# Basekick Labs vulnerabilities Source: https://junglewise.ai/threats/vendors/basekick-labs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/basekick-labs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 7 vulnerabilities in Basekick Labs: 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Arc unauthenticated application log disclosure via /api/v1/logs, was published on 5 November 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 7 - All time: 7 (0 critical, 0 exploited in the wild) ## About Basekick Labs A software development company focused on digital product engineering. ## Latest Basekick Labs vulnerabilities - [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/go-2026-6907-arc-has-unauthenticated-application-log-disclosure-via-api-bf3cce98) (info, published 5 Nov 2026) - [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/arc-has-unauthenticated-application-log-disclosure-via-api-v1-logs-a055c7d7) (low, published 3 Nov 2026) - [CVE-2026-55678: Arc Enterprise authentication bypass in cluster node admission](https://junglewise.ai/threats/cve-2026-55678-arc-enterprise-authentication-bypass-in-cluster-node-admission) (medium, CVSS 4, published 28 Aug 2026) - [CVE-2026-48106: Arc Enterprise cluster replication unauthenticated message acceptance](https://junglewise.ai/threats/cve-2026-48106-arc-enterprise-cluster-replication-unauthenticated-message) (info, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-48105: Arc Enterprise path traversal in Raft FSM file registration](https://junglewise.ai/threats/cve-2026-48105-arc-enterprise-path-traversal-in-raft-fsm-file-registration) (info, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-48050: Basekick-Labs Arc unauthenticated access to pprof debug endpoints](https://junglewise.ai/threats/cve-2026-48050-basekick-labs-arc-unauthenticated-access-to-pprof-debug-endpoints) (high, CVSS 4, published 21 Aug 2026) - [CVE-2026-47735: Basekick Labs Arc local file read and SSRF via DuckDB functions](https://junglewise.ai/threats/cve-2026-47735-basekick-labs-arc-local-file-read-and-ssrf-via-duckdb-functions) (high, CVSS 4, published 21 Aug 2026) ## Most severe Basekick Labs vulnerabilities - [CVE-2026-48050: Basekick-Labs Arc unauthenticated access to pprof debug endpoints](https://junglewise.ai/threats/cve-2026-48050-basekick-labs-arc-unauthenticated-access-to-pprof-debug-endpoints) (high, CVSS 4, published 21 Aug 2026) - [CVE-2026-47735: Basekick Labs Arc local file read and SSRF via DuckDB functions](https://junglewise.ai/threats/cve-2026-47735-basekick-labs-arc-local-file-read-and-ssrf-via-duckdb-functions) (high, CVSS 4, published 21 Aug 2026) - [CVE-2026-55678: Arc Enterprise authentication bypass in cluster node admission](https://junglewise.ai/threats/cve-2026-55678-arc-enterprise-authentication-bypass-in-cluster-node-admission) (medium, CVSS 4, published 28 Aug 2026) - [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/arc-has-unauthenticated-application-log-disclosure-via-api-v1-logs-a055c7d7) (low, published 3 Nov 2026) - [CVE-2026-48105: Arc Enterprise path traversal in Raft FSM file registration](https://junglewise.ai/threats/cve-2026-48105-arc-enterprise-path-traversal-in-raft-fsm-file-registration) (info, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-48106: Arc Enterprise cluster replication unauthenticated message acceptance](https://junglewise.ai/threats/cve-2026-48106-arc-enterprise-cluster-replication-unauthenticated-message) (info, CVSS 7.5, published 21 Aug 2026) - [Arc unauthenticated application log disclosure via /api/v1/logs](https://junglewise.ai/threats/go-2026-6907-arc-has-unauthenticated-application-log-disclosure-via-api-bf3cce98) (info, published 5 Nov 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 4 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Basekick Labs technologies - [Basekick Labs Arc](https://junglewise.ai/threats/technologies/arc): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Basekick Labs vulnerabilities", https://junglewise.ai/threats/vendors/basekick-labs, 13 November 2026.