18
CVEs
4
Critical
10
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
10
MEDIUM
3
LOW
1
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-75854 | Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exposes no authentication gate, letting anyone who can reach the Redis port read, write, and delete records across any database on the server. VulnCheck reported the flaw (CWE-306, Missing Authentication) with a CVSS 4.0 base score of 9.3, reflecting network-reachable, no-privilege exploitation with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.3 | 1.1% | 48 |
|
| CVE-2026-75851 | Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with read-only access to a single database to gain full server-wide administrative control. The flaw stems from the server failing to bind the authenticated principal to asynchronous command worker threads, so a JavaScript command submitted with awaitResponse:false runs with no user context and bypasses the scripting authorization gate entirely. VulnCheck reported the issue; there is no public exploit identified at time of analysis, but the mechanics are fully documented in the vendor advisory, making exploitation straightforward. | CRITICAL | 9.4 | 0.3% | 47 |
|
| CVE-2026-75843 | Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server administrator via the gRPC transaction interface. Because the server fails to bind the authenticated principal to the gRPC transaction executor thread in beginTransaction, an attacker can call executeCommand with a valid transaction ID to run arbitrary JavaScript that bypasses scripting authorization, ultimately creating server-wide admin accounts. Reported by VulnCheck with a linked GitHub security advisory; no public exploit is identified at time of analysis, and the flaw carries a CVSS 4.0 base score of 9.4. | CRITICAL | 9.4 | 0.3% | 47 |
|
| CVE-2026-75852 | Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any database through the MongoDB wire-protocol plugin on TCP port 27017. The plugin negotiates a SASL handshake but never actually enforces it on data commands (insert, find, update, delete, create), so an attacker who can reach the port gains complete read/write access with no credentials. Reported by VulnCheck; no public exploit code has been identified at time of analysis, though the trivial reproduction path makes weaponization straightforward. | CRITICAL | 9.3 | 0.5% | 47 |
|
| CVE-2026-76224 | Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version 26.7.3 to full OS command execution by any authenticated user, including those with only read-only database roles. The flaw is a silent fallback in ArcadeGremlin.executeStatement() that routes parameterized queries failing gremlin-lang parsing to the unrestricted Groovy scripting engine, which can invoke arbitrary Java and OS-level code as the server process user. No public exploit has been identified at time of analysis, but the minimal privilege bar - any valid credential - makes this a critical upgrade priority for all ArcadeDB deployments. | HIGH | 8.7 | 0.6% | 44 |
|
| CVE-2026-75853 | Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to fully access all databases on the server, completely circumventing per-database and per-type ACLs. Versions 26.7.3 and below of com.arcadedb:arcadedb-gremlin are affected; the plugin enforces SASL PLAIN authentication but never invokes the database permission check (canAccessToDatabase) nor binds the authenticated principal into the execution engine. No public exploit code has been identified at time of analysis, but exploitation requires only a single valid server credential regardless of what database that credential was originally provisioned for. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-75840 | Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to escape the GraalVM JavaScript sandbox and read any file accessible to the ArcadeDB server process on the underlying host. The sandbox allowlist enforces package name restrictions via unescaped regular expressions, which an attacker can craft to match unintended Java class names and instantiate ZipFile or JarFile to open arbitrary filesystem paths. No public exploit has been identified at time of analysis; however, the vendor-confirmed patch to 26.8.1 should be applied promptly given the high confidentiality impact and the sensitivity of files typically reachable by a database server process. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-75855 | Path traversal in ArcadeDB versions before 26.8.1 enables authenticated root users to write and delete arbitrary files outside the designated database directory via the POST /api/v1/server REST API endpoint. By embedding ../ sequences within database names passed to create database or drop database commands, a root-privileged attacker can place files at arbitrary filesystem paths or recursively delete directories accessible to the server process. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 8.4 reflects high integrity and availability impact across both the ArcadeDB process and the underlying OS filesystem. | HIGH | 8.4 | 0.4% | 42 |
|
| CVE-2026-75842 | Arbitrary file read in ArcadeDB's OpenCypher LOAD CSV FROM clause allows any authenticated user with read query privileges to exfiltrate arbitrary server-side files. All versions prior to 26.8.1 are affected, as confirmed by the vendor's GitHub security advisory GHSA-hfp5-6gcp-8c75. An attacker issuing a crafted LOAD CSV FROM 'file:///etc/shadow' statement receives the file contents directly in the query response, exposing credentials, private keys, and configuration data readable by the server process - no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-76225 | Server-side request forgery in ArcadeDB before 26.8.1 allows authenticated low-privilege users to weaponize the OpenCypher LOAD CSV feature to issue arbitrary HTTP/HTTPS requests from the database server host, reaching internal network services and cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the content of these restricted destinations, enabling exfiltration of internal service data or cloud IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.3 with SC:H reflects meaningful lateral impact against adjacent cloud and internal infrastructure. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-65831 | Authenticated users holding only read-only (reader) privileges on an ArcadeDB database can escalate to arbitrary JVM scripting by POSTing a {"language":"js"} command to /api/v1/command/{database}, because the polyglot query engine never applies the database-administrator authorization check enforced on the SQL/Cypher paths. A cooperating sandbox flaw lets those scripts reflect from the bound database object through database.getClass().getClassLoader().loadClass to classes outside the allowedPackages whitelist, allowing an attacker to read arbitrary host files such as /etc/passwd and configuration files outside the database scope. Process creation remains blocked, so OS command execution is not confirmed; exploitation needs valid credentials and no user interaction, the flaw is fixed in ArcadeDB 26.7.1, and no public exploit code or CISA KEV entry was identified at time of analysis. | HIGH | 7.7 | – | 38 |
|
| CVE-2026-75846 | Missing authorization in ArcadeDB's DELETE FUNCTION SQL command allows any authenticated database user to permanently remove server-side functions regardless of their actual permission level. All releases up to and including 26.7.3 are affected; the issue is resolved in 26.8.1. No public exploit has been identified at time of analysis, but the low barrier - a valid database credential and a single API call - makes this easily reachable by insiders or compromised low-privilege accounts, particularly where server-side functions enforce security or business logic. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-76223 | Function library integrity in ArcadeDB 26.7.3 and earlier can be silently tampered by any authenticated low-privilege database user because the UPDATE_SCHEMA permission gate is bypassed when a DEFINE FUNCTION statement targets an already-existing library rather than creating a new one. Attackers holding only basic database credentials can overwrite or inject SQL or Cypher function logic authored by administrators, poisoning business logic, data transformations, or access-control routines that depend on those functions. No active exploitation is confirmed (no CISA KEV listing), but the low attack complexity and network reachability (CVSS 4.0 AV:N/AC:L/PR:L) make this a genuine priority for any multi-user ArcadeDB deployment. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-75844 | Server-side request forgery in ArcadeDB before 26.8.1 enables authenticated attackers to bypass the IMPORT DATABASE command's hostname validator by exploiting a time-of-check/time-of-use gap: the validator resolves a hostname once, but the subsequent HTTP connection re-resolves it independently and follows redirects. This allows DNS rebinding or redirect-based bypass to reach cloud metadata endpoints such as the AWS IMDSv1 service, internal network services, or arbitrary local files on the host. No public exploit is identified at time of analysis, but the techniques involved are well-documented and the cloud credential exposure impact is severe on default cloud deployments. | HIGH | 7.1 | 0.2% | 36 |
|
| CVE-2026-75841 | Heap memory exhaustion in ArcadeDB's Cypher query engine allows authenticated users to trigger OutOfMemoryError and cause temporary service unavailability. Attackers with valid database credentials can submit crafted Cypher range() expressions with abnormally large bounds, consuming server heap until the JVM is starved of resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the authenticated prerequisite meaningfully limits attacker pool. | MEDIUM | 5.3 | 0.3% | 27 |
|