{"schema_version":1,"title":"surrealdb (crates.io) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 118 vulnerabilities in surrealdb (crates.io): 0 in the last 7 days and 107 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to…, was published on 20 July 2026.","url":"https://junglewise.ai/threats/technologies/surrealdb","json_url":"https://junglewise.ai/threats/technologies/surrealdb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/surrealdb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":18,"all_time":118,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":107,"last_365_days":116},"latest":[{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-es512-silently-downgraded-to-es384-due-to-e04b1ff5","title":"Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:11+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-es512-silently-downgraded-to-es384-due-to-e04b1ff5"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-has-denial-of-service-in-json-parser-due-4a35277e","title":"Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:11+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-has-denial-of-service-in-json-parser-due-4a35277e"},{"cvss":4.3,"slug":"surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8","title":"SurrealDB ES512 algorithm silently downgraded to ES384","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:11+00:00","url":"https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8"},{"cvss":7.5,"slug":"surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0","title":"SurrealDB JSON parser denial of service via uncontrolled recursion","severity":"high","exploited":false,"published_at":"2026-07-20T12:33:11+00:00","url":"https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-authorization-bypass-in-kill-statement-5e4f8426","title":"Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:10+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-authorization-bypass-in-kill-statement-5e4f8426"},{"cvss":5.4,"slug":"surrealdb-authorization-bypass-in-kill-statement-fc230d0f","title":"SurrealDB authorization bypass in KILL statement","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:10+00:00","url":"https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f"},{"cvss":6.5,"slug":"surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001","title":"SurrealDB permission bypass via WHERE clause evaluation","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:10+00:00","url":"https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-scraping-a-table-with-no-available-6c182f18","title":"Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:10+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-scraping-a-table-with-no-available-6c182f18"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-graph-traversal-bypasses-table-select-d916e3ce","title":"Duplicate Advisory: SurrealDB: Graph traversal bypasses table SELECT permissions","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-graph-traversal-bypasses-table-select-d916e3ce"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-authenticated-callers-can-read-fields-4932bd06","title":"Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-authenticated-callers-can-read-fields-4932bd06"},{"cvss":6.5,"slug":"surrealdb-graph-traversal-bypasses-table-select-permissions-e4d46f5f","title":"SurrealDB graph traversal bypasses table SELECT permissions","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/surrealdb-graph-traversal-bypasses-table-select-permissions-e4d46f5f"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-port-specific-deny-net-rules-silently-fa3aafa3","title":"Duplicate Advisory: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-port-specific-deny-net-rules-silently-fa3aafa3"},{"cvss":4.3,"slug":"surrealdb-field-level-permission-bypass-in-json-patch-93126efa","title":"SurrealDB field-level permission bypass in JSON Patch","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/surrealdb-field-level-permission-bypass-in-json-patch-93126efa"},{"cvss":6.4,"slug":"surrealdb-port-specific-deny-net-rule-bypass-on-http-redirect-855c5516","title":"SurrealDB port-specific deny-net rule bypass on HTTP redirect","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/surrealdb-port-specific-deny-net-rule-bypass-on-http-redirect-855c5516"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-has-bypass-of-field-level-select-ea545ec1","title":"Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-has-bypass-of-field-level-select-ea545ec1"},{"cvss":4.3,"slug":"surrealdb-information-disclosure-via-error-messages-96515867","title":"SurrealDB information disclosure via error messages","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:09+00:00","url":"https://junglewise.ai/threats/surrealdb-information-disclosure-via-error-messages-96515867"},{"cvss":6.5,"slug":"surrealdb-array-element-level-select-permissions-bypass-b5926e1a","title":"SurrealDB array element-level SELECT permissions bypass","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/surrealdb-array-element-level-select-permissions-bypass-b5926e1a"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-array-element-level-field-select-7f66607a","title":"Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-array-element-level-field-select-7f66607a"},{"cvss":4.3,"slug":"surrealdb-permissions-bypass-via-permissions-clause-3674ec45","title":"SurrealDB permissions bypass via PERMISSIONS clause","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/surrealdb-permissions-bypass-via-permissions-clause-3674ec45"},{"cvss":3.1,"slug":"duplicate-advisory-writes-in-a-permissions-clause-bypass-table-354a55d3","title":"Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-writes-in-a-permissions-clause-bypass-table-354a55d3"},{"cvss":4.3,"slug":"surrealdb-field-level-select-permission-bypass-via-graph-traversals-1a29fcf0","title":"SurrealDB field-level SELECT permission bypass via graph traversals","severity":"medium","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/surrealdb-field-level-select-permission-bypass-via-graph-traversals-1a29fcf0"},{"cvss":3.1,"slug":"duplicate-advisory-custom-api-route-lets-authenticated-callers-override-970e2c8d","title":"Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-custom-api-route-lets-authenticated-callers-override-970e2c8d"},{"cvss":3.1,"slug":"duplicate-advisory-surrealdb-field-level-select-permissions-bypassed-33bf15c3","title":"Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals","severity":"low","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-surrealdb-field-level-select-permissions-bypassed-33bf15c3"},{"cvss":8.1,"slug":"surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d","title":"SurrealDB custom API route namespace/database scope bypass","severity":"high","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d"},{"cve":"CVE-2026-63761","cvss":4.3,"epss":0.0028,"slug":"cve-2026-63761-surrealdb-cryptographic-algorithm-substitution-in-jwt-access","title":"SurrealDB cryptographic algorithm substitution in JWT access method","severity":"medium","exploited":false,"published_at":"2026-07-20T12:19:46.33+00:00","url":"https://junglewise.ai/threats/cve-2026-63761-surrealdb-cryptographic-algorithm-substitution-in-jwt-access"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":40},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":35},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"coreutils (crates.io)","slug":"crates-io-coreutils","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/crates-io-coreutils"},{"name":"wasmtime (crates.io)","slug":"wasmtime","vulnerabilities":42,"url":"https://junglewise.ai/threats/technologies/wasmtime"},{"name":"deno (crates.io)","slug":"deno","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/deno"},{"name":"zebrad (crates.io)","slug":"zebrad","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/zebrad"},{"name":"openssl-src (crates.io)","slug":"openssl-src","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/openssl-src"},{"name":"openssl (crates.io)","slug":"crates-io-openssl","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/crates-io-openssl"},{"name":"rustfs (crates.io)","slug":"rustfs","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/rustfs"},{"name":"ckb (crates.io)","slug":"ckb","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/ckb"},{"name":"diesel (crates.io)","slug":"diesel","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/diesel"},{"name":"pyo3 (crates.io)","slug":"pyo3","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/pyo3"},{"name":"russh (crates.io)","slug":"crates-io-russh","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/crates-io-russh"},{"name":"deepseek-tui (crates.io)","slug":"deepseek-tui","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/deepseek-tui"}],"technology":{"hub":true,"name":"surrealdb (crates.io)","slug":"surrealdb","vendor":{"name":"crates.io","slug":"crates-io","url":"https://junglewise.ai/threats/vendors/crates-io"},"aliases":[],"homepage":"https://surrealdb.com/","repo_url":"https://github.com/surrealdb/surrealdb","description":"A multi-model database written in Rust designed for serverless, web, and mobile applications.","url":"https://junglewise.ai/threats/technologies/surrealdb"},"most_severe":[{"cve":"CVE-2024-58362","cvss":8.8,"epss":0.0064,"slug":"cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations","title":"SurrealDB query injection in RPC API signin and signup operations","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.047+00:00","url":"https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations"},{"cve":"CVE-2023-54366","cvss":8.8,"epss":0.0046,"slug":"cve-2023-54366-surrealdb-insecure-default-table-permissions","title":"SurrealDB insecure default table permissions","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:07.603+00:00","url":"https://junglewise.ai/threats/cve-2023-54366-surrealdb-insecure-default-table-permissions"},{"cvss":8.8,"slug":"surrealdb-deny-net-bypass-via-dns-resolution-54b52c8a","title":"SurrealDB deny-net bypass via DNS resolution","severity":"high","exploited":false,"published_at":"2026-07-18T15:31:49+00:00","url":"https://junglewise.ai/threats/surrealdb-deny-net-bypass-via-dns-resolution-54b52c8a"},{"cvss":8.8,"slug":"surrealdb-insecure-default-table-permissions-36fa4a9b","title":"SurrealDB insecure default table permissions","severity":"high","exploited":false,"published_at":"2026-07-18T15:31:47+00:00","url":"https://junglewise.ai/threats/surrealdb-insecure-default-table-permissions-36fa4a9b"},{"cvss":8.8,"slug":"surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef","title":"SurrealDB session hijacking via HTTP RPC session leak","severity":"high","exploited":false,"published_at":"2026-07-01T20:00:17+00:00","url":"https://junglewise.ai/threats/surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef"},{"cve":"CVE-2024-58366","cvss":8.5,"epss":0.0058,"slug":"cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting","title":"SurrealDB format string vulnerability in rquickjs scripting engine","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.6+00:00","url":"https://junglewise.ai/threats/cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting"},{"cve":"CVE-2026-63735","cvss":8.1,"epss":0.0037,"slug":"cve-2026-63735-surrealdb-authorization-bypass-in-custom-api-routes","title":"SurrealDB authorization bypass in custom API routes","severity":"high","exploited":false,"published_at":"2026-07-20T12:19:42.563+00:00","url":"https://junglewise.ai/threats/cve-2026-63735-surrealdb-authorization-bypass-in-custom-api-routes"},{"cvss":8.1,"slug":"surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d","title":"SurrealDB custom API route namespace/database scope bypass","severity":"high","exploited":false,"published_at":"2026-07-20T12:33:08+00:00","url":"https://junglewise.ai/threats/surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d"},{"cvss":8.1,"slug":"surrealdb-privilege-escalation-via-http-rpc-session-race-condition-871af91c","title":"SurrealDB privilege escalation via HTTP RPC session race condition","severity":"high","exploited":false,"published_at":"2026-07-01T20:02:06+00:00","url":"https://junglewise.ai/threats/surrealdb-privilege-escalation-via-http-rpc-session-race-condition-871af91c"},{"cvss":8,"slug":"surrealdb-surrealql-injection-in-backup-export-import-ffe1bfaf","title":"SurrealDB SurrealQL injection in backup export/import","severity":"high","exploited":false,"published_at":"2026-07-18T15:31:49+00:00","url":"https://junglewise.ai/threats/surrealdb-surrealql-injection-in-backup-export-import-ffe1bfaf"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}