Skip to content
CVE Tracker

Basekick-Labs vulnerabilities

6 published CVEs name Basekick-Labs among the affected products.

All 6 in the listAtom feed of new CVEs
Published CVEs
6
Last 12 months
6
Critical
0
Known exploited
0

Critical 0High 4Medium 2Low 0Not scored 0

Newest CVEs

  • CVE-2026-55098

    Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

    Basekick-Labs · arc

    Medium6.5
  • CVE-2026-55678

    Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset

    Basekick-Labs · arc

    Medium6.9
  • CVE-2026-48106

    Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer

    Basekick-Labs · arc

    High8.3
  • CVE-2026-48105

    Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

    Basekick-Labs · arc

    High8.3
  • CVE-2026-47735

    Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

    Basekick-Labs · arc

    High7.1
  • CVE-2026-48050

    Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

    Basekick-Labs · arc

    High8.8

Products with the most CVEs

  1. arc6

Most common weaknesses

  1. CWE-200 Exposure of sensitive information3
  2. CWE-306 Missing authentication for a critical function3
  3. CWE-22 Path traversal2
  4. CWE-345 2
  5. CWE-284 Improper access control1
  6. CWE-287 Improper authentication1
  7. CWE-400 Uncontrolled resource consumption1
  8. CWE-863 Incorrect authorization1
  9. CWE-913 1
  10. CWE-918 Server-side request forgery (SSRF)1