CVE Tools
Track your stack

Arcane

14 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Arcane. Use it to gauge the current risk picture and drill into individual advisories.

Arcane CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Arcane CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-121
2026-012
2026-020
2026-030
2026-041
2026-056
2026-060
2026-070
2026-080
2026-091
2026-103

Severity

How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical321%
  • High750%
  • Medium429%

Latest CVEs

The 14 most recently published vulnerabilities affecting Arcane.

  1. CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)8.8
  2. CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`4.3
  3. CVE-2026-96626Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host8.5
  4. CVE-2026-86114Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints6.5
  5. CVE-2026-45625Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs9.9
  6. CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter6.3
  7. CVE-2026-45627Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover8.2
  8. CVE-2026-47125Arcane: Missing admin authorization on global variables endpoint8.8
  9. CVE-2026-47179Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane7.7
  10. CVE-2026-42461Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)7.5
  11. CVE-2026-40242Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint7.2
  12. CVE-2026-23944Arcane allows unauthenticated proxy access to remote environments9.8
  13. CVE-2026-23520Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE9.0
  14. CVE-2025-69031WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability5.3

Product grouping is registry-driven, with AI assist and human review. How it works