https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T20:55:09.165394+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343927 EUVD-2026-343927 2026-10-09T20:55:09.170231+00:00 EUVD-2026-343927 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67343 fkie_cve-2026-67343 2026-10-09T20:55:09.170274+00:00

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.

 https://cve.radiocsirt.org/vuln/ghsa-3cc2-w6p6-c4vg GHSA-3cc2-w6p6-c4vg 2026-10-09T20:55:09.170310+00:00

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.