Spicedb
Vendor:
First CVE: Jan 11, 2022 · Active for 4 years
13
Total CVEs
More Total CVEs than 91% of tracked products
2.6
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
5.8
Avg CVSS
Higher Avg CVSS than 17% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Spicedb over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 11, 2022
4 years ago
Most Recent CVE
Apr 15, 2026
100 days ago
CVE Severity & Scoring
Spicedb13 CVEs
69%
15%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (7.7%)
Network12 (92.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None11 (84.6%)
Unknown0 (0.0%)
Required2 (15.4%)
Privileges Required
Low2 (15.4%)
High2 (15.4%)
None9 (69.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-21646HIGH SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or | Jan 11, 2022 | 8.1 | 26 | NO | NO |
CVE-2024-27101CRITICAL SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatc | Mar 1, 2024 | 9.1 | 25 | NO | NO |
CVE-2023-29193HIGH SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a fla | Apr 14, 2023 | 7.5 | 24 | NO | NO |
CVE-2025-64529MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator som | Nov 10, 2025 | 6.5 | 20 | NO | NO |
CVE-2023-46255MEDIUM SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided dat | Oct 31, 2023 | 6.5 | 19 | NO | NO |
CVE-2026-40091MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level | Apr 15, 2026 | 4.4 | 18 | NO | NO |
CVE-2025-65111MEDIUM SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following character | Nov 21, 2025 | 5.3 | 18 | NO | NO |
CVE-2025-49011MEDIUM SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relat | Jun 6, 2025 | 5.3 | 17 | NO | NO |
CVE-2024-38361MEDIUM Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has | Jun 20, 2024 | 5.3 | 17 | NO | NO |
CVE-2024-46989MEDIUM spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Multiple caveats over the same indirect sub | Sep 18, 2024 | 5.3 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Spicedb
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.3.0 | 1 | 8.1 | 1.5% | 0 | 0 |
| 1.22.0 | 1 | 5.3 | 0.4% | 0 | 0 |