# cve.now: Arcadedata

The newest entries naming Arcadedata as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119577](https://cve.now/CVE-2026-119577.md): ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections (CVSS 7.6)
- [CVE-2026-119576](https://cve.now/CVE-2026-119576.md): ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint (CVSS 5.3)
- [CVE-2026-119575](https://cve.now/CVE-2026-119575.md): ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List (CVSS 7.1)
- [CVE-2026-114059](https://cve.now/CVE-2026-114059.md): ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization (CVSS 7.7)
- [CVE-2026-114058](https://cve.now/CVE-2026-114058.md): ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol (CVSS 5.3)
- [CVE-2026-114057](https://cve.now/CVE-2026-114057.md): ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure (CVSS 5.3)
- [CVE-2026-114056](https://cve.now/CVE-2026-114056.md): ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH (CVSS 5.3)
- [CVE-2026-93598](https://cve.now/CVE-2026-93598.md): ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle (CVSS 7.1)
- [CVE-2026-93597](https://cve.now/CVE-2026-93597.md): ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses (CVSS 5.3)
- [CVE-2026-93596](https://cve.now/CVE-2026-93596.md): ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect (CVSS 5.3)
- [CVE-2026-93595](https://cve.now/CVE-2026-93595.md): ArcadeDB before 26.9.1 ACL Bypass via query\_database Tool (CVSS 7.1)
- [CVE-2026-93594](https://cve.now/CVE-2026-93594.md): ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries (CVSS 7.1)
- [CVE-2026-93593](https://cve.now/CVE-2026-93593.md): ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission (CVSS 8.6)
- [CVE-2026-65831](https://cve.now/CVE-2026-65831.md): ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (CVSS 7.7)
- [CVE-2026-54077](https://cve.now/CVE-2026-54077.md): ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (CVSS 7.1)
- [CVE-2026-54076](https://cve.now/CVE-2026-54076.md): ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (CVSS 8.1)
- [CVE-2026-76225](https://cve.now/CVE-2026-76225.md): ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV (CVSS 8.3)
- [CVE-2026-76224](https://cve.now/CVE-2026-76224.md): ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback (CVSS 8.7)
- [CVE-2026-76223](https://cve.now/CVE-2026-76223.md): ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION (CVSS 7.1)
- [CVE-2026-75855](https://cve.now/CVE-2026-75855.md): ArcadeDB before 26.8.1 Path Traversal via create/drop database (CVSS 8.4)
- [CVE-2026-75854](https://cve.now/CVE-2026-75854.md): ArcadeDB Redis Wire-Protocol Plugin Missing Authentication (CVSS 9.3)
- [CVE-2026-75853](https://cve.now/CVE-2026-75853.md): ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database (CVSS 8.7)
- [CVE-2026-75852](https://cve.now/CVE-2026-75852.md): ArcadeDB MongoDB wire protocol authentication bypass cross-database (CVSS 9.3)
- [CVE-2026-75851](https://cve.now/CVE-2026-75851.md): ArcadeDB before 26.8.1 Authentication Bypass via Async Command (CVSS 9.4)
- [CVE-2026-75850](https://cve.now/CVE-2026-75850.md): ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers (CVSS 2.3)
- [CVE-2026-75846](https://cve.now/CVE-2026-75846.md): ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION (CVSS 7.1)
- [CVE-2026-75845](https://cve.now/CVE-2026-75845.md): ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set\_server\_setting (CVSS 5.3)
- [CVE-2026-75844](https://cve.now/CVE-2026-75844.md): ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass (CVSS 7.1)
- [CVE-2026-75843](https://cve.now/CVE-2026-75843.md): ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction (CVSS 9.4)
- [CVE-2026-75842](https://cve.now/CVE-2026-75842.md): ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV (CVSS 8.3)
- [CVE-2026-75841](https://cve.now/CVE-2026-75841.md): ArcadeDB before 26.8.1 Denial of Service via range() (CVSS 5.3)
- [CVE-2026-75840](https://cve.now/CVE-2026-75840.md): ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex (CVSS 8.7)
- [CVE-2026-75839](https://cve.now/CVE-2026-75839.md): ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints (CVSS 5.3)
- [CVE-2026-68578](https://cve.now/CVE-2026-68578.md): ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport (CVSS 7.7)
- [CVE-2026-67357](https://cve.now/CVE-2026-67357.md): ArcadeDB before 26.7.3 Information Disclosure via get\_server\_settings (CVSS 7.7)
- [CVE-2026-67356](https://cve.now/CVE-2026-67356.md): ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger (CVSS 8.7)
- [CVE-2026-67340](https://cve.now/CVE-2026-67340.md): ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts (CVSS 8.6)
- [CVE-2026-67344](https://cve.now/CVE-2026-67344.md): ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE (CVSS 8.5)
- [CVE-2026-67341](https://cve.now/CVE-2026-67341.md): ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION (CVSS 9.3)
- [CVE-2026-67343](https://cve.now/CVE-2026-67343.md): ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server (CVSS 8.7)
- [CVE-2026-67342](https://cve.now/CVE-2026-67342.md): ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers (CVSS 9.3)
- [CVE-2026-44221](https://cve.now/CVE-2026-44221.md): ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases (CVSS 9.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/arcadedata
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.