com.arcadedb:arcadedb-console (23.10.1), com.arcadedb:arcadedb-coverage (23.10.1) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (23.10.1)

com.arcadedb:arcadedb-engine MAVEN version 23.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.10.1 - com.arcadedb:arcadedb-coverage 23.10.1 -...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.5.1), com.arcadedb:arcadedb-console (>=26.1.1, <=26.5.1) +17 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (>=26.1.1, <=26.5.1)

com.arcadedb:arcadedb-engine MAVEN version =26.1.1, =26.2.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.4.2, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.1.1, =26.5.1 and more Source cves: CVE-2026-54077 Source advisory: GHSA-8W86-M9H8-HVQG...

com.arcadedb:arcadedb-console (25.4.1), com.arcadedb:arcadedb-coverage (25.4.1) +10 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (25.4.1)

com.arcadedb:arcadedb-engine MAVEN version 25.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 25.4.1 - com.arcadedb:arcadedb-coverage 25.4.1 -...

com.arcadedb:arcadedb-console (22.10.1), com.arcadedb:arcadedb-coverage (22.10.1) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (22.10.1)

com.arcadedb:arcadedb-engine MAVEN version 22.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 22.10.1 - com.arcadedb:arcadedb-coverage 22.10.1 -...

com.arcadedb:arcadedb-console (23.2.1), com.arcadedb:arcadedb-coverage (23.2.1) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (23.2.1)

com.arcadedb:arcadedb-engine MAVEN version 23.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.2.1 - com.arcadedb:arcadedb-coverage 23.2.1 -...

com.arcadedb:arcadedb-console (24.1.1), com.arcadedb:arcadedb-coverage (24.1.1) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (24.1.1)

com.arcadedb:arcadedb-engine MAVEN version 24.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 24.1.1 - com.arcadedb:arcadedb-coverage 24.1.1 -...

com.arcadedb:arcadedb-console (25.7.1), com.arcadedb:arcadedb-graphql (25.7.1) +9 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (25.7.1)

com.arcadedb:arcadedb-engine MAVEN version 25.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 25.7.1 - com.arcadedb:arcadedb-graphql 25.7.1 -...

com.arcadedb:arcadedb-console (23.11.1), com.arcadedb:arcadedb-coverage (23.11.1) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (23.11.1)

com.arcadedb:arcadedb-engine MAVEN version 23.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.11.1 - com.arcadedb:arcadedb-coverage 23.11.1 -...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points...

com.arcadedb:arcadedb-console (23.1.2), com.arcadedb:arcadedb-coverage (23.1.2) +8 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (23.1.2)

com.arcadedb:arcadedb-engine MAVEN version 23.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 23.1.2 - com.arcadedb:arcadedb-coverage 23.1.2 -...

com.arcadedb:arcadedb-console (21.10.2), com.arcadedb:arcadedb-coverage (21.10.2) +9 more potentially affected by CVE-2026-54077 via com.arcadedb:arcadedb-engine (21.10.2)

com.arcadedb:arcadedb-engine MAVEN version 21.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.arcadedb:arcadedb-engine and may be impacted: - com.arcadedb:arcadedb-console 21.10.2 - com.arcadedb:arcadedb-coverage 21.10.2 -...

PT-2026-67320

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang. via Java.type because the ScriptTriggerExecutor includes java.lang. in the allowed packages. An...

PT-2026-67321

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description Insufficient authorization checks on the SQL DEFINE FUNCTION statement when using LANGUAGE js allow users with database access to execute arbitrary JavaScript code. This bypasses security controls...

PT-2026-67322

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An authorization bypass exists in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. The issue occurs because approximately 14 HTTP handlers resolve the database path paramete...

cognee-community-graph-adapter-arcadedb (0.2.0), cognee-community-graph-adapter-memgraph (0.2.0) +25 more potentially affected by CVE-2026-58473 via cognee (>=1.0.3, <=1.4.2)

cognee PYPI version =1.0.3, =1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1...

CVE-2026-44221

ArcadeDB is a Multi-Model DBMS. Prior to 2.6.4, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: 1 ServerSecurityUser.getDatabaseUser returned a DB user with an...

CVE-2026-44221 ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases

ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: 1...

CVE-2026-44221

ArcadeDB prior to version 2.6.4 (also referenced as 26.4.2 in some advisories) contains a cross-database authorization bypass. Two defects enable authenticated principals to bypass both record-level and database-level controls: (1) ServerSecurityUser.getDatabaseUser() returns a DB user with an un...

com.arcadedb:arcadedb-bolt (>=26.2.1, <=26.3.2), com.arcadedb:arcadedb-coverage (>=21.9.1-beta, <=25.4.1) +10 more potentially affected by CVE-2026-44221 via com.arcadedb:arcadedb-server (>=21.9.1-beta, <=26.3.2)

com.arcadedb:arcadedb-server MAVEN version =21.9.1-beta, =26.2.1, =21.9.1-beta, =21.12.1, =24.11.1, =25.9.1, =25.1.1, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =21.9.1-beta, =25.11.1, =26.3.2 - io.github.mdre:adbogm 0.9.0.6 Source cves: CVE-2026-44221 Source advisory: MEND:CVE-2026-44221...

CVE-2026-44221 ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases

ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: 1...