CVE-2026-93598 | | | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyg… |
CVE-2026-93597 | High | 7.7 | 2026-09-18 | ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attacke… |
CVE-2026-93596 | Medium | 4.3 | 2026-09-18 | ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker thread… |
CVE-2026-93595 | Medium | 6.5 | 2026-09-18 | ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes quer… |
CVE-2026-93594 | High | 8.1 | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file… |
CVE-2026-93593 | High | 8.1 | 2026-09-18 | ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but… |
CVE-2026-65831 | High | 7.7 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.co… |
CVE-2026-54077 | High | 7.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.ja… |
CVE-2026-54076 | High | 8.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty… |
CVE-2026-76225 | High | 7.7 | 2026-08-19 | ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. A… |
CVE-2026-76224 | High | 8.8 | 2026-08-19 | ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine d… |
CVE-2026-76223 | High | 7.1 | 2026-08-19 | ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-exis… |
CVE-2026-75855 | High | 8.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing auth… |
CVE-2026-75854 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read… |
CVE-2026-75853 | High | 8.8 | 2026-08-18 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorizatio… |
CVE-2026-75852 | Critical | 9.8 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue i… |
CVE-2026-75851 | Critical | 9.9 | 2026-08-18 | ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker thr… |
CVE-2026-75850 | Medium | 4.2 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on… |
CVE-2026-75846 | High | 7.1 | 2026-08-18 | ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStateme… |
CVE-2026-75845 | Medium | 6.3 | 2026-08-18 | ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool. SetServerSettingTool.exe… |
CVE-2026-75844 | High | 7.1 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and ch… |
CVE-2026-75843 | Critical | 9.9 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to… |
CVE-2026-75842 | High | 7.7 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read loc… |
CVE-2026-75841 | Medium | 4.3 | 2026-08-18 | ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory… |
CVE-2026-75840 | High | 7.5 | 2026-08-18 | ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expr… |
CVE-2026-75839 | Medium | 4.3 | 2026-08-18 | ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints… |
CVE-2026-68578 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no… |
CVE-2026-67357 | High | 7.5 | 2026-08-02 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in… |
CVE-2026-67356 | High | 8.8 | 2026-08-02 | ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().c… |
CVE-2026-67344 | Medium | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL opera… |
CVE-2026-67343 | High | 8.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arca… |
CVE-2026-67342 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that f… |
CVE-2026-67341 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database a… |
CVE-2026-67340 | High | 7.2 | 2026-08-01 | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java… |
CVE-2026-44221 | Critical | 9.0 | 2026-05-12 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could… |