CVEs we hold for Arcadedata

Records whose assigning authority named Arcadedata as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-93598ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleArcadeData arcadedb

CVE-2026-93597ArcadeDB before 26.9.1 SSRF via IPv6 transition addressesArcadeData arcadedb

CVE-2026-93596ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge ConnectArcadeData arcadedb

CVE-2026-93595ArcadeDB before 26.9.1 ACL Bypass via query_database ToolArcadeData arcadedb

CVE-2026-93594ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeriesArcadeData arcadedb

CVE-2026-93593ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type PermissionArcadeData arcadedb

CVE-2026-76225ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSVArcadeData arcadedb

CVE-2026-76224ArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackArcadeData arcadedb

CVE-2026-76223ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTIONArcadeData arcadedb

CVE-2026-75855ArcadeDB before 26.8.1 Path Traversal via create/drop databaseArcadeData arcadedb

CVE-2026-75854ArcadeDB Redis Wire-Protocol Plugin Missing AuthenticationArcadeData arcadedb

CVE-2026-75853ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-DatabaseArcadeData arcadedb

CVE-2026-75852ArcadeDB MongoDB wire protocol authentication bypass cross-databaseArcadeData arcadedb

CVE-2026-75851ArcadeDB before 26.8.1 Authentication Bypass via Async CommandArcadeData arcadedb

CVE-2026-75850ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch HandlersArcadeData arcadedb

CVE-2026-75846ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTIONArcadeData arcadedb

CVE-2026-75845ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_settingArcadeData arcadedb

CVE-2026-75844ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypassArcadeData arcadedb

CVE-2026-75843ArcadeDB before 26.8.1 Privilege Escalation via gRPC TransactionArcadeData arcadedb

CVE-2026-75842ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSVArcadeData arcadedb

CVE-2026-75841ArcadeDB before 26.8.1 Denial of Service via range()ArcadeData arcadedb

CVE-2026-75840ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped RegexArcadeData arcadedb

CVE-2026-75839ArcadeDB before 26.8.1 Information Disclosure via Cluster EndpointsArcadeData arcadedb

CVE-2026-68578ArcadeDB before 26.7.3 Authentication Bypass via MCP TransportArcadeData arcadedb

CVE-2026-67357ArcadeDB before 26.7.3 Information Disclosure via get_server_settingsArcadeData arcadedb

CVE-2026-67356ArcadeDB before 26.7.3 Privilege Escalation via JavaScript TriggerArcadeData arcadedb

CVE-2026-67344ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPEArcadeData arcadedb

CVE-2026-67343ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/serverArcadeData arcadedb

CVE-2026-67342ArcadeDB before 26.7.2 Authorization Bypass via Database HandlersArcadeData arcadedb

CVE-2026-67341ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTIONArcadeData arcadedb

CVE-2026-67340ArcadeDB before 26.7.2 Remote Code Execution via Trigger ScriptsArcadeData arcadedb

CVE-2026-65831ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file readArcadeData arcadedb; com.arcadedb arcadedb-server

CVE-2026-54077ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersArcadeData arcadedb; com.arcadedb arcadedb-engine

CVE-2026-54076ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)ArcadeData arcadedb; com.arcadedb arcadedb-engine

CVE-2026-44221ArcadeDB: Cross-database authorization bypass and unsecured newly-created databasesArcadeData arcadedb

35 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.