https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T08:11:46.319567+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343736 EUVD-2026-343736 2026-10-09T08:11:46.380805+00:00 EUVD-2026-343736 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68578 fkie_cve-2026-68578 2026-10-09T08:11:46.380850+00:00

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

 https://cve.radiocsirt.org/vuln/ghsa-hq22-48ph-vqch GHSA-hq22-48ph-vqch 2026-10-09T08:11:46.380887+00:00

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.