{"schema_version":1,"title":"SurrealDB vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 39 vulnerabilities in SurrealDB: 0 in the last 7 days and 34 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, SurrealDB improper authorization in field permissions, was published on 18 July 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/surrealdb","json_url":"https://junglewise.ai/threats/vendors/surrealdb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/surrealdb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":7,"all_time":39,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":34,"last_365_days":39},"latest":[{"cvss":6.5,"slug":"surrealdb-improper-authorization-in-field-permissions-50d5e9e6","title":"SurrealDB improper authorization in field permissions","severity":"medium","exploited":false,"published_at":"2026-07-18T15:31:49+00:00","url":"https://junglewise.ai/threats/surrealdb-improper-authorization-in-field-permissions-50d5e9e6"},{"cvss":4.9,"slug":"surrealdb-uncaught-exception-in-role-conversion-3f7ddccb","title":"SurrealDB uncaught exception in role conversion","severity":"medium","exploited":false,"published_at":"2026-07-18T15:31:48+00:00","url":"https://junglewise.ai/threats/surrealdb-uncaught-exception-in-role-conversion-3f7ddccb"},{"cvss":6.3,"slug":"surrealdb-authentication-bypass-when-changing-databases-as-scope-user-928458d3","title":"SurrealDB authentication bypass when changing databases as scope user","severity":"medium","exploited":false,"published_at":"2026-07-18T15:31:48+00:00","url":"https://junglewise.ai/threats/surrealdb-authentication-bypass-when-changing-databases-as-scope-user-928458d3"},{"cvss":6.3,"slug":"surrealdb-silent-failure-to-overwrite-table-definition-for-relation-80222378","title":"SurrealDB silent failure to overwrite table definition for relation types","severity":"medium","exploited":false,"published_at":"2026-07-18T15:31:47+00:00","url":"https://junglewise.ai/threats/surrealdb-silent-failure-to-overwrite-table-definition-for-relation-80222378"},{"cve":"CVE-2024-58367","cvss":6.5,"epss":0.0036,"slug":"cve-2024-58367-surrealdb-improper-authorization-in-field-permissions","title":"SurrealDB improper authorization in field permissions","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:09.737+00:00","url":"https://junglewise.ai/threats/cve-2024-58367-surrealdb-improper-authorization-in-field-permissions"},{"cve":"CVE-2024-58366","cvss":8.5,"epss":0.0058,"slug":"cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting","title":"SurrealDB format string vulnerability in rquickjs scripting engine","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.6+00:00","url":"https://junglewise.ai/threats/cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting"},{"cve":"CVE-2024-58363","cvss":6.3,"epss":0.0034,"slug":"cve-2024-58363-surrealdb-improper-authentication-during-database-switch","title":"SurrealDB improper authentication during database switch","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:09.187+00:00","url":"https://junglewise.ai/threats/cve-2024-58363-surrealdb-improper-authentication-during-database-switch"},{"cve":"CVE-2024-58362","cvss":8.8,"epss":0.0064,"slug":"cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations","title":"SurrealDB query injection in RPC API signin and signup operations","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.047+00:00","url":"https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations"},{"cve":"CVE-2024-58361","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58361-surrealdb-denial-of-service-via-uncaught-exception-in-parser","title":"SurrealDB denial of service via uncaught exception in parser","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.917+00:00","url":"https://junglewise.ai/threats/cve-2024-58361-surrealdb-denial-of-service-via-uncaught-exception-in-parser"},{"cve":"CVE-2024-58359","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58359-surrealdb-denial-of-service-in-order-by-rand-sorting","title":"SurrealDB denial of service in ORDER BY rand() sorting","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.78+00:00","url":"https://junglewise.ai/threats/cve-2024-58359-surrealdb-denial-of-service-in-order-by-rand-sorting"},{"cve":"CVE-2024-58358","cvss":4.9,"epss":0.0047,"slug":"cve-2024-58358-surrealdb-denial-of-service-via-nonexistent-role-conversion","title":"SurrealDB denial of service via nonexistent role conversion","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.643+00:00","url":"https://junglewise.ai/threats/cve-2024-58358-surrealdb-denial-of-service-via-nonexistent-role-conversion"},{"cve":"CVE-2024-58357","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58357-surrealdb-denial-of-service-via-uncaught-exception-in-rand-time","title":"SurrealDB denial of service via uncaught exception in rand::time","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.503+00:00","url":"https://junglewise.ai/threats/cve-2024-58357-surrealdb-denial-of-service-via-uncaught-exception-in-rand-time"},{"cve":"CVE-2024-58356","cvss":4,"epss":0.0027,"slug":"cve-2024-58356-surrealdb-incorrect-permission-application-in-define-table","title":"SurrealDB incorrect permission application in DEFINE TABLE OVERWRITE","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.363+00:00","url":"https://junglewise.ai/threats/cve-2024-58356-surrealdb-incorrect-permission-application-in-define-table"},{"cve":"CVE-2026-63309","cvss":4.3,"slug":"cve-2026-63309-surrealdb-information-disclosure-via-order-by-clause","title":"SurrealDB information disclosure via ORDER BY clause","severity":"medium","exploited":false,"published_at":"2026-07-17T17:17:17.717+00:00","url":"https://junglewise.ai/threats/cve-2026-63309-surrealdb-information-disclosure-via-order-by-clause"},{"cvss":4.3,"slug":"surrealdb-silent-jwt-algorithm-downgrade-from-es512-to-es384-cb812308","title":"SurrealDB silent JWT algorithm downgrade from ES512 to ES384","severity":"medium","exploited":false,"published_at":"2026-07-01T20:23:01+00:00","url":"https://junglewise.ai/threats/surrealdb-silent-jwt-algorithm-downgrade-from-es512-to-es384-cb812308"},{"cvss":4.3,"slug":"surrealdb-authorization-bypass-in-indexed-count-queries-50d17fc5","title":"SurrealDB authorization bypass in indexed COUNT queries","severity":"medium","exploited":false,"published_at":"2026-07-01T20:22:06+00:00","url":"https://junglewise.ai/threats/surrealdb-authorization-bypass-in-indexed-count-queries-50d17fc5"},{"cvss":6.5,"slug":"surrealdb-missing-authorization-for-implicit-resource-creation-in-use-58639d34","title":"SurrealDB missing authorization for implicit resource creation in USE statements","severity":"medium","exploited":false,"published_at":"2026-07-01T20:21:25+00:00","url":"https://junglewise.ai/threats/surrealdb-missing-authorization-for-implicit-resource-creation-in-use-58639d34"},{"cvss":6.4,"slug":"surrealdb-ssrf-via-port-specific-deny-rule-bypass-in-http-redirects-5bade041","title":"SurrealDB SSRF via port-specific deny rule bypass in HTTP redirects","severity":"medium","exploited":false,"published_at":"2026-07-01T20:20:40+00:00","url":"https://junglewise.ai/threats/surrealdb-ssrf-via-port-specific-deny-rule-bypass-in-http-redirects-5bade041"},{"cvss":4.3,"slug":"surrealdb-incorrect-authorization-in-live-select-subscriptions-00a28bab","title":"SurrealDB incorrect authorization in LIVE SELECT subscriptions","severity":"medium","exploited":false,"published_at":"2026-07-01T20:20:00+00:00","url":"https://junglewise.ai/threats/surrealdb-incorrect-authorization-in-live-select-subscriptions-00a28bab"},{"cvss":4.3,"slug":"surrealdb-authorization-bypass-via-relate-statement-record-overwrite-4d44d965","title":"SurrealDB authorization bypass via RELATE statement record overwrite","severity":"medium","exploited":false,"published_at":"2026-07-01T20:19:17+00:00","url":"https://junglewise.ai/threats/surrealdb-authorization-bypass-via-relate-statement-record-overwrite-4d44d965"},{"cvss":4.3,"slug":"surrealdb-authorization-bypass-in-json-patch-copy-and-move-operations-95a1d296","title":"SurrealDB authorization bypass in JSON Patch copy and move operations","severity":"medium","exploited":false,"published_at":"2026-07-01T20:18:06+00:00","url":"https://junglewise.ai/threats/surrealdb-authorization-bypass-in-json-patch-copy-and-move-operations-95a1d296"},{"cvss":4.3,"slug":"surrealdb-information-disclosure-via-error-messages-in-arithmetic-0b7afd0c","title":"SurrealDB information disclosure via error messages in arithmetic operators","severity":"medium","exploited":false,"published_at":"2026-07-01T20:16:52+00:00","url":"https://junglewise.ai/threats/surrealdb-information-disclosure-via-error-messages-in-arithmetic-0b7afd0c"},{"cvss":4.3,"slug":"surrealdb-insufficient-session-expiration-in-live-query-subscriptions-7fd95fb5","title":"SurrealDB insufficient session expiration in LIVE query subscriptions","severity":"medium","exploited":false,"published_at":"2026-07-01T20:16:12+00:00","url":"https://junglewise.ai/threats/surrealdb-insufficient-session-expiration-in-live-query-subscriptions-7fd95fb5"},{"cvss":5.3,"slug":"surrealdb-memory-amplification-in-sql-websocket-endpoint-6da5e698","title":"SurrealDB memory amplification in /sql WebSocket endpoint","severity":"medium","exploited":false,"published_at":"2026-07-01T20:15:03+00:00","url":"https://junglewise.ai/threats/surrealdb-memory-amplification-in-sql-websocket-endpoint-6da5e698"},{"cvss":5.4,"slug":"surrealdb-authorization-bypass-in-kill-statement-cdd89814","title":"SurrealDB authorization bypass in KILL statement","severity":"medium","exploited":false,"published_at":"2026-07-01T20:14:20+00:00","url":"https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-cdd89814"}],"vendor":{"hub":true,"name":"SurrealDB","slug":"surrealdb","homepage":"https://surrealdb.com","description":"SurrealDB is a multi-model database supporting graph, document, and relational data with real-time collaboration features.","url":"https://junglewise.ai/threats/vendors/surrealdb"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":14},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2024-58362","cvss":8.8,"epss":0.0064,"slug":"cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations","title":"SurrealDB query injection in RPC API signin and signup operations","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.047+00:00","url":"https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations"},{"cvss":8.8,"slug":"surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef","title":"SurrealDB session hijacking via HTTP RPC session leak","severity":"high","exploited":false,"published_at":"2026-07-01T20:00:17+00:00","url":"https://junglewise.ai/threats/surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef"},{"cve":"CVE-2024-58366","cvss":8.5,"epss":0.0058,"slug":"cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting","title":"SurrealDB format string vulnerability in rquickjs scripting engine","severity":"high","exploited":false,"published_at":"2026-07-18T14:17:09.6+00:00","url":"https://junglewise.ai/threats/cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting"},{"cvss":8.1,"slug":"surrealdb-privilege-escalation-via-http-rpc-session-race-condition-871af91c","title":"SurrealDB privilege escalation via HTTP RPC session race condition","severity":"high","exploited":false,"published_at":"2026-07-01T20:02:06+00:00","url":"https://junglewise.ai/threats/surrealdb-privilege-escalation-via-http-rpc-session-race-condition-871af91c"},{"cvss":7.7,"slug":"surrealdb-arbitrary-file-read-in-define-analyzer-mapper-filter-ca70a4da","title":"SurrealDB arbitrary file read in DEFINE ANALYZER mapper filter","severity":"high","exploited":false,"published_at":"2026-06-19T22:10:48+00:00","url":"https://junglewise.ai/threats/surrealdb-arbitrary-file-read-in-define-analyzer-mapper-filter-ca70a4da"},{"cvss":7.5,"slug":"surrealdb-unauthenticated-remote-dos-in-rpc-use-handler-295d4555","title":"SurrealDB unauthenticated remote DoS in RPC use handler","severity":"high","exploited":false,"published_at":"2026-07-01T20:04:22+00:00","url":"https://junglewise.ai/threats/surrealdb-unauthenticated-remote-dos-in-rpc-use-handler-295d4555"},{"cvss":7.5,"slug":"surrealdb-uncontrolled-recursion-in-json-parser-34ffeed1","title":"SurrealDB uncontrolled recursion in JSON parser","severity":"high","exploited":false,"published_at":"2026-07-01T20:03:33+00:00","url":"https://junglewise.ai/threats/surrealdb-uncontrolled-recursion-in-json-parser-34ffeed1"},{"cve":"CVE-2024-58361","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58361-surrealdb-denial-of-service-via-uncaught-exception-in-parser","title":"SurrealDB denial of service via uncaught exception in parser","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.917+00:00","url":"https://junglewise.ai/threats/cve-2024-58361-surrealdb-denial-of-service-via-uncaught-exception-in-parser"},{"cve":"CVE-2024-58359","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58359-surrealdb-denial-of-service-in-order-by-rand-sorting","title":"SurrealDB denial of service in ORDER BY rand() sorting","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.78+00:00","url":"https://junglewise.ai/threats/cve-2024-58359-surrealdb-denial-of-service-in-order-by-rand-sorting"},{"cve":"CVE-2024-58357","cvss":6.5,"epss":0.0045,"slug":"cve-2024-58357-surrealdb-denial-of-service-via-uncaught-exception-in-rand-time","title":"SurrealDB denial of service via uncaught exception in rand::time","severity":"medium","exploited":false,"published_at":"2026-07-18T14:17:08.503+00:00","url":"https://junglewise.ai/threats/cve-2024-58357-surrealdb-denial-of-service-via-uncaught-exception-in-rand-time"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"Surrealdb-Core","slug":"surrealdb-core","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/surrealdb-core"}]}