getarcaneapp arcane

• CVE-2026-96627 High 8.8 Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) 0.4%
• CVE-2026-96628 Medium 4.3 Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` 0.2%
• CVE-2026-96626 High 8.5 Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host 0.2%
• CVE-2026-86114 Medium 6.5 Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints 0.4%
• CVE-2026-45625 Critical 9.9 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs 0.4%
• CVE-2026-45626 Medium 6.3 Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter 0.2%
• CVE-2026-45627 High 8.2 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover 0.2%
• CVE-2026-47125 High 8.8 Arcane: Missing admin authorization on global variables endpoint 0.2%
• CVE-2026-47179 High 7.7 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane 0.3%
• CVE-2026-42461 High 8.7 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) 1.3%
• CVE-2026-40242 High 7.2 Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint 0.6%
• CVE-2026-23944 High 8.0 Arcane allows unauthenticated proxy access to remote environments 0.5%
• CVE-2026-23520 Critical 9.1 Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE 1.8%