AR
Vendor
ArcadeData
39
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114059 | AR arcadedb ArcadeData | 7.5 | Oct 21 | ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization |
| CVE-2026-114058 | AR arcadedb ArcadeData | 4.3 | Oct 21 | ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol |
| CVE-2026-114057 | AR arcadedb ArcadeData | 4.3 | Oct 21 | ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure |
| CVE-2026-114056 | AR arcadedb ArcadeData | 4.3 | Oct 21 | ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH |
| CVE-2026-93598 | AR arcadedb ArcadeData | 7.1 | Sep 18 | ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle |
| CVE-2026-93597 | AR arcadedb ArcadeData | 7.7 | Sep 18 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses |
| CVE-2026-93596 | AR arcadedb ArcadeData | 4.3 | Sep 18 | ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect |
| CVE-2026-93595 | AR arcadedb ArcadeData | 6.5 | Sep 18 | ArcadeDB before 26.9.1 ACL Bypass via query_database Tool |
| CVE-2026-93594 | AR arcadedb ArcadeData | 8.1 | Sep 18 | ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries |
| CVE-2026-93593 | AR arcadedb ArcadeData | 8.1 | Sep 18 | ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission |
| CVE-2026-65831 | AR arcadedb ArcadeData | 7.7 | Sep 15 | ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read |
| CVE-2026-54077 | AR arcadedb ArcadeData | 7.1 | Sep 15 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users |
| CVE-2026-54076 | AR arcadedb ArcadeData | 8.1 | Sep 15 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) |
| CVE-2026-76225 | AR arcadedb ArcadeData | 7.7 | Aug 19 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV |
| CVE-2026-76224 | AR arcadedb ArcadeData | 8.8 | Aug 19 | ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback |
| CVE-2026-76223 | AR arcadedb ArcadeData | 7.1 | Aug 19 | ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION |
| CVE-2026-75855 | AR arcadedb ArcadeData | 8.7 | Aug 18 | ArcadeDB before 26.8.1 Path Traversal via create/drop database |
| CVE-2026-75854 | AR arcadedb ArcadeData | 9.8 | Aug 18 | ArcadeDB Redis Wire-Protocol Plugin Missing Authentication |
| CVE-2026-75853 | AR arcadedb ArcadeData | 8.8 | Aug 18 | ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database |
| CVE-2026-75852 | AR arcadedb ArcadeData | 9.8 | Aug 18 | ArcadeDB MongoDB wire protocol authentication bypass cross-database |
| CVE-2026-75851 | AR arcadedb ArcadeData | 9.9 | Aug 18 | ArcadeDB before 26.8.1 Authentication Bypass via Async Command |
| CVE-2026-75850 | AR arcadedb ArcadeData | 4.2 | Aug 18 | ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers |
| CVE-2026-75846 | AR arcadedb ArcadeData | 7.1 | Aug 18 | ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION |
| CVE-2026-75845 | AR arcadedb ArcadeData | 6.3 | Aug 18 | ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting |
| CVE-2026-75844 | AR arcadedb ArcadeData | 7.1 | Aug 18 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass |
| CVE-2026-75843 | AR arcadedb ArcadeData | 9.9 | Aug 18 | ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction |
| CVE-2026-75842 | AR arcadedb ArcadeData | 7.7 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV |
| CVE-2026-75841 | AR arcadedb ArcadeData | 4.3 | Aug 18 | ArcadeDB before 26.8.1 Denial of Service via range() |
| CVE-2026-75840 | AR arcadedb ArcadeData | 7.5 | Aug 18 | ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex |
| CVE-2026-75839 | AR arcadedb ArcadeData | 4.3 | Aug 18 | ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints |
| CVE-2026-68578 | AR arcadedb ArcadeData | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport |
| CVE-2026-67357 | AR arcadedb ArcadeData | 7.5 | Aug 2 | ArcadeDB before 26.7.3 Information Disclosure via get_server_settings |
| CVE-2026-67356 | AR arcadedb ArcadeData | 8.8 | Aug 2 | ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger |
| CVE-2026-67340 | AR arcadedb ArcadeData | 7.2 | Aug 1 | ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts |
| CVE-2026-67344 | AR arcadedb ArcadeData | 4.3 | Aug 1 | ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE |
| CVE-2026-67341 | AR arcadedb ArcadeData | 9.8 | Aug 1 | ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION |
| CVE-2026-67343 | AR arcadedb ArcadeData | 8.8 | Aug 1 | ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server |
| CVE-2026-67342 | AR arcadedb ArcadeData | 9.8 | Aug 1 | ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers |
| CVE-2026-44221 | AR arcadedb ArcadeData | 9.0 | May 12 | ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases |