CVE-2026-69555: Incorrect Authorization

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3163 more potentially affected by CVE-2026-47890 via org.springframework:spring-webflux (>=6.2.0, <=7.0.8)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-47890 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORK-19267095...

PT-2026-79201

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description An issue involving the use of an incorrectly-resolved name or reference allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

Malicious Package

Overview arc-diag-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-18534

ArcSearch for iOS versions prior to 1.48.0 has a spoofing vulnerability where the address bar remains hidden after a page-initiated scroll, letting attacker-controlled content mimic browser UI elements. CVSS 7.4 (HIGH) reflects the high integrity impact requiring user interaction. No exploitation...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

CVE-2026-18534 Address bar spoofing risk in affected iOS versions of Arc Search

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

Signed, sealed, injected: The mechanics of DCRat in 2026

Signed, sealed, injected: The mechanics of DCRat in 2026 By Madhini Muralidharan, Shalaka Patil and Kaushal Sarda · August 13, 2026 Introduction In early 2026, the Trellix Advanced Research Center ARC identified and analyzed an active DarkCrystal RAT DCRat campaign following a critical customer...

CVE-2026-33922

A flaw was found in Arc. This path traversal vulnerability exists within the Offline archives functionality of the local web interface. A local user with administrative credentials can exploit this by submitting an archive name containing special characters, allowing them to delete arbitrary file...

CVE-2026-33922

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

EUVD-2026-55996

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-33922

CVE-2026-33922: Path traversal in the Offline archives feature of the Arc local web interface (Arc before v2.7.0). A local user with administrative Web UI credentials can submit an archive name containing traversal sequences to delete arbitrary files accessible to the Arc process, which runs with...

CVE-2026-33921 Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to...

CVE-2026-33921 Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to...

CVE-2026-33921

CVE-2026-33921 maps to a Windows RPC Runtime (rpcrt4.dll) vulnerability where NdrComplexTypeBufferSize underflows, enabling a pre-auth heap-based overflow (Ghost-Call) via RPC/SMB without credentials. Impact: potential remote code execution with SYSTEM privileges on affected Windows hosts; exploi...

Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

Summary A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. Impact A local user with administrative credentials for the web interface could submit an archive name containing traversal...

Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0

Summary The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. Impact A local user without administrative privileges could use the...

PT-2026-70103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal vulnerability exists in the Offline archives functionality of the local web interface. This issue occurs because of insufficient validation of a...