Arcadedata vulnerabilities

Products

• Arcadedb 42

Newest

• arcadedata arcadedb ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections CVE-2026-119577 7.6 HighOctober 30, 2026
• arcadedata arcadedb ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint CVE-2026-119576 5.3 MediumOctober 30, 2026
• arcadedata arcadedb ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List CVE-2026-119575 7.1 HighOctober 30, 2026
• arcadedata arcadedb ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization CVE-2026-114059 7.7 HighOctober 21, 2026
• arcadedata arcadedb ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol CVE-2026-114058 5.3 MediumOctober 21, 2026
• arcadedata arcadedb ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure CVE-2026-114057 5.3 MediumOctober 21, 2026
• arcadedata arcadedb ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH CVE-2026-114056 5.3 MediumOctober 21, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle CVE-2026-93598 7.1 HighSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses CVE-2026-93597 5.3 MediumSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect CVE-2026-93596 5.3 MediumSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 ACL Bypass via query_database Tool CVE-2026-93595 7.1 HighSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries CVE-2026-93594 7.1 HighSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission CVE-2026-93593 8.6 HighSeptember 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV CVE-2026-76225 8.3 HighAugust 19, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback CVE-2026-76224 8.7 HighAugust 19, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION CVE-2026-76223 7.1 HighAugust 19, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Path Traversal via create/drop database CVE-2026-75855 Public exploit 8.4 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB Redis Wire-Protocol Plugin Missing Authentication CVE-2026-75854 9.3 CriticalAugust 18, 2026
• arcadedata arcadedb ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database CVE-2026-75853 8.7 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB MongoDB wire protocol authentication bypass cross-database CVE-2026-75852 9.3 CriticalAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Authentication Bypass via Async Command CVE-2026-75851 9.4 CriticalAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers CVE-2026-75850 2.3 LowAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION CVE-2026-75846 7.1 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting CVE-2026-75845 5.3 MediumAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass CVE-2026-75844 7.1 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction CVE-2026-75843 9.4 CriticalAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV CVE-2026-75842 8.3 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Denial of Service via range() CVE-2026-75841 5.3 MediumAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex CVE-2026-75840 8.7 HighAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints CVE-2026-75839 5.3 MediumAugust 18, 2026
• arcadedata arcadedb ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport CVE-2026-68578 7.7 HighAugust 2, 2026
• arcadedata arcadedb ArcadeDB before 26.7.3 Information Disclosure via get_server_settings CVE-2026-67357 7.7 HighAugust 2, 2026
• arcadedata arcadedb ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger CVE-2026-67356 8.7 HighAugust 2, 2026
• arcadedata arcadedb ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE CVE-2026-67344 8.5 HighAugust 1, 2026
• arcadedata arcadedb ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server CVE-2026-67343 8.7 HighAugust 1, 2026
• arcadedata arcadedb ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers CVE-2026-67342 Fix available 9.3 CriticalJuly 16, 2026
• arcadedata arcadedb ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION CVE-2026-67341 Fix available 9.3 CriticalJuly 16, 2026
• arcadedata arcadedb ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts CVE-2026-67340 Public exploitFix available 8.6 HighJuly 16, 2026
• arcadedata arcadedb, com.arcadedb arcadedb-server +1 more ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read CVE-2026-65831 Fix available 7.7 HighJuly 16, 2026
• arcadedata arcadedb, com.arcadedb arcadedb-engine +1 more ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) CVE-2026-54076 Fix available 8.1 HighJuly 16, 2026
• arcadedata arcadedb, com.arcadedb arcadedb-engine +1 more ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users CVE-2026-54077 Fix available 7.1 HighJuly 16, 2026
• arcadedata arcadedb ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases CVE-2026-44221 Fix available 9.0 CriticalMay 5, 2026