Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Arcane — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Arcane, with AI-generated Chinese analysis, references, and POCs.

Vendor: Skywarrior

CVE ID Title CVSS Severity Published
CVE-2026-86114 Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints CWE-862 6.5 Medium 2026-09-05
CVE-2026-45625 Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs CWE-862 9.9 Critical 2026-05-29
CVE-2026-45626 Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter CWE-78 6.3 Medium 2026-05-29
CVE-2026-45627 Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover CWE-79 8.2 High 2026-05-29
CVE-2026-47125 Arcane: Missing admin authorization on global variables endpoint CWE-862 8.8 High 2026-05-29
CVE-2026-47179 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane CWE-22 7.7 High 2026-05-29
CVE-2026-42461 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CWE-862 7.5 - 2026-05-09
CVE-2026-40242 Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint CWE-918 7.2 High 2026-04-10
CVE-2026-23944 Arcane allows unauthenticated proxy access to remote environments CWE-306 8.6AI High AI 2026-01-19
CVE-2026-23520 Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE CWE-78 9.1 Critical 2026-01-15
CVE-2025-69031 WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability CWE-862 5.3 Medium 2025-12-30

All 11 known CVE vulnerabilities affecting Arcane with full Chinese analysis, references, and POCs where available.