CVE-2026-75840High· 7.5▾ TwilightArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114649Medium· 6.8Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
CVE-2026-98497Medium· 5.6kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (CVE-2026-98497)
CVE-2026-98572Medium· 4.4kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS32 (CVE-2026-98572)
CVE-2026-98577Medium· 5.3kernel: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (CVE-2026-98577)
CVE-2026-72314High· 7.8In the Linux kernel, the following vulnerability has been resolved: regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Compare against -EDEADLK, which is what ww_mutex_lock() actually returns and what every oth…