Latest high and critical flaws
- CVE-2026-114059 ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute GrooHigh 7.7 · Oct 20, 2026
- CVE-2026-93598 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglHigh 7.1 · Sep 18, 2026
- CVE-2026-93595 ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints.High 7.1 · Sep 18, 2026
- CVE-2026-93594 ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file iHigh 7.1 · Sep 18, 2026
- CVE-2026-93593 ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but THigh 8.6 · Sep 18, 2026
- CVE-2026-65831 ArcadeDB is a Multi-Model DBMS.High 7.7 · Sep 15, 2026
- CVE-2026-54077 ArcadeDB is a Multi-Model DBMS.High 7.1 · Sep 15, 2026
- CVE-2026-54076 ArcadeDB is a Multi-Model DBMS.High 8.1 · Sep 15, 2026
- CVE-2026-76225 ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs.High 8.3 · Aug 19, 2026
- CVE-2026-76224 ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine.High 8.7 · Aug 19, 2026
- CVE-2026-76223 ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existHigh 7.1 · Aug 19, 2026
- CVE-2026-75855 ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing autheHigh 8.4 · Aug 18, 2026
- CVE-2026-75854 ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, Critical 9.3 · Aug 18, 2026
- CVE-2026-75853 ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorizationHigh 8.7 · Aug 18, 2026
- CVE-2026-75852 ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin.Critical 9.3 · Aug 18, 2026
- CVE-2026-75851 ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threCritical 9.4 · Aug 18, 2026
- CVE-2026-75846 ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement.High 7.1 · Aug 18, 2026
- CVE-2026-75844 ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and cheHigh 7.1 · Aug 18, 2026
- CVE-2026-75843 ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to Critical 9.4 · Aug 18, 2026
- CVE-2026-75842 ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read locaHigh 8.3 · Aug 18, 2026
- CVE-2026-75840 ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expreHigh 8.7 · Aug 18, 2026
- CVE-2026-68578 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-High 7.7 · Aug 2, 2026
- CVE-2026-67357 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cHigh 7.7 · Aug 2, 2026
- CVE-2026-67356 ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().crHigh 8.7 · Aug 2, 2026
- CVE-2026-67344 ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ...High 8.5 · Aug 1, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.