Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-10130 (GCVE-0-2026-10130)

Vulnerability from cvelistv5 – Published: 2026-07-18 22:15 – Updated: 2026-07-18 22:15

Title

QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts

Summary

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim's identity without requiring any prior credentials or user interaction.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck

References

3 references

URL	Tags
https://github.com/FalkorDB/QueryWeaver	product
https://github.com/FalkorDB/QueryWeaver/commit/e6…	patch
https://www.vulncheck.com/advisories/queryweaver-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FalkorDB	QueryWeaver	Affected: 0 , ≤ 0.2.0 (git) Unaffected: 0.3.1 (git)

Date Public

2026-07-18 00:00

Credits

Katriel Moses

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "QueryWeaver",
          "vendor": "FalkorDB",
          "versions": [
            {
              "lessThanOrEqual": "0.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "status": "unaffected",
              "version": "0.3.1",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Katriel Moses"
        }
      ],
      "datePublic": "2026-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eQueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim\u0027s identity without requiring any prior credentials or user interaction.\u003c/p\u003e"
            }
          ],
          "value": "QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim\u0027s identity without requiring any prior credentials or user interaction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T22:15:13.688Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Product Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/FalkorDB/QueryWeaver"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FalkorDB/QueryWeaver/commit/e6a49f508191d0f1bdad0f146da43819e7849f18"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/queryweaver-authentication-bypass-via-email-signup-token-issuance-for-existing-accounts"
        }
      ],
      "title": "QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-10130",
    "datePublished": "2026-07-18T22:15:13.688Z",
    "dateReserved": "2026-05-29T18:28:14.533Z",
    "dateUpdated": "2026-07-18T22:15:13.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57857 (GCVE-0-2026-57857)

Vulnerability from cvelistv5 – Published: 2026-07-18 20:33 – Updated: 2026-07-18 20:53

Title

Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

Summary

The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck

References

2 references

URL	Tags
https://www.flow.cl/	product
https://www.vulncheck.com/advisories/flow-payment…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Flow	Flow Payment	Affected: 0 , ≤ 3.0.8 (semver) Unaffected: 3.0.9 (semver)

Date Public

2026-07-18 00:00

Credits

Quarancle

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Flow Payment",
          "vendor": "Flow",
          "versions": [
            {
              "lessThanOrEqual": "3.0.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Quarancle"
        }
      ],
      "datePublic": "2026-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}\u0026cancel_order=true\u0026error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim\u0027s browser in the origin of the WordPress site."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T20:53:33.051Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Vendor Website",
          "tags": [
            "product"
          ],
          "url": "https://www.flow.cl/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/flow-payment-plugin-for-wordpress-reflected-cross-site-scripting-via-error-message-parameter"
        }
      ],
      "title": "Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-57857",
    "datePublished": "2026-07-18T20:33:06.674Z",
    "dateReserved": "2026-06-25T18:48:00.282Z",
    "dateUpdated": "2026-07-18T20:53:33.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53994 (GCVE-0-2026-53994)

Vulnerability from cvelistv5 – Published: 2026-07-18 19:30 – Updated: 2026-07-18 19:30

Title

ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation

Summary

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck

References

3 references

URL	Tags
https://github.com/proftpd/proftpd	product
https://github.com/proftpd/proftpd/commit/7342836…	patch
https://www.vulncheck.com/advisories/proftpd-mod-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ProFTPD Project	ProFTPD	Affected: 0 , < 1.3.10 (git)

Date Public

2026-07-18 00:00

Credits

devnull445

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "ProFTPD",
          "vendor": "ProFTPD Project",
          "versions": [
            {
              "lessThan": "1.3.10",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "devnull445"
        }
      ],
      "datePublic": "2026-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T19:30:32.740Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Product",
          "tags": [
            "product"
          ],
          "url": "https://github.com/proftpd/proftpd"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/proftpd/proftpd/commit/7342836fa98e36209660a4c5805c801476f63936"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-unsigned-integer-underflow-and-size-truncation"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-53994",
    "datePublished": "2026-07-18T19:30:32.740Z",
    "dateReserved": "2026-06-11T16:07:13.001Z",
    "dateUpdated": "2026-07-18T19:30:32.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57848 (GCVE-0-2026-57848)

Vulnerability from cvelistv5 – Published: 2026-07-18 19:15 – Updated: 2026-07-18 19:15

Title

Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Summary

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filter the incoming URI before using it as the outgoing attachment, so a caller can pass a file:// URI pointing at the application's own internal storage (for example /data/data/chat.revolt/databases/revolt.db, cached authentication token files, or preferences) and have the app treat that internal file as a user-selected attachment. An attacker who can invoke intents on the victim's device (via ADB access, a co-installed malicious application, or any other route that reaches Android's intent dispatch) can launch ShareTargetActivity with such a URI and cause the victim, on a single channel-selection interaction, to send the internal file to any Stoat channel or user of the attacker's choosing. The composer displays the attachment as \"attachment\" with no filename indication, so the victim has no visible signal that the file being sent is their own internal application data. Consequences include disclosure of the local Stoat database (message history, contact list, cached content), disclosure of authentication tokens permitting full account takeover, and disclosure of any other file readable by the app process.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-926 - Improper Export of Android Application Components

Assigner

VulnCheck

References

3 references

URL	Tags
https://github.com/stoatchat/for-android	product
https://github.com/stoatchat/for-android/commit/5…	patch
https://www.vulncheck.com/advisories/stoat-for-an…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
stoatchat	Stoat for Android	Affected: 0 , < 1.6.0 (git)

Date Public

2026-07-17 00:00

Credits

Monokle

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Stoat for Android",
          "vendor": "stoatchat",
          "versions": [
            {
              "lessThan": "1.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Monokle"
        }
      ],
      "datePublic": "2026-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filter the incoming URI before using it as the outgoing attachment, so a caller can pass a file:// URI pointing at the application\u0027s own internal storage (for example /data/data/chat.revolt/databases/revolt.db, cached authentication token files, or preferences) and have the app treat that internal file as a user-selected attachment. An attacker who can invoke intents on the victim\u0027s device (via ADB access, a co-installed malicious application, or any other route that reaches Android\u0027s intent dispatch) can launch ShareTargetActivity with such a URI and cause the victim, on a single channel-selection interaction, to send the internal file to any Stoat channel or user of the attacker\u0027s choosing. The composer displays the attachment as \\\"attachment\\\" with no filename indication, so the victim has no visible signal that the file being sent is their own internal application data. Consequences include disclosure of the local Stoat database (message history, contact list, cached content), disclosure of authentication tokens permitting full account takeover, and disclosure of any other file readable by the app process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "Improper Export of Android Application Components",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T19:15:18.458Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Product",
          "tags": [
            "product"
          ],
          "url": "https://github.com/stoatchat/for-android"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/stoatchat/for-android/commit/50d5f5143940809ebb5a61e5f507c956c33aa970"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stoat-for-android-internal-file-disclosure-via-exported-sharetargetactivity-uri-validation"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-57848",
    "datePublished": "2026-07-18T19:15:18.458Z",
    "dateReserved": "2026-06-25T18:48:00.282Z",
    "dateUpdated": "2026-07-18T19:15:18.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9323 (GCVE-0-2026-9323)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:51 – Updated: 2026-07-18 13:51

Title

Insecure PRNG and Information Exposure in urwid Web Display Backend

Summary

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Assigner

VulnCheck

References

6 references

URL	Tags
https://github.com/urwid/urwid/security/advisorie…	technical-description
https://github.com/urwid/urwid	product
https://github.com/urwid/urwid/commit/24acd12f0d0…	patch
https://github.com/urwid/urwid/issues/1127	technical-description
https://github.com/urwid/urwid/pull/1128
https://www.vulncheck.com/advisories/insecure-prn…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
urwid	urwid	Affected: 0 , ≤ 24acd12 (git)

Date Public

2026-07-18 00:00

Credits

Katriel Moses

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "urwid",
          "vendor": "urwid",
          "versions": [
            {
              "lessThanOrEqual": "24acd12",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Katriel Moses"
        }
      ],
      "datePublic": "2026-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python\u0027s Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim\u0027s terminal screen via the polling endpoint, inject keystrokes into the victim\u0027s session (yielding OS-level code execution with the session owner\u0027s privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-338",
              "description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:51:06.021Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv"
        },
        {
          "name": "Product",
          "tags": [
            "product"
          ],
          "url": "https://github.com/urwid/urwid"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/urwid/urwid/commit/24acd12f0d0598036d0d577f2ee63e4a27b4a3d9"
        },
        {
          "name": "GitHub Issue",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/urwid/urwid/issues/1127"
        },
        {
          "name": "Pull Request",
          "url": "https://github.com/urwid/urwid/pull/1128"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/insecure-prng-and-information-exposure-in-urwid-web-display-backend"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insecure PRNG and Information Exposure in urwid Web Display Backend",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-9323",
    "datePublished": "2026-07-18T13:51:06.021Z",
    "dateReserved": "2026-05-22T20:56:42.239Z",
    "dateUpdated": "2026-07-18T13:51:06.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11826 (GCVE-0-2026-11826)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:35 – Updated: 2026-07-18 13:35

Title

OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()

Summary

OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

VulnCheck

References

4 references

URL	Tags
https://gist.github.com/Shukhrat-03/5cf1825b72e48…	technical-description
https://github.com/thiagoralves/OpenPLC_v3/commit…	issue-tracking
https://github.com/thiagoralves/OpenPLC_v3	product
https://www.vulncheck.com/advisories/openplc-v3-h…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
openplcproject	OpenPLC_v3	Affected: 0 , ≤ b470206 (git)

Date Public

2026-07-17 00:00

Credits

Shuhratbek Uraimov Shuhratbek Uraimov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "OpenPLC_v3",
          "vendor": "openplcproject",
          "versions": [
            {
              "lessThanOrEqual": "b470206",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shuhratbek Uraimov"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Shuhratbek Uraimov"
        }
      ],
      "datePublic": "2026-07-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:35:35.639Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Gist",
          "tags": [
            "technical-description"
          ],
          "url": "https://gist.github.com/Shukhrat-03/5cf1825b72e485ef98a32958dfbc611a#security-vulnerability-report"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/thiagoralves/OpenPLC_v3/commit/b4702061dc14d1024856f71b4543298d77007b88"
        },
        {
          "name": "Product",
          "tags": [
            "product"
          ],
          "url": "https://github.com/thiagoralves/OpenPLC_v3"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openplc-v3-heap-based-buffer-overflow-in-modbus-master-getdata"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-11826",
    "datePublished": "2026-07-18T13:35:35.639Z",
    "dateReserved": "2026-06-09T19:53:45.722Z",
    "dateUpdated": "2026-07-18T13:35:35.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71398 (GCVE-0-2025-71398)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass

Summary

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to access internal endpoints and retrieve sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:15.797Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5q9x-554g-9jgg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5q9x-554g-9jgg"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-http-redirect-bypass"
        }
      ],
      "title": "SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71398",
    "datePublished": "2026-07-18T13:10:15.797Z",
    "dateReserved": "2026-07-18T12:38:41.076Z",
    "dateUpdated": "2026-07-18T13:10:15.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71397 (GCVE-0-2025-71397)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops

Summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop\u0027s iteration count is constrained, nesting multiple loops (e.g., each with 1,000,000 iterations) is not, so an attacker can execute a function that consumes all server CPU time. Configured timeouts do not stop the execution, rendering the server unresponsive to other queries and connections until it is manually restarted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:15.129Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-pxw4-94j3-v9pf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-pxw4-94j3-v9pf"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-cpu-exhaustion-via-nested-for-loops"
        }
      ],
      "title": "SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71397",
    "datePublished": "2026-07-18T13:10:15.129Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:15.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71396 (GCVE-0-2025-71396)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting

Summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting capability is explicitly enabled (via --allow-scripting or --allow-all). An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause a denial of service. Scripting is disabled by default."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:14.441Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3824-qmfq-2qv7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting"
        }
      ],
      "title": "SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71396",
    "datePublished": "2026-07-18T13:10:14.441Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:14.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71395 (GCVE-0-2025-71395)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 Memory Exhaustion via string::replace

Summary

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:13.744Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3633-g6mg-p6qq)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3633-g6mg-p6qq"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via string::replace",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-string-replace"
        }
      ],
      "title": "SurrealDB before 2.2.2 Memory Exhaustion via string::replace",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71395",
    "datePublished": "2026-07-18T13:10:13.744Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:13.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71394 (GCVE-0-2025-71394)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER

Summary

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file system. Attackers with root, namespace, or database level privileges can point analyzers to arbitrary file paths and exfiltrate content from two-column tab-separated files."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:13.041Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2cvj-g5r5-jrrg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2cvj-g5r5-jrrg"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-local-file-read-via-define-analyzer"
        }
      ],
      "title": "SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71394",
    "datePublished": "2026-07-18T13:10:13.041Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:13.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71393 (GCVE-0-2025-71393)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions

Summary

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-674 - Uncontrolled Recursion

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can bypass the recursion limit by chaining native and JavaScript function calls to trigger infinite recursion and exhaust server memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:12.360Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m7rc-8w7m-r9qr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m7rc-8w7m-r9qr"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-memory-exhaustion-via-nested-functions"
        }
      ],
      "title": "SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71393",
    "datePublished": "2026-07-18T13:10:12.360Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:12.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71392 (GCVE-0-2025-71392)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 SurrealQL Injection via export

Summary

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

cure53

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "cure53"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently imports the exported backup, the injected SurrealQL executes, enabling privilege escalation and root-level takeover of the SurrealDB instance. Applications that let users define custom tables or fields are also exposed to a universal second-order SurrealQL injection even when query parameters are sanitized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:11.661Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-ccj3-5p93-8p42)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-ccj3-5p93-8p42"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 SurrealQL Injection via export",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-surrealql-injection-via-export"
        }
      ],
      "title": "SurrealDB before 2.2.2 SurrealQL Injection via export",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71392",
    "datePublished": "2026-07-18T13:10:11.661Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:11.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71391 (GCVE-0-2025-71391)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.2.2 Denial of Service via /sql endpoint

Summary

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.2.2 (semver) Unaffected: 2.2.2 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.1.5 (semver) Unaffected: 2.1.5 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.5 (semver) Unaffected: 2.0.5 (semver)

Date Public

2025-04-10 00:00

Credits

castilho101

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "castilho101"
        }
      ],
      "datePublic": "2025-04-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted HTTP queries containing null bytes to the /sql endpoint, causing an unhandled exception that crashes the SurrealDB instance and any dependent applications."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:10.977Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rq86-9m6r-cm3g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-rq86-9m6r-cm3g"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.2.2 Denial of Service via /sql endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-sql-endpoint"
        }
      ],
      "title": "SurrealDB before 2.2.2 Denial of Service via /sql endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71391",
    "datePublished": "2026-07-18T13:10:10.977Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:10.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71390 (GCVE-0-2025-71390)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution

Summary

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.3.6, 2.2.6 (semver) Unaffected: 2.3.6, 2.2.6 (semver)

Date Public

2025-06-26 00:00

Credits

manelmontilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.3.6, 2.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.3.6, 2.2.6",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manelmontilla"
        }
      ],
      "datePublic": "2025-06-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::\u003cfn\u003e(\u003curl\u003e) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:10.319Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m3c3-78fh-w3w7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution"
        }
      ],
      "title": "SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71390",
    "datePublished": "2026-07-18T13:10:10.319Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-18T13:10:10.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58370 (GCVE-0-2024-58370)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service

Summary

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.1.0 (semver) Unaffected: 1.1.0 (semver)

Date Public

2024-01-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause stack overflow and crash the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:09.658Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6r8p-hpg7-825g)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6r8p-hpg7-825g"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-uncontrolled-recursion-denial-of-service"
        }
      ],
      "title": "SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58370",
    "datePublished": "2026-07-18T13:10:09.658Z",
    "dateReserved": "2026-07-18T12:40:52.917Z",
    "dateUpdated": "2026-07-18T13:10:09.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58369 (GCVE-0-2024-58369)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.1.1 Denial of Service via Global Parameters

Summary

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.1.1 (semver) Unaffected: 1.1.1 (semver)

Date Public

2024-01-17 00:00

Credits

Tu0Laj1 jabis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tu0Laj1"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "jabis"
        }
      ],
      "datePublic": "2024-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the SurrealDB server, resulting in denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:08.965Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jm4v-58r5-66hj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm4v-58r5-66hj"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.1.1 Denial of Service via Global Parameters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-global-parameters"
        }
      ],
      "title": "SurrealDB before 1.1.1 Denial of Service via Global Parameters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58369",
    "datePublished": "2026-07-18T13:10:08.965Z",
    "dateReserved": "2026-07-18T12:40:52.917Z",
    "dateUpdated": "2026-07-18T13:10:08.965Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58368 (GCVE-0-2024-58368)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.1.0 Denial of Service via HTTP Headers

Summary

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.1.0 (semver) Unaffected: 1.1.0 (semver)

Date Public

2024-01-17 00:00

Credits

Tu0Laj1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Tu0Laj1"
        }
      ],
      "datePublic": "2024-01-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:08.303Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m24x-r6q3-2vp9)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m24x-r6q3-2vp9"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.1.0 Denial of Service via HTTP Headers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-http-headers"
        }
      ],
      "title": "SurrealDB before 1.1.0 Denial of Service via HTTP Headers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58368",
    "datePublished": "2026-07-18T13:10:08.303Z",
    "dateReserved": "2026-07-18T12:40:52.917Z",
    "dateUpdated": "2026-07-18T13:10:08.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58367 (GCVE-0-2024-58367)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions

Summary

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-285 - Improper Authorization

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.0.4 (semver) Unaffected: 2.0.4 (semver)

Date Public

2024-10-08 00:00

Credits

5hanth Xkonti

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "5hanth"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Xkonti"
        }
      ],
      "datePublic": "2024-10-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:07.604Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9722-9j67-vjcr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"
        }
      ],
      "title": "SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58367",
    "datePublished": "2026-07-18T13:10:07.604Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:07.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58366 (GCVE-0-2024-58366)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.1.1 Format String via Scripting Functions

Summary

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

Severity

9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.1.1 (semver) Unaffected: 1.1.1 (semver)
surrealdb	surrealdb	Affected: 0 , < 0.4.2 (semver) Unaffected: 0.4.2 (semver)

Date Public

2024-02-19 00:00

Credits

akkie

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.1.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/rquickjs",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "0.4.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "akkie"
        }
      ],
      "datePublic": "2024-02-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:06.939Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q3gg-m8hr-h4x4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q3gg-m8hr-h4x4"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.1.1 Format String via Scripting Functions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-format-string-via-scripting-functions"
        }
      ],
      "title": "SurrealDB before 1.1.1 Format String via Scripting Functions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58366",
    "datePublished": "2026-07-18T13:10:06.939Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:06.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58365 (GCVE-0-2024-58365)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.2.0 Denial of Service via Nonexistent Function

Summary

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.2.0 (semver) Unaffected: 1.2.0 (semver)

Date Public

2024-02-19 00:00

Credits

idofilus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "idofilus"
        }
      ],
      "datePublic": "2024-02-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:06.241Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6wr5-jmpr-mjcx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wr5-jmpr-mjcx"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.2.0 Denial of Service via Nonexistent Function",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-function"
        }
      ],
      "title": "SurrealDB before 1.2.0 Denial of Service via Nonexistent Function",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58365",
    "datePublished": "2026-07-18T13:10:06.241Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:06.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58364 (GCVE-0-2024-58364)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.2.1 Denial of Service via Parsing Error

Summary

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.2.1 (semver) Unaffected: 1.2.1 (semver)

Date Public

2024-02-19 00:00

Credits

Cheyenne1025

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Cheyenne1025"
        }
      ],
      "datePublic": "2024-02-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in the span rendering code, crashing the server and causing denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:05.569Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-8xff-473h-f863)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8xff-473h-f863"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.2.1 Denial of Service via Parsing Error",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parsing-error"
        }
      ],
      "title": "SurrealDB before 1.2.1 Denial of Service via Parsing Error",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58364",
    "datePublished": "2026-07-18T13:10:05.569Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:05.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58363 (GCVE-0-2024-58363)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.5.4 Authentication Bypass via Database Switch

Summary

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.5.4 (semver) Unaffected: 1.5.4 (semver)
surrealdb	surrealdb	Affected: 0 , < 2.0.0-alpha.6 (semver) Unaffected: 2.0.0-alpha.6 (semver)
surrealdb	surrealdb	Affected: 0 , < 1.5.1 (semver) Unaffected: 1.5.1 (semver)

Date Public

2024-07-10 00:00

Credits

ericwhitefield

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.5.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.0-alpha.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.0-alpha.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.5.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.5.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ericwhitefield"
        }
      ],
      "datePublic": "2024-07-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:04.938Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-gh9f-6xm2-c4j2)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.5.4 Authentication Bypass via Database Switch",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch"
        }
      ],
      "title": "SurrealDB before 1.5.4 Authentication Bypass via Database Switch",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58363",
    "datePublished": "2026-07-18T13:10:04.938Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:04.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58362 (GCVE-0-2024-58362)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.5.5 Query Injection via RPC API

Summary

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.5.5, 2.0.0-beta.3 (semver) Unaffected: 1.5.5, 2.0.0-beta.3 (semver)
surrealdb	surrealdb	Affected: 0 , < 1.5.2 (semver) Unaffected: 1.5.2 (semver)

Date Public

2024-09-11 00:00

Credits

RaphaelDarley

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.5.5, 2.0.0-beta.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.5.5, 2.0.0-beta.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.5.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "RaphaelDarley"
        }
      ],
      "datePublic": "2024-09-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner\u0027s SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:04.263Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-64f8-pjgr-9wmr)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.5.5 Query Injection via RPC API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api"
        }
      ],
      "title": "SurrealDB before 1.5.5 Query Injection via RPC API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58362",
    "datePublished": "2026-07-18T13:10:04.263Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:04.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58361 (GCVE-0-2024-58361)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.0.4 Denial of Service via Parser Exception

Summary

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 2.0.0 , < 2.0.4 (semver) Unaffected: 2.0.4 (semver)

Date Public

2024-10-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.0.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-10-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:03.607Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qjrv-v6qp-x99x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-qjrv-v6qp-x99x"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.0.4 Denial of Service via Parser Exception",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-parser-exception"
        }
      ],
      "title": "SurrealDB before 2.0.4 Denial of Service via Parser Exception",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58361",
    "datePublished": "2026-07-18T13:10:03.607Z",
    "dateReserved": "2026-07-18T12:40:52.916Z",
    "dateUpdated": "2026-07-18T13:10:03.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58359 (GCVE-0-2024-58359)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.1.0 Denial of Service via rand() Sorting

Summary

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.1.0 (semver) Unaffected: 2.1.0 (semver)

Date Public

2024-11-22 00:00

Credits

finnbear extrawurst

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "finnbear"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "extrawurst"
        }
      ],
      "datePublic": "2024-11-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:02.920Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m52v-24p8-654f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m52v-24p8-654f"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via rand() Sorting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-sorting"
        }
      ],
      "title": "SurrealDB before 2.1.0 Denial of Service via rand() Sorting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58359",
    "datePublished": "2026-07-18T13:10:02.920Z",
    "dateReserved": "2026-06-08T15:20:35.497Z",
    "dateUpdated": "2026-07-18T13:10:02.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58358 (GCVE-0-2024-58358)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.1.0 Denial of Service via Nonexistent Role

Summary

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.1.0 (semver) Unaffected: 2.1.0 (semver)

Date Public

2024-11-22 00:00

Credits

garyhai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "garyhai"
        }
      ],
      "datePublic": "2024-11-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:02.254Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jc55-246c-r88f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via Nonexistent Role",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role"
        }
      ],
      "title": "SurrealDB before 2.1.0 Denial of Service via Nonexistent Role",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58358",
    "datePublished": "2026-07-18T13:10:02.254Z",
    "dateReserved": "2026-06-08T15:20:35.497Z",
    "dateUpdated": "2026-07-18T13:10:02.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58357 (GCVE-0-2024-58357)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.1.0 Denial of Service via rand::time()

Summary

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics and cause denial of service.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.1.0 (semver) Unaffected: 2.1.0 (semver)

Date Public

2024-11-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-11-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliably trigger server panics and cause denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:01.549Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h4f5-h82v-5w4r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4f5-h82v-5w4r"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via rand::time()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-rand-time"
        }
      ],
      "title": "SurrealDB before 2.1.0 Denial of Service via rand::time()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58357",
    "datePublished": "2026-07-18T13:10:01.549Z",
    "dateReserved": "2026-06-08T15:20:35.497Z",
    "dateUpdated": "2026-07-18T13:10:01.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-58356 (GCVE-0-2024-58356)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE

Summary

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CWE

CWE-276 - Incorrect Default Permissions

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 2.1.4 (semver) Unaffected: 2.1.4 (semver)

Date Public

2024-12-16 00:00

Credits

AlbertMarashi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb-core",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "2.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.1.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "AlbertMarashi"
        }
      ],
      "datePublic": "2024-12-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table\u0027s permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:00.884Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-27vq-hv74-7cqp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite"
        }
      ],
      "title": "SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2024-58356",
    "datePublished": "2026-07-18T13:10:00.884Z",
    "dateReserved": "2026-06-08T15:20:35.497Z",
    "dateUpdated": "2026-07-18T13:10:00.884Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54366 (GCVE-0-2023-54366)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-18 13:10

Title

SurrealDB before 1.0.1 Insecure Default Table Permissions

Summary

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-276 - Incorrect Default Permissions

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 1.0.1 (semver) Unaffected: 1.0.1 (semver)

Date Public

2023-12-14 00:00

Credits

LucyEgan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "1.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LucyEgan"
        }
      ],
      "datePublic": "2023-12-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T13:10:00.190Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-x5fr-7hhj-34j3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 1.0.1 Insecure Default Table Permissions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions"
        }
      ],
      "title": "SurrealDB before 1.0.1 Insecure Default Table Permissions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-54366",
    "datePublished": "2026-07-18T13:10:00.190Z",
    "dateReserved": "2026-06-22T21:54:30.246Z",
    "dateUpdated": "2026-07-18T13:10:00.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

4878 vulnerabilities

CVE-2026-10130 (GCVE-0-2026-10130)

CVE-2026-57857 (GCVE-0-2026-57857)

CVE-2026-53994 (GCVE-0-2026-53994)

CVE-2026-57848 (GCVE-0-2026-57848)

CVE-2026-9323 (GCVE-0-2026-9323)

CVE-2026-11826 (GCVE-0-2026-11826)

CVE-2025-71398 (GCVE-0-2025-71398)

CVE-2025-71397 (GCVE-0-2025-71397)

CVE-2025-71396 (GCVE-0-2025-71396)

CVE-2025-71395 (GCVE-0-2025-71395)

CVE-2025-71394 (GCVE-0-2025-71394)

CVE-2025-71393 (GCVE-0-2025-71393)

CVE-2025-71392 (GCVE-0-2025-71392)

CVE-2025-71391 (GCVE-0-2025-71391)

CVE-2025-71390 (GCVE-0-2025-71390)

CVE-2024-58370 (GCVE-0-2024-58370)

CVE-2024-58369 (GCVE-0-2024-58369)

CVE-2024-58368 (GCVE-0-2024-58368)

CVE-2024-58367 (GCVE-0-2024-58367)

CVE-2024-58366 (GCVE-0-2024-58366)

CVE-2024-58365 (GCVE-0-2024-58365)

CVE-2024-58364 (GCVE-0-2024-58364)

CVE-2024-58363 (GCVE-0-2024-58363)

CVE-2024-58362 (GCVE-0-2024-58362)

CVE-2024-58361 (GCVE-0-2024-58361)

CVE-2024-58359 (GCVE-0-2024-58359)

CVE-2024-58358 (GCVE-0-2024-58358)

CVE-2024-58357 (GCVE-0-2024-58357)

CVE-2024-58356 (GCVE-0-2024-58356)

CVE-2023-54366 (GCVE-0-2023-54366)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

4878 vulnerabilities

CVE-2026-10130 (GCVE-0-2026-10130)

CVE-2026-57857 (GCVE-0-2026-57857)

CVE-2026-53994 (GCVE-0-2026-53994)

CVE-2026-57848 (GCVE-0-2026-57848)

CVE-2026-9323 (GCVE-0-2026-9323)

CVE-2026-11826 (GCVE-0-2026-11826)

CVE-2025-71398 (GCVE-0-2025-71398)

CVE-2025-71397 (GCVE-0-2025-71397)

CVE-2025-71396 (GCVE-0-2025-71396)

CVE-2025-71395 (GCVE-0-2025-71395)

CVE-2025-71394 (GCVE-0-2025-71394)

CVE-2025-71393 (GCVE-0-2025-71393)

CVE-2025-71392 (GCVE-0-2025-71392)

CVE-2025-71391 (GCVE-0-2025-71391)

CVE-2025-71390 (GCVE-0-2025-71390)

CVE-2024-58370 (GCVE-0-2024-58370)

CVE-2024-58369 (GCVE-0-2024-58369)

CVE-2024-58368 (GCVE-0-2024-58368)

CVE-2024-58367 (GCVE-0-2024-58367)

CVE-2024-58366 (GCVE-0-2024-58366)

CVE-2024-58365 (GCVE-0-2024-58365)

CVE-2024-58364 (GCVE-0-2024-58364)

CVE-2024-58363 (GCVE-0-2024-58363)

CVE-2024-58362 (GCVE-0-2024-58362)

CVE-2024-58361 (GCVE-0-2024-58361)

CVE-2024-58359 (GCVE-0-2024-58359)

CVE-2024-58358 (GCVE-0-2024-58358)

CVE-2024-58357 (GCVE-0-2024-58357)

CVE-2024-58356 (GCVE-0-2024-58356)

CVE-2023-54366 (GCVE-0-2023-54366)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.