CVE Browser

ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries

ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback

ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION

ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB MongoDB wire protocol authentication bypass cross-database

ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers

ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting

ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass

ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

ArcadeDB before 26.8.1 Denial of Service via range()

ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex