Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: ArcadeData arcadedb 26.9.1 Clear all filters
TI-2026-63062 CVE-2026-93598 · GHSA-rqx6-fvpr-qm24

ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

Priority HIGH 66

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBund…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00633 Published 2026-09-18 Fixed in 26.9.1 CWE-184
TI-2026-63061 CVE-2026-93597 · GHSA-9fpr-24pp-pfx2

ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

Priority MEDIUM 57

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-09-18 Fixed in 26.9.1 CWE-918
TI-2026-63060 CVE-2026-93596 · GHSA-frwj-8cg6-5jfh

ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect

Priority MEDIUM 57

ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/bat…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-09-18 Fixed in 26.9.1 CWE-862
TI-2026-63059 CVE-2026-93595 · GHSA-jr2j-wmqp-cp5r

ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

Priority LOW 31

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00375 Published 2026-09-18 Fixed in 26.9.1 CWE-862
TI-2026-63058 CVE-2026-93594 · GHSA-34w2-f24j-55hj

ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries

Priority HIGH 66

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00441 Published 2026-09-18 Fixed in 26.9.1 CWE-863
TI-2026-63057 CVE-2026-93593 · GHSA-46xr-4762-9x3m

ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

Priority HIGH 72

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00363 Published 2026-09-18 Fixed in 26.9.1 CWE-863