Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

608 advisories

Loading
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions Moderate
CVE-2026-63733 was published for surrealdb-core (Rust) Sep 4, 2026
sondt99 Credited to sondt99
Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions Moderate
GHSA-6g69-7xmf-h2x7 was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation Moderate
CVE-2026-63761 was published for surrealdb (Rust) Jul 1, 2026
q1uf3ng Credited to q1uf3ng
Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation Moderate
GHSA-gw59-x2xr-wwvr was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level Moderate
CVE-2026-63755 was published for surrealdb (Rust) Jul 1, 2026
LucyEgan Credited to LucyEgan
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries Moderate
CVE-2026-63758 was published for surrealdb (Rust) Jul 1, 2026
Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries Moderate
GHSA-mf42-3c8q-x7x8 was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Moderate
CVE-2026-63743 was published for surrealdb (Rust) Jul 1, 2026
Duplicate Advisory: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Moderate
GHSA-vq7c-3hc9-m5hr was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Graph traversal bypasses table SELECT permissions Moderate
CVE-2026-63746 was published for surrealdb (Rust) Jul 1, 2026
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` Moderate
CVE-2026-63751 was published for surrealdb (Rust) Jul 1, 2026
Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` Moderate
GHSA-8pr5-wpg9-2h74 was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Moderate
CVE-2026-63748 was published for surrealdb (Rust) Jul 1, 2026
Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Moderate
GHSA-p7hp-79jj-q923 was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals Moderate
CVE-2026-63738 was published for surrealdb (Rust) Jun 19, 2026
Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals Moderate
GHSA-9c3h-q3pp-fw5x was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users Moderate
CVE-2026-63740 was published for surrealdb (Rust) Aug 14, 2026
msanchezdev Credited to msanchezdev
SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) Moderate
CVE-2025-71398 was published for surrealdb (Rust) Apr 11, 2025
cure53 Credited to cure53
Duplicate Advisory: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF) Moderate
GHSA-xhwm-9486-8rgr was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
SurrealDB has an Uncaught Exception Handling Nonexistent Role Moderate
CVE-2024-58358 was published for surrealdb (Rust) Nov 22, 2024
garyhai Credited to garyhai
Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role Moderate
GHSA-9qrf-6whp-92w3 was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User Moderate
GHSA-hgp5-pm7v-q8vg was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
SurrealDB allows bypass of deny-net flags via DNS resolution Moderate
CVE-2025-71390 was published for SurrealDB (Rust) Sep 4, 2026
manelmontilla Credited to manelmontilla
Duplicate Advisory: SurrealDB allows bypass of deny-net flags via DNS resolution Moderate
GHSA-vp9r-94xg-q7q8 was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
Duplicate Advisory: SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field Moderate
GHSA-2f98-6626-h2p2 was published for surrealdb (Rust) Jul 17, 2026 • withdrawn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database