Arcadedata vulnerabilities
42 CVEs and advisories name Arcadedata as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119577ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
- CVE-2026-119576ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
- CVE-2026-119575ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
- CVE-2026-114059ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
- CVE-2026-114058ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
- CVE-2026-114057ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
- CVE-2026-114056ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
- CVE-2026-93598ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle
- CVE-2026-93597ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
- CVE-2026-93596ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect
- CVE-2026-93595ArcadeDB before 26.9.1 ACL Bypass via query_database Tool
- CVE-2026-93594ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries
- CVE-2026-93593ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission
- CVE-2026-65831ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
- CVE-2026-54077ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users
- CVE-2026-54076ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
- CVE-2026-76225ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
- CVE-2026-76224ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
- CVE-2026-76223ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION
- CVE-2026-75855ArcadeDB before 26.8.1 Path Traversal via create/drop database
- CVE-2026-75854ArcadeDB Redis Wire-Protocol Plugin Missing Authentication
- CVE-2026-75853ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
- CVE-2026-75852ArcadeDB MongoDB wire protocol authentication bypass cross-database
- CVE-2026-75851ArcadeDB before 26.8.1 Authentication Bypass via Async Command
- CVE-2026-75850ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers
- CVE-2026-75846ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
- CVE-2026-75845ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting
- CVE-2026-75844ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass
- CVE-2026-75843ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
- CVE-2026-75842ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV