Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: ArcadeData arcadedb 26.10.2 Clear all filters
TI-2026-83079 CVE-2026-119577 · GHSA-v25h-f6ww-7597

Improper session revocation in ArcadeDB wire-protocol connections

Priority LOW 35

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00285 Published 2026-10-30 Fixed in 26.10.2 CWE-613
TI-2026-83078 CVE-2026-119576 · GHSA-7ggx-x32v-fc5c

Authorization bypass in ArcadeDB lets users replace the GraphQL schema

Priority LOW 23

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00215 Published 2026-10-30 Fixed in 26.10.2 CWE-862
TI-2026-83077 CVE-2026-119575 · GHSA-vqh4-vww9-5p94

SSRF in ArcadeDB via ALTER DATABASE LOAD CSV block list

Priority MEDIUM 64

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-30 Fixed in 26.10.2 CWE-918