Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-48106: CWE-306: Missing Authentication for Critical Function in Basekick-Labs arcCVE-2026-48106 0 Arc, an open SQL-native time-series database by Basekick-Labs, has a vulnerability in versions prior to 26.06.1 where the cluster replication receiver does not authenticate the MsgReplicateSync payload at the application layer. While TLS/mTLS protects the transport layer, there is no protection against message tampering or replay attacks once inside the cluster network. This issue is fixed in version 26.06.1. Workarounds include restricting cluster network access, auditing replication logs, or disabling cluster mode until patched. Join the discussion | CVE Database V5 | 08/21/2026, 22:49:12 UTC Added: 08/21/2026, 22:53:19 UTC |
CVE-2026-48105: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Basekick-Labs arcCVE-2026-48105 0 CVE-2026-48105 is a path traversal vulnerability in Basekick-Labs arc, an open SQL-native time-series database. Prior to version 26.06.1, the Arc Enterprise Raft FSM component accepts attacker-controlled file paths in manifest-registration proposals without proper validation. This allows paths with parent directory traversal sequences and other unauthorized formats. The vulnerability is fixed in version 26.06.1. Workarounds include restricting cluster network access, auditing manifest paths, or disabling cluster mode until patched. Join the discussion | CVE Database V5 | 08/21/2026, 22:47:13 UTC Added: 08/21/2026, 22:53:19 UTC |
CVE-2026-48050: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Basekick-Labs arcCVE-2026-48050 0 Basekick-Labs arc versions prior to 26.06.1 expose Go's pprof debug endpoints at /debug/pprof/* without authentication due to middleware bypass. This allows unauthorized actors to access sensitive profiling information. The issue is patched in version 26.06.1. Workarounds include blocking these endpoints at a reverse proxy or restricting access via firewall rules. Join the discussion | CVE Database V5 | 08/21/2026, 22:40:12 UTC Added: 08/21/2026, 22:53:19 UTC |
CVE-2026-47735: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Basekick-Labs arcCVE-2026-47735 0 CVE-2026-47735 is a high-severity path traversal vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The vulnerability arises because Arc's user-SQL validator only blocked certain DuckDB I/O functions via regex denylist, leaving many others unblocked. This allowed scalar table functions in the SELECT list to bypass RBAC checks and access files outside intended directories. The issue is addressed in version 26.06.1 by implementing a structural sandbox at the DuckDB layer that restricts file access to an allowlist and disables further extension installs or loads. Join the discussion | CVE Database V5 | 08/21/2026, 22:42:55 UTC Added: 08/21/2026, 22:53:19 UTC |
Showing 1 to 4 of 4 results