Medium
CVE-2026-7715
A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7. This affects the function arango_backup of the file src/tools.ts of the component MCP Interface. Such manipulation of the…
Tag: ArangoDB
All CVEs associated with "ArangoDB". Page 1/1 • 6 CVEs.
About “ArangoDB”
A curated feed of “ArangoDB”-related CVEs appears below. We currently track 6 CVEs for this tag (all time). In the last 365 days, 2 were published. Average CVSS is 6.5 (all time; 5.8 over 365d), and 33% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
In our taxonomy this topic maps to a MODERATE impact class. Databases, proxies, and web servers often need coordinated restarts and config checks. Patch only modules you deploy, verify TLS and authentication, and tune limits. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: arangodb
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | EOL | LTS |
|---|---|---|---|---|
| 3.12 | 3.12.9.2 | - | ||
| 3.11 | 3.11.14.4 | - | ||
| 3.10 | 3.10.14 | Expired | ||
| 3.9 | 3.9.12 | Expired | ||
| 3.8 | 3.8.9 | Expired | ||
| 3.7 | 3.7.18 | Expired | ||
| 3.6 | 3.6.16 | Expired | ||
| 3.5 | 3.5.7 | Expired | ||
| 3.4 | 3.4.11 | Expired | ||
| 3.3 | 3.3.25 | Expired | ||
| 3.2 | 3.2.18 | Expired | ||
| 3.1 | 3.1.29 | - Expired | ||
| 3.0 | 3.0.12 | - Expired | ||
| 2.8 | 2.8.11 | Expired |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS (expired) · ICS
Subscribe CVEs: RSS for “ArangoDB” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2026-05-04
2026-02-15
Medium
CVE-2019-25367
ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user management, and API parameters. Attacke…
2022-09-08
Critical
CVE-2022-36084
cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate…
2022-02-09
Low
CVE-2021-25939
In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests pe…
2021-11-16
High
CVE-2021-25940
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malici…
2021-05-24
Medium
CVE-2021-25938
In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip…