Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: ArcadeData arcadedb 26.7.2 Clear all filters
TI-2026-47636 CVE-2026-67340 · GHSA-w8vx-3rmm-v7rp

ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

Priority MEDIUM 47

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00918 Published 2026-08-01 Fixed in 26.7.2 CWE-94
TI-2026-47639 CVE-2026-67343 · GHSA-3cc2-w6p6-c4vg

ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server

Priority MEDIUM 40

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00508 Published 2026-08-01 Fixed in 26.7.2 CWE-200
TI-2026-47638 CVE-2026-67342 · GHSA-gj8q-6wmr-v9mq

ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers

Priority MEDIUM 49

ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that fail to validate database access permissions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00543 Published 2026-08-01 Fixed in 26.7.2 CWE-639