https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T21:16:55.198272+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-357966 EUVD-2026-357966 2026-10-09T21:16:55.243373+00:00 EUVD-2026-357966 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67340 fkie_cve-2026-67340 2026-10-09T21:16:55.243410+00:00

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

 https://cve.radiocsirt.org/vuln/ghsa-w8vx-3rmm-v7rp GHSA-w8vx-3rmm-v7rp 2026-10-09T21:16:55.243444+00:00

ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.