CVE Daily – ArangoDB (High+Critical) https://cvedaily.com/pages/tags/arangodb.html CVE Daily – ArangoDB (High+Critical) en Wed, 03 Jun 2026 21:26:52 +0000 [Critical] CVE-2022-36084 – cruddl is software for creating a GraphQL API for a database, using the GraphQL ... https://nvd.nist.gov/vuln/detail/CVE-2022-36084 https://nvd.nist.gov/vuln/detail/CVE-2022-36084 Thu, 08 Sep 2022 22:15:08 +0000 Critical CVE-2022-36084

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFullt…

CVSS: 9.9 · CWE: CWE-74

View on NVD

]]> [High] CVE-2021-25940 – In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Sessi... https://nvd.nist.gov/vuln/detail/CVE-2021-25940 https://nvd.nist.gov/vuln/detail/CVE-2021-25940 Tue, 16 Nov 2021 10:15:06 +0000 High CVE-2021-25940

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.

CVSS: 8.8 · CWE: CWE-613

View on NVD

]]>