ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-113714 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-113718 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-113719 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-113722 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-113732 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

analysis3054 (>=0.3.24, <=0.5.2), autogluon (>=0.5.0b20220623, <=1.5.1b20260720) +18 more potentially affected by CVE-2026-100308 via gluonts (>=0.6.0, <=0.17.0rc1)

gluonts PYPI version =0.6.0, =0.3.24, =0.5.0b20220623, =0.5.0b20220623, =0.1.3, =0.0.1, =0.6.0, =1.0.0, =0.2.0, =0.1.3, =0.0.1, =0.1.0 and more Source cves: CVE-2026-100308 Source advisory: MEND:CVE-2026-100308...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93594 ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93594

ArcadeDB (Maven com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file ID. Query paths reaching data through LSM index files or the TimeSeries engine skip that permission check entirely. An authenticated user denied readRe...

EUVD-2026-82912

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93593 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

EUVD-2026-82889

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93593 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93593 ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93594 ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93594 ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93593

ArcadeDB before 26.9.1 is affected by a TimeSeries ACL bypass (CVE-2026-93593). The root cause lies in the ACL resolver, which builds permissions from bucket IDs; however, TimeSeries types do not own normal record buckets, causing the missing type-name-based access check and resulting in permissi...

CVE-2026-93594: Incorrect Authorization

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93593: Incorrect Authorization

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...