AR
Product
arcadedb
39
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 7High 22Medium 10Low 0
Watch
Add arcadedb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76224 | 8.8 | Aug 19 | ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback Affected: before 26.8.1 |
| CVE-2026-75853 | 8.8 | Aug 18 | ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database Affected: before 26.8.1 |
| CVE-2026-67356 | 8.8 | Aug 2 | ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger Affected: before 26.7.3 |
| CVE-2026-67343 | 8.8 | Aug 1 | ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server Affected: before 26.7.2 |
| CVE-2026-75855 | 8.7 | Aug 18 | ArcadeDB before 26.8.1 Path Traversal via create/drop database Affected: before 26.8.1 |
| CVE-2026-93594 | 8.1 | Sep 18 | ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries Affected: before 26.9.1 |
| CVE-2026-93593 | 8.1 | Sep 18 | ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission Affected: before 26.9.1 |
| CVE-2026-54076 | 8.1 | Sep 15 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) Affected: < 26.6.1 |
| CVE-2026-93597 | 7.7 | Sep 18 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses Affected: before 26.9.1 |
| CVE-2026-65831 | 7.7 | Sep 15 | ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read Affected: < 26.7.1 |
| CVE-2026-76225 | 7.7 | Aug 19 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV Affected: before 26.8.1 |
| CVE-2026-75842 | 7.7 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV Affected: before 26.8.1 |
| CVE-2026-114059 | 7.5 | Oct 21 | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization Affected: before 26.10.1 |
| CVE-2026-75840 | 7.5 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex Affected: before 26.8.1 |
| CVE-2026-68578 | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport Affected: before 26.7.3 |
| CVE-2026-67357 | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Information Disclosure via get_server_settings Affected: before 26.7.3 |
| CVE-2026-67340 | 7.2 | Aug 1 | ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts Affected: before 26.7.2 |
| CVE-2026-93598 | 7.1 | Sep 18 | ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle Affected: before 26.9.1 |
| CVE-2026-54077 | 7.1 | Sep 15 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users Affected: < 26.6.1 |
| CVE-2026-76223 | 7.1 | Aug 19 | ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION Affected: before 26.8.1 |
| CVE-2026-75846 | 7.1 | Aug 18 | ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION Affected: before 26.8.1 |
| CVE-2026-75844 | 7.1 | Aug 18 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass Affected: before 26.8.1 |
Showing 22