CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:00 UTC)

What this means for you

This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,435; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product arcadedata:arcadedb. Show all products

26 CVEs, showing 1 to 26

CVE	Severity	Title	Published
CVE-2026-93598	High 7.1	ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93597	High 7.7	ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93596	Medium 4.3	ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93595	Medium 6.5	ArcadeDB before 26.9.1 ACL Bypass via query_database Tool Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93594	High 8.1	ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries Assigned by VulnCheck	Sep 18, 2026
CVE-2026-93593	High 8.1	ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission Assigned by VulnCheck	Sep 18, 2026
CVE-2026-65831	High 7.7	ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read Assigned by GitHub_M	Sep 15, 2026
CVE-2026-54077	High 7.1	ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users Assigned by GitHub_M	Sep 15, 2026
CVE-2026-54076	High 8.1	ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) Assigned by GitHub_M	Sep 15, 2026
CVE-2026-76225	High 7.7	ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76224	High 8.8	ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback Assigned by VulnCheck	Aug 19, 2026
CVE-2026-76223	High 7.1	ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION Assigned by VulnCheck	Aug 19, 2026
CVE-2026-75855	High 8.7	ArcadeDB before 26.8.1 Path Traversal via create/drop database Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75854	Critical 9.8	ArcadeDB Redis Wire-Protocol Plugin Missing Authentication Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75853	High 8.8	ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75852	Critical 9.8	ArcadeDB MongoDB wire protocol authentication bypass cross-database Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75851	Critical 9.9	ArcadeDB before 26.8.1 Authentication Bypass via Async Command Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75850	Medium 4.2	ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75846	High 7.1	ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75845	Medium 6.3	ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75844	High 7.1	ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75843	Critical 9.9	ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75842	High 7.7	ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75841	Medium 4.3	ArcadeDB before 26.8.1 Denial of Service via range() Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75840	High 7.5	ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex Assigned by VulnCheck	Aug 18, 2026
CVE-2026-75839	Medium 4.3	ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints Assigned by VulnCheck	Aug 18, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.