NVD disclosure day
CVE-2026-107910
Halo Surface Signal: 3 out of 5 — possibly public-facing.
An improper authentication vulnerability in FalkorDB's Bolt endpoint allows unauthenticated remote attackers to execute graph queries by exploiting flawed logic in the authentication function. If the Bolt endpoint is enabled, certain operational errors can cause the system to incorrectly authenticate attackers, grantin
CVE-2026-107908
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A heap-based out-of-bounds write in FalkorDB's Bolt protocol handler may allow unauthenticated remote attackers to cause a denial of service or execute code by sending a crafted message, but only affects deployments where the Bolt endpoint is enabled.
CVE-2026-7827
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A stack-based buffer overflow in FalkorDB's graph decoders could allow a remote attacker to cause a denial of service or execute code by sending a crafted RDB stream, impacting service availability and integrity.
CVE-2026-5759
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
FalkorDB's RDB decoders contain a double free and use-after-free vulnerability in the `RdbLoadDeletedNodes` function. An attacker could exploit this by sending a crafted RDB stream to an unprotected instance, potentially leading to denial of service or arbitrary code execution. The primary concern is confirming FalkorD