What’s Vulnerable › Products

ArcadeData arcadedb vulnerabilities

42 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 42 published in the last 12 months.

Check whether your ArcadeData arcadedb version is affected

Latest ArcadeData arcadedb vulnerabilities

• CVE-2026-119577 — ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections (CVSS 6.8)
• CVE-2026-119576 — ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint (CVSS 4.3)
• CVE-2026-119575 — ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List (CVSS 6.5)
• CVE-2026-114058 — ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol (CVSS 4.3)
• CVE-2026-114057 — ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure (CVSS 4.3)
• CVE-2026-114059 — ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization (CVSS 7.5)
• CVE-2026-114056 — ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH (CVSS 4.3)
• CVE-2026-93598 — ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle (CVSS 7.1)
• CVE-2026-93597 — ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses (CVSS 7.7)
• CVE-2026-93596 — ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect (CVSS 4.3)
• CVE-2026-93595 — ArcadeDB before 26.9.1 ACL Bypass via query_database Tool (CVSS 6.5)
• CVE-2026-93594 — ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries (CVSS 8.1)
• CVE-2026-93593 — ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission (CVSS 8.1)
• CVE-2026-65831 — ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (CVSS 7.7)
• CVE-2026-54077 — ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (CVSS 7.1)
• CVE-2026-54076 — ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (CVSS 8.1)
• CVE-2026-76225 — ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV (CVSS 7.7)
• CVE-2026-76224 — ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback (CVSS 8.8)
• CVE-2026-76223 — ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION (CVSS 7.1)
• CVE-2026-75855 — ArcadeDB before 26.8.1 Path Traversal via create/drop database (CVSS 8.7)
• CVE-2026-75854 — ArcadeDB Redis Wire-Protocol Plugin Missing Authentication (CVSS 9.8)
• CVE-2026-75853 — ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database (CVSS 8.8)
• CVE-2026-75852 — ArcadeDB MongoDB wire protocol authentication bypass cross-database (CVSS 9.8)
• CVE-2026-75851 — ArcadeDB before 26.8.1 Authentication Bypass via Async Command (CVSS 9.9)
• CVE-2026-75850 — ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers (CVSS 4.2)