- Latest release
- 26.11.1 (Nov 4, 2026): no advisory affects it
- Newest unaffected release
- 26.11.1 (Nov 4, 2026), the latest release
- Advisories
- 4 · 1 critical, 3 high
- Dependents
- 18
- Releases
- 65 since 21.9.1 (Sep 21, 2021)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-54077Affects 21.9.1-beta to 26.5.1 (26.6.1 is outside it)
- CVE-2026-54076Affects 21.9.1-beta to 26.5.1 (26.6.1 is outside it)
- CVE-2026-67340Affects 21.9.1-beta to 26.7.1 (26.7.2 is outside it)
- CVE-2026-67341Affects 21.9.1-beta to 26.7.1 (26.7.2 is outside it)
Advisories 4
- CVE-2026-54077High 7.1
ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
Affected: fixed in 26.6.1.
Fixed in 26.6.1 (released Jun 3, 2026, 104 days before disclosure).
The latest release, 26.11.1, is not affected.
- CVE-2026-54076High 8.1
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
Affected: fixed in 26.6.1.
Fixed in 26.6.1 (released Jun 3, 2026, 104 days before disclosure).
The latest release, 26.11.1, is not affected.
- CVE-2026-67340High 8.6
ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts
Affected: fixed in 26.7.2.
Fixed in 26.7.2 (released Jul 9, 2026, 23 days before disclosure).
The latest release, 26.11.1, is not affected.
- CVE-2026-67341Critical 9.3
ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION
Affected: fixed in 26.7.2.
Fixed in 26.7.2 (released Jul 9, 2026, 23 days before disclosure).
The latest release, 26.11.1, is not affected.