GE
Vendor
getarcaneapp
13
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96627 | AR arcane getarcaneapp | 8.8 | Oct 16 | Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) |
| CVE-2026-96628 | AR arcane getarcaneapp | 4.3 | Oct 16 | Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` |
| CVE-2026-96626 | AR arcane getarcaneapp | 8.5 | Oct 16 | Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host |
| CVE-2026-86114 | AR arcane getarcaneapp | 6.5 | Sep 5 | Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints |
| CVE-2026-45625 | AR arcane getarcaneapp | 9.9 | May 29 | Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs |
| CVE-2026-45626 | AR arcane getarcaneapp | 6.3 | May 29 | Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter |
| CVE-2026-45627 | AR arcane getarcaneapp | 8.2 | May 29 | Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover |
| CVE-2026-47125 | AR arcane getarcaneapp | 8.8 | May 29 | Arcane: Missing admin authorization on global variables endpoint |
| CVE-2026-47179 | AR arcane getarcaneapp | 7.7 | May 29 | Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane |
| CVE-2026-42461 | AR arcane getarcaneapp | 7.5 | May 9 | Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) |
| CVE-2026-40242 | AR arcane getarcaneapp | 6.5 | Apr 10 | Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint |
| CVE-2026-23944 | AR arcane getarcaneapp | 9.8 | Jan 19 | Arcane allows unauthenticated proxy access to remote environments |
| CVE-2026-23520 | AR arcane getarcaneapp | 8.0 | Jan 15 | Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE |