CVE-2026-48050High· 8.2▾ TwilightArc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to `…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
— → 8.2
8.2 → —
— → 8.2
Last analysed / modified upstream
Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* via app.Use(pprof.New()) in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before the token check on prefix match, so the endpoints are reachable without any authentication. Version 26.06.1 contains a patch. Some workarounds are available. Block /debug/pprof* at a reverse proxy / load balancer in front of Arc, restrict Arc's API port to known-trusted networks via firewall rules, and/or patch the running build: comment out app.Use(pprof.New()) in internal/api/server.go and rebuild.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/basekick-labs/arc < 0.0.0-20260520170331-32a4091fb949Patched in:
github.com/basekick-labs/arc 0.0.0-20260520170331-32a4091fb949Source: https://github.com/advisories/GHSA-j93g-rp6m-j32m
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73501Critical· 9.1kin-openapi is a Go project for handling OpenAPI files
CVE-2021-38554Medium· 5.3vault: UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser (CVE-2021-38554)
CVE-2026-76905High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2025-22866Medium· 5.3crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
CVE-2026-73502Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-79651High· 7.5A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak