high · CVSS v3 7.5

CVE-2026-114059

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-o…

Description

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.

Scores

Severity
high
CVSS v2
7.1
CVSS v3
7.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-114053

vLLM versions 0.7.3 through 0.30.9 allow an attacker to specify a code revision that is loaded by the Transformers AutoProcessor when trust_remote_code is enabled. This can lead to arbitrary Python execution via the unauthenticated /tokenize endpoint. The flaw affects any deployment of vLLM that accepts external model revisions.

View analysis

high

CVE-2026-114055

The vulnerability in vLLM (versions 0.7.3 through 0.30.x) allows remote clients to supply oversized multimodal processor parameters via mm_processor_kwargs, causing uncontrolled memory consumption and server termination. It affects multimodal processors such as Isaac, InternVL, and H2OVL. The flaw can be exploited to disrupt services that rely on shared vLLM instances.

View analysis

high

CVE-2026-114063

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users read arbitrary files outside the prerendered output. The vulnerability can leak source code, configuration, or credentials if the preview server is reachable over the network. It is critical for deployments that expose the preview server to the internet or internal network.

View analysis

high

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

View analysis