These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-63763 is a confused deputy privilege escalation vulnerability in SurrealDB before 2.5.0 and before 3.0.0-beta.3. The vulnerability allows unprivileged users to create or modify fields containing futures, functions, or closures, which can be executed with higher-privileged user permissions. This can lead to full privilege escalation, including creation of a root owner and server takeover. Users of [truncated]
CVE-2026-63762 is a denial of service vulnerability in SurrealDB's embedded JavaScript scripting engine, enabled via the --allow-scripting capability. Users with query execution capabilities can trigger a null pointer dereference, causing the server process to terminate immediately. This vulnerability affects users who have enabled --allow-scripting or --allow-guests. The issue was addressed by updating t [truncated]
CVE-2026-63761 is a medium-severity vulnerability affecting SurrealDB before version 3.1.0. The issue arises when a JWT access method is configured with the ES512 algorithm, which is silently substituted with ES384 due to limitations in the underlying jsonwebtoken crate. This substitution leads to authentication handshake failures for users who provide the correct P-521 key for ES512, as ES384 expects a P [truncated]
CVE-2026-63760 is a denial-of-service vulnerability in SurrealDB before version 3.1.0. The vulnerability occurs because the configured recursion depth limit is not enforced in the value and JSON parser when processing nested braces, brackets, or parentheses. This allows unauthenticated attackers to send deeply nested JSON payloads to the WebSocket /rpc endpoint, exhausting server memory and crashing the p [truncated]
CVE-2026-63759 is a high-severity vulnerability in SurrealDB before version 3.1.0. The issue arises from the failure to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can exploit this by sending queries with deeply nested type annotations, leading to server memory exhaustion and process crashes.
CVE-2026-63758 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability allows authenticated database users to terminate other users' LIVE SELECT subscriptions by issuing KILL statements with target live query UUIDs without ownership verification. This issue affects SurrealDB deployments where multiple users have access to the database, potentially disrupting real-tim [truncated]
CVE-2026-63757 is a session hijacking vulnerability in SurrealDB versions before 3.1.0. The HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. This allows unauthenticated attackers to enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges. The vulner [truncated]
CVE-2026-63756 is a critical vulnerability in SurrealDB versions before 3.1.0. The issue is a time-of-check/time-of-use race condition in the HTTP /rpc endpoint. This allows unauthenticated attackers to send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active, potentially leading to the execution of operations with hijacked user privileges.
CVE-2026-63755 is a high-severity vulnerability in SurrealDB, a database management system. The vulnerability allows an authenticated user, including Record and Scope users, to bypass table-level permission checks and read the full contents of any table in the database they are authenticated against. This is achieved by exploiting the ordering flaw in the evaluation of user-supplied WHERE clauses in SELEC [truncated]
CVE-2026-63754 is a denial of service vulnerability in SurrealDB versions before 3.1.0. An authenticated user with select permission can cause all CREATE, UPDATE, and DELETE operations on a table to fail by registering a LIVE query that triggers evaluation errors. This can lead to significant disruption of database operations. Users should be aware of this vulnerability and take steps to mitigate it.
CVE-2026-63753 is a vulnerability in SurrealDB before version 3.1.0. The issue causes the database to fail refreshing authentication state in LIVE SELECT subscriptions when session state changes. As a result, attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes. The CVSS score for this vulnerability is 5.3, classified as MEDIUM s [truncated]
CVE-2026-63752 is an authorization bypass vulnerability in SurrealDB before version 3.1.0. The vulnerability exists in the RELATE statement, allowing authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. This can be exploited by issuing a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite [truncated]
CVE-2026-63751 is a field-level permission bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability allows authenticated users to read protected fields using JSON Patch operations. Specifically, attackers can exploit this vulnerability by using UPDATE PATCH with an empty 'from' pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SE [truncated]
SurrealDB versions before 3.1.0 have a vulnerability in their WebSocket implementation. The SURREAL_WEBSOCKET_MAX_MESSAGE_SIZE limit is not applied to anonymous /sql WebSocket connections. This allows attackers to send large WebSocket frames, potentially leading to memory amplification and degradation of /sql availability. The vulnerability can be exploited by streaming large WebSocket frames across multi [truncated]
CVE-2026-63749 is an authentication bypass vulnerability in SurrealDB versions before 3.1.0. The vulnerability exists in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. This allows authenticated subscribers to bind chosen values to these parameter names and register LIVE SE [truncated]
CVE-2026-63748 is an information disclosure vulnerability in SurrealDB versions before 3.1.0. Authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. The vulnerability is triggered by arithmetic or extend operations on hidden fields, embedding raw operand values in error responses and bypassing field-level access controls. This vulnerab [truncated]
CVE-2026-63746 is a high-severity vulnerability in SurrealDB versions before 3.1.0. The issue allows authenticated users to read records from any table reachable through graph edges, regardless of the target table's SELECT permissions. This occurs due to a failure in enforcing table SELECT permissions when traversing graph edges or back-references. The vulnerability has significant implications for data a [truncated]
CVE-2026-63745 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. Authenticated users can spoof composite record-id field values by writing to editable body fields, bypassing permission rules that gate access on id components like tenant isolation. This vulnerability has a CVSS score of 5.3 and is considered Medium severity. Users of SurrealDB versions before 3.1.0 should apply p [truncated]
A server-side request forgery vulnerability was discovered in SurrealDB before version 3.1.5. The vulnerability exists in the JWKS fetcher, which follows HTTP redirects without re-validating redirect targets against network capabilities. This allows attackers with Owner role to configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access contr [truncated]
CVE-2026-63743 is a capability bypass vulnerability in SurrealDB before 3.1.0. An authenticated user can exploit this vulnerability to circumvent port-scoped --deny-net rules by chaining an HTTP redirect from an allowed hostname to a denied host:port combination. The redirect is followed because the port information is dropped during redirect policy evaluation. This vulnerability has a CVSS score of 5.3 a [truncated]
CVE-2026-63742 is a field-level SELECT permission bypass vulnerability in SurrealDB versions before 3.1.0. This issue affects indexed COUNT fast paths, allowing attackers to execute COUNT queries on indexed fields with field-level SELECT restrictions. This can lead to the confirmation or recovery of restricted field values through repeated guesses. The CVSS score for this vulnerability is 5.3, with a seve [truncated]
SurrealDB versions before 3.1.4 have a vulnerability where record users can read array elements that should be denied by exploiting incorrect index handling during permission filtering. This issue allows attackers with record scope access to access sensitive data. The vulnerability arises from a flaw in the permission filtering mechanism for array elements, potentially leading to unauthorized access to se [truncated]
CVE-2026-63739 is an arbitrary file read vulnerability in SurrealDB before 3.1.5. The vulnerability exists in the DEFINE ANALYZER mapper filter and allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file contents through query error messages when the SURREAL_FILE_ALLOWLIST is empty [truncated]
CVE-2026-63738 is a medium-severity vulnerability in SurrealDB versions 3.1.0 before 3.1.5. The issue allows attackers with table-level SELECT access to read field values hidden by field-level permissions through graph-edge or back-reference traversals. This vulnerability can potentially lead to unauthorized data access. Users of SurrealDB versions 3.1.0 before 3.1.5 should assess their exposure and apply [truncated]
CVE-2026-63737 is a denial of service vulnerability in SurrealDB versions before 3.1.5. Authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack overflow during query processing and aborting the entire process. This vulnerability can have a signif [truncated]
CVE-2026-63736 is a server-side request forgery vulnerability in SurrealDB before 3.2.0. The vulnerability exists in the JWKS fetcher, which validates only the URL hostname string against allow-lists without checking resolved IP addresses. An attacker with the Owner role can exploit this vulnerability by pointing an access method at an allow-listed hostname resolving to private or loopback addresses, caus [truncated]
CVE-2026-63735 is a high-severity vulnerability in SurrealDB, a database management system. Versions before 3.2.0 fail to validate namespace and database scope in custom API routes. This oversight allows authenticated users to invoke endpoints in different namespaces or databases by specifying the target scope in the URL path. Consequently, attackers with valid credentials for any namespace or database ca [truncated]
CVE-2026-63734 is a denial of service vulnerability in SurrealDB versions before 3.2.0. The vulnerability is located in the SurrealML header parser and allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other malformed header fields that trigger unchecked unwrap calls, causing a pan [truncated]
CVE-2026-63733 is a permissions bypass vulnerability in SurrealDB versions before 3.2.0. The vulnerability allows attackers with permission to perform a guarded operation to write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption. This vulnerability has a CVSS score of 5.3 and a severity of [truncated]
CVE-2025-71397 is a high-severity vulnerability in SurrealDB that allows authenticated users with OWNER or EDITOR permissions to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is constrained, nesting multiple loops is not, enabling an attacker to execute a function that consumes all server CPU time. This can render the server unrespons [truncated]