47 matches found
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATESCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC...
EUVD-2026-107007
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATESCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC...
PT-2026-120182
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRP...
CVE-2026-94490
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-comman...
EUVD-2026-84249
A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...
CVE-2026-94490
A security flaw exists in OctoPrint version 1.0.0 within the Command API component. Specifically, the executeSystemCommand() function in the file src/octoprint/server/api/system.py fails to properly neutralize special elements, leading to an OS command injection vulnerability. A remote attacker c...
CVE-2026-94490
...
CVE-2026-94490: Undefined Security Weakness
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-comman...
PT-2026-96321
Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description An OS command injection flaw exists in the Command API component within the executeSystemCommand function of the src/octoprint/server/api/system.py file. A remote attacker can exploit this by manipulating th...
EUVD-2026-80014
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-73807
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-73807 mySCADA myPRO Manager Missing Authorization
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-73807
mySCADA myPRO Manager has a missing authorization vulnerability in its command API , which fails to properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API can reach privileged management functions, rated CVSS 3.1 9.8 (Critical...
CVE-2026-73807 mySCADA myPRO Manager Missing Authorization
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
PT-2026-93180
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-73807: Missing Authorization
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions...
CVE-2026-75846
In ArcadeDB versions ≤ 26.7.3, DeleteFunctionStatement.executeSimple permanently removes any registered server-side function via the command API without calling checkPermissionsOnDatabase(UPDATE_SCHEMA). Any database user can delete security-relevant logic. Upgrade to 26.8.1. No in-the-wild explo...
CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...
CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...