Login Request a demo
AR
Product
arcane
by getarcaneapp · last CVE Oct 16, 2026
13
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 2High 7Medium 4Low 0
Severity
All severities13Critical2High7Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add arcane to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-96627
8.8
0%
Oct 16
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Affected: < 2.6.0
CVE-2026-47125
8.8
0%
May 29
Arcane: Missing admin authorization on global variables endpoint
Affected: < 1.19.2
CVE-2026-96626
8.5
0%
Oct 16
Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
Affected: < 2.5.0
CVE-2026-45627
8.2
0%
May 29
Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover
Affected: < 1.19.0
CVE-2026-23520
8.0
2%
Jan 15
Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE
Affected: < 1.13.0
CVE-2026-47179
7.7
0%
May 29
Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane
Affected: < 1.19.4
CVE-2026-42461
7.5
1%
May 9
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)
Affected: < 1.18.0
Showing 7