Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: surrealdb 2.1.0 Clear all filters
TI-2024-38443 CVE-2024-58359 · GHSA-gjm5-72ch-9675

SurrealDB before 2.1.0 Denial of Service via rand() Sorting

Priority LOW 32

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0045 Published 2026-07-18 Fixed in 2.1.0 CWE-248
TI-2024-38442 CVE-2024-58358 · GHSA-jc55-246c-r88f

SurrealDB before 2.1.0 Denial of Service via Nonexistent Role

Priority LOW 31

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00472 Published 2026-07-18 Fixed in 2.1.0 CWE-248
TI-2024-38441 CVE-2024-58357 · GHSA-3h9v-xwgf-h5c5

SurrealDB before 2.1.0 Denial of Service via rand::time()

Priority LOW 32

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0045 Published 2026-07-18 Fixed in 2.1.0 CWE-248