ArcadeData / Arcadedb
35 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-93598 | ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle | HIGH | 7.1 | Sep 18, 2026 |
| CVE-2026-93597 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses | MEDIUM | 5.3 | Sep 18, 2026 |
| CVE-2026-93596 | ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect | MEDIUM | 5.3 | Sep 18, 2026 |
| CVE-2026-93595 | ArcadeDB before 26.9.1 ACL Bypass via query_database Tool | HIGH | 7.1 | Sep 18, 2026 |
| CVE-2026-93594 | ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries | HIGH | 7.1 | Sep 18, 2026 |
| CVE-2026-93593 | ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission | HIGH | 8.6 | Sep 18, 2026 |
| CVE-2026-65831 | ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read | HIGH | 7.7 | Sep 15, 2026 |
| CVE-2026-54077 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users | HIGH | 7.1 | Sep 15, 2026 |
| CVE-2026-54076 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) | HIGH | 8.1 | Sep 15, 2026 |
| CVE-2026-76225 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV | HIGH | 8.3 | Aug 19, 2026 |
| CVE-2026-76224 | ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback | HIGH | 8.7 | Aug 19, 2026 |
| CVE-2026-76223 | ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION | HIGH | 7.1 | Aug 19, 2026 |
| CVE-2026-75855 | ArcadeDB before 26.8.1 Path Traversal via create/drop database | HIGH | 8.4 | Aug 18, 2026 |
| CVE-2026-75854 | ArcadeDB Redis Wire-Protocol Plugin Missing Authentication | CRITICAL | 9.3 | Aug 18, 2026 |
| CVE-2026-75853 | ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database | HIGH | 8.7 | Aug 18, 2026 |
| CVE-2026-75852 | ArcadeDB MongoDB wire protocol authentication bypass cross-database | CRITICAL | 9.3 | Aug 18, 2026 |
| CVE-2026-75851 | ArcadeDB before 26.8.1 Authentication Bypass via Async Command | CRITICAL | 9.4 | Aug 18, 2026 |
| CVE-2026-75850 | ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers | LOW | 2.3 | Aug 18, 2026 |
| CVE-2026-75846 | ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION | HIGH | 7.1 | Aug 18, 2026 |
| CVE-2026-75845 | ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting | MEDIUM | 5.3 | Aug 18, 2026 |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | HIGH | 7.1 | Aug 18, 2026 |
| CVE-2026-75843 | ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction | CRITICAL | 9.4 | Aug 18, 2026 |
| CVE-2026-75842 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV | HIGH | 8.3 | Aug 18, 2026 |
| CVE-2026-75841 | ArcadeDB before 26.8.1 Denial of Service via range() | MEDIUM | 5.3 | Aug 18, 2026 |
| CVE-2026-75840 | ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex | HIGH | 8.7 | Aug 18, 2026 |
Showing 1 to 25 of 35 CVEs