Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51856
Total
4111
Critical
15381
High
15070
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-71393 | UNKNOWN | — | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can … | Jul 18, 2026 |
| CVE-2025-71392 | UNKNOWN | — | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated … | Jul 18, 2026 |
| CVE-2025-71391 | UNKNOWN | — | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the database. Attackers can send crafted … | Jul 18, 2026 |
| CVE-2025-71390 | UNKNOWN | — | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An … | Jul 18, 2026 |
| CVE-2024-58370 | MEDIUM | 6.5 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can … | Jul 18, 2026 |
| CVE-2024-58369 | MEDIUM | 6.5 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can … | Jul 18, 2026 |
| CVE-2024-58368 | HIGH | 7.5 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can … | Jul 18, 2026 |
| CVE-2024-58367 | UNKNOWN | — | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through … | Jul 18, 2026 |
| CVE-2024-58366 | HIGH | 8.5 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string … | Jul 18, 2026 |
| CVE-2024-58365 | MEDIUM | 6.5 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed … | Jul 18, 2026 |
| CVE-2024-58364 | MEDIUM | 6.5 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can … | Jul 18, 2026 |
| CVE-2024-58363 | MEDIUM | 6.3 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated … | Jul 18, 2026 |
| CVE-2024-58362 | HIGH | 8.8 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it … | Jul 18, 2026 |
| CVE-2024-58361 | MEDIUM | 6.5 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed … | Jul 18, 2026 |
| CVE-2024-58359 | MEDIUM | 6.5 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries … | Jul 18, 2026 |
| CVE-2024-58358 | MEDIUM | 4.9 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers … | Jul 18, 2026 |
| CVE-2024-58357 | MEDIUM | 6.5 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. … | Jul 18, 2026 |
| CVE-2024-58356 | UNKNOWN | — | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because … | Jul 18, 2026 |
| CVE-2023-54366 | HIGH | 8.8 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers … | Jul 18, 2026 |
| CVE-2026-9147 | HIGH | 7.8 | uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for … | Jul 18, 2026 |
| CVE-2026-59173 | UNKNOWN | — | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended … | Jul 18, 2026 |
| CVE-2026-16158 | HIGH | 8.7 | Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without … | Jul 18, 2026 |
| CVE-2026-15631 | HIGH | 8.7 | Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket … | Jul 18, 2026 |
| CVE-2026-16097 | HIGH | 8.8 | A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the function sub_42537C of the component Scheduler Name Handler. The manipulation of the argument … | Jul 18, 2026 |
| CVE-2026-16096 | HIGH | 8.8 | A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulation leads … | Jul 18, 2026 |