AR
Product
arcadedb
39
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 7High 22Medium 10Low 0
Watch
Add arcadedb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-75851 | 9.9 | Aug 18 | ArcadeDB before 26.8.1 Authentication Bypass via Async Command Affected: before 26.8.1 |
| CVE-2026-75843 | 9.9 | Aug 18 | ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction Affected: before 26.8.1 |
| CVE-2026-75854 | 9.8 | Aug 18 | ArcadeDB Redis Wire-Protocol Plugin Missing Authentication Affected: before 26.8.1 |
| CVE-2026-75852 | 9.8 | Aug 18 | ArcadeDB MongoDB wire protocol authentication bypass cross-database Affected: before 26.8.1 |
| CVE-2026-67341 | 9.8 | Aug 1 | ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION Affected: before 26.7.2 |
| CVE-2026-67342 | 9.8 | Aug 1 | ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers Affected: before 26.7.2 |
| CVE-2026-44221 | 9.0 | May 12 | ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases Affected: >= 21.10.1, < 26.4.2 |
| CVE-2026-76224 | 8.8 | Aug 19 | ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback Affected: before 26.8.1 |
| CVE-2026-75853 | 8.8 | Aug 18 | ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database Affected: before 26.8.1 |
| CVE-2026-67356 | 8.8 | Aug 2 | ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger Affected: before 26.7.3 |
| CVE-2026-67343 | 8.8 | Aug 1 | ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server Affected: before 26.7.2 |
| CVE-2026-75855 | 8.7 | Aug 18 | ArcadeDB before 26.8.1 Path Traversal via create/drop database Affected: before 26.8.1 |
| CVE-2026-93594 | 8.1 | Sep 18 | ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries Affected: before 26.9.1 |
| CVE-2026-93593 | 8.1 | Sep 18 | ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission Affected: before 26.9.1 |
| CVE-2026-54076 | 8.1 | Sep 15 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) Affected: < 26.6.1 |
| CVE-2026-93597 | 7.7 | Sep 18 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses Affected: before 26.9.1 |
| CVE-2026-65831 | 7.7 | Sep 15 | ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read Affected: < 26.7.1 |
| CVE-2026-76225 | 7.7 | Aug 19 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV Affected: before 26.8.1 |
| CVE-2026-75842 | 7.7 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV Affected: before 26.8.1 |
| CVE-2026-114059 | 7.5 | Oct 21 | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization Affected: before 26.10.1 |
| CVE-2026-75840 | 7.5 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex Affected: before 26.8.1 |
| CVE-2026-68578 | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport Affected: before 26.7.3 |
| CVE-2026-67357 | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Information Disclosure via get_server_settings Affected: before 26.7.3 |
| CVE-2026-67340 | 7.2 | Aug 1 | ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts Affected: before 26.7.2 |
| CVE-2026-93598 | 7.1 | Sep 18 | ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle Affected: before 26.9.1 |
| CVE-2026-54077 | 7.1 | Sep 15 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users Affected: < 26.6.1 |
| CVE-2026-76223 | 7.1 | Aug 19 | ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION Affected: before 26.8.1 |
| CVE-2026-75846 | 7.1 | Aug 18 | ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION Affected: before 26.8.1 |
| CVE-2026-75844 | 7.1 | Aug 18 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass Affected: before 26.8.1 |
| CVE-2026-93595 | 6.5 | Sep 18 | ArcadeDB before 26.9.1 ACL Bypass via query_database Tool Affected: before 26.9.1 |
| CVE-2026-75845 | 6.3 | Aug 18 | ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting Affected: 26.4.2 before 26.8.1 |
| CVE-2026-114058 | 4.3 | Oct 21 | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol Affected: 26.2.1 before 26.10.1 |
| CVE-2026-114057 | 4.3 | Oct 21 | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure Affected: 26.2.1 before 26.10.1 |
| CVE-2026-114056 | 4.3 | Oct 21 | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH Affected: 26.8.1 before 26.10.1 |
| CVE-2026-93596 | 4.3 | Sep 18 | ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect Affected: before 26.9.1 |
| CVE-2026-75841 | 4.3 | Aug 18 | ArcadeDB before 26.8.1 Denial of Service via range() Affected: before 26.8.1 |
| CVE-2026-75839 | 4.3 | Aug 18 | ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints Affected: before 26.8.1 |
| CVE-2026-67344 | 4.3 | Aug 1 | ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE Affected: before 26.7.2 |
| CVE-2026-75850 | 4.2 | Aug 18 | ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers Affected: before 26.8.1 |
Showing 39