CVE-2026-42461

Arcane (Huma backend) has an unauthenticated information disclosure vulnerability prior to version 1.18.0. Four GET endpoints under /api/templates* (list, all, specific, and content) were registered without any Security requirement, enabling unauthenticated network clients to read full Compose YA...

CVE-2026-40242

The Arcane Docker management interface is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in versions prior to 1.17.3 . The flaw exists in the /api/templates/fetch endpoint, which accepts a caller-supplied url parameter and performs a server-side HTTP GET request without authe...