Linux Distros Unpatched Vulnerability : CVE-2026-59645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

EUVD-2026-51988

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578 ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578

ArcadeDB before 26.7.3 is affected by an authentication bypass in the MCP HTTP transport: the server does not bind the authenticated principal, causing engine permission checks to pass as no-ops. As a result, non-root MCP-allowed users can perform arbitrary writes, DDL, schema mutations, and run ...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

EUVD-2026-51807

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67340

ArcadeDB prior to 26.7.2 (arcadedb-engine) is affected: ScriptTriggerExecutor adds java.lang.* to allowed packages, allowing trigger scripts to access host classes via Java.type. An authenticated user with UPDATE_SCHEMA can create a JavaScript trigger that calls java.lang.Runtime.getRuntime().exe...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

CVE-2026-67344 ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE

ArcadeDB before 26.7.2 fails to enforce the UPDATESCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access e.g., a...

EUVD-2026-51813

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67344

ArcadeDB before 26.7.2 is affected: ALTER TYPE operations for CUSTOM and BUCKETSELECTIONSTRATEGY do not enforce UPDATE_SCHEMA, allowing an authenticated user with only read access (e.g., a read‑only API token) to mutate a type’s custom schema metadata and bucket‑selection strategy via the HTTP co...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-17348

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

EUVD-2026-51563

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17348 pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

EUVD-2026-51561

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...