Live CVE & 0day intelligence

Sound the depths of every vulnerability.

Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.

Browse the feed For agents → /llms.txt

Depth = severity + exploitation

HadalCritical and actively exploited (CISA KEV / 0day)
AbyssalCritical with a public exploit or in-the-wild use
MidnightCritical, or high with PoC / in-the-wild
TwilightHigh severity, or a signal on a lesser flaw
SunlitLow / medium · no exploitation signal

74878

Tracked CVEs

6999

Critical

765

Exploited in wild

5500

Last 7 days

Trending now

Bluesky + Hacker News mentions, last 7 days

1CVE-2026-109618Critical· 9.2RCE via OOM corruption4896
2CVE-2026-109619Critical· 9.2RCE via stale global state2196
3CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder1892
4CVE-2026-110264Critical· 10.0Integer Overflow or Wraparound in GitLab367
5CVE-2026-112816Critical· 10.0Improper certificate validation in the HTTPS listener in LXD367
6CVE-2026-116366Critical· 9.5Unauthenticated RCE vulnerability against ClickHouse Server364
7CVE-2026-97631Critical· 9.5Pre-boot RCE in EDK II PXE driver264
8CVE-2026-91403Critical· 9.1Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)262

This week's digest →All digests

Feed

87 matches

CVE-2026-121416High· 7.1

3d ago

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who c…

▾ Twilightsurrealdb · surrealdbEPSS 0.31%via CVEORG

CVE-2026-121420Low· 3.3

3d ago

SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP…

▾ Sunlitsurrealdb · surrealdbEPSS 0.16%via CVEORG

CVE-2026-121417High· 7.8PoC

3d ago

SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispa…

▾ Midnightsurrealdb · surrealdbEPSS 0.20%via CVEORG

CVE-2026-121421Medium· 4.3PoC

3d ago

SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check …

▾ Twilightsurrealdb · surrealdbEPSS 0.33%via CVEORG

CVE-2026-121423Medium· 6.5

3d ago

SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapp…

▾ Sunlitsurrealdb · surrealdbEPSS 0.34%via CVEORG

CVE-2026-121419High· 8.1

3d ago

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privile…

▾ Twilightsurrealdb · surrealdbEPSS 0.32%via CVEORG

CVE-2026-121422Medium· 4.1

3d ago

SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass

SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or re…

▾ Sunlitsurrealdb · surrealdbEPSS 0.25%via CVEORG

CVE-2026-121418Medium· 4.3

3d ago

SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attac…

▾ Sunlitsurrealdb · surrealdbEPSS 0.20%via CVEORG

CVE-2026-109343High· 8.1

3w ago

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or re…

▾ Twilightsurrealdb · surrealdbEPSS 0.26%via NVD

CVE-2026-109342Medium· 5.4

3w ago

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attac…

▾ Sunlitsurrealdb · surrealdbEPSS 0.28%via NVD

CVE-2026-109341High· 7.1

3w ago

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use…

▾ Twilightsurrealdb · surrealdbEPSS 0.26%via NVD

CVE-2026-109340Medium· 5.4

3w ago

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a reference…

▾ Sunlitsurrealdb · surrealdbEPSS 0.24%via NVD

CVE-2026-109339Medium· 4.9

3w ago

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed mal…

▾ Sunlitsurrealdb · surrealdbEPSS 0.38%via NVD

CVE-2026-109338Medium· 6.5

3w ago

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via He…

▾ Sunlitsurrealdb · surrealdbEPSS 0.31%via NVD

CVE-2026-109337Medium· 4.3

3w ago

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft …

▾ Sunlitsurrealdb · surrealdbEPSS 0.24%via NVD

CVE-2026-109336Medium· 4.3

3w ago

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unre…

▾ Sunlitsurrealdb · surrealdbEPSS 0.22%via NVD

CVE-2026-109335Medium· 6.5

3w ago

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMP…

▾ Sunlitsurrealdb · surrealdbEPSS 0.30%via NVD

CVE-2026-109334High· 8.1

3w ago

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surr…

▾ Twilightsurrealdb · surrealdbEPSS 0.26%via NVD

CVE-2026-109333Medium· 6.5

3w ago

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a for…

▾ Sunlitsurrealdb · surrealdbEPSS 0.29%via NVD

CVE-2026-102876High· 8.1

1mo ago

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB head…

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB head…

▾ Twilightsurrealdb · surrealdbEPSS 0.27%via NVD

CVE-2026-63735High· 8.1

2mo ago

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

▾ Twilightsurrealdb · surrealdbEPSS 0.37%via GHSA

CVE-2026-63740Medium· 6.5

2mo ago

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

▾ Sunlitsurrealdb · surrealdbEPSS 0.36%via OSV

GHSA-8rw6-p7m8-63jpMedium· 6.5

2mo ago

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

▾ Sunlitsurrealdb · surrealdbvia GHSA

CVE-2026-63745Medium· 5.4

3mo ago

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access…

▾ Sunlitsurrealdb · surrealdbEPSS 0.25%via NVD

CVE-2026-63746Medium· 6.5

3mo ago

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's P…

▾ Sunlitsurrealdb · surrealdbEPSS 0.40%via NVD

From the blog

All posts →

Oct 27, 2026

Sound the depths of every vulnerability.

Trending now

Feed

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass

SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB head…

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial

Sound the depths of every vulnerability.

Trending now

Feed

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses

SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backends

SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass

SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization

SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision

SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass

SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB head…

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references

From the blog

VulnSea has moved to vulnsea.com (and what changed since September)

What's new: open corpus, three new MCP tools, vendor advisories, package pages

Wiring VulnSea into an agent: a hands-on tutorial