idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...

CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Suggested description NorduGrid nordugrid-arc-wn 6.14.0 has the arc-job-cgroup SUID binary that is vulnerable to a path traversal attack. Combined with a race condition, the attacker can write the ppid to any file as long as the file is writable by...

CVE-2024-42642

CVE-2024-42642 Introduction The device in question is any MX500-series SSD. These SSDs are controlled by a Sillicon-Motion SM2259 controller older batches had an older controller, Sillicon-Motion SM2258, but the main focus of this document is the newer one. SM2259 is a 4-channel SATA 6Gb/s...

ARC-Browser-Address-Bar-Spoofing-PoC

ARC Browser Address Bar Spoofing - iOS/iPadOS CVE-2024-25733 ARC Browser Address Bar Spoofing PoC - iOS/iPadOS Exploit PoC Proof of Concept function spoof setTimeout = window.stop; let randomPort; do randomPort = Math.floorMath.random 1000; while randomPort === 0 || randomPort === 443;...

CVE-2026-21407

Deadlock for some IntelR ArcTM B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access whe...

EUVD-2026-121290

Deadlock for some IntelR ArcTM B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access whe...

CVE-2026-21407

A deadlock vulnerability exists in the Ring 1: Device Drivers for certain Intel(R) Arc(TM) B-series graphics cards . An unprivileged software adversary with authenticated access and low complexity can trigger a denial of service (DoS) . While the attack may require special internal knowledge, it ...

CVE-2026-21407

Deadlock for some IntelR ArcTM B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access whe...

CVE-2026-21407: n/a Intel(R) Arc(TM) B-series graphics cards: Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service

Deadlock for some IntelR ArcTM B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access whe...

Intel® Graphics Advisory - 01440

Summary: Potential security vulnerabilities for some Intel® Arc™ B-series graphics cards and some Intel® Graphics software may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID:...

Malicious Package

Overview arc-contracts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-88366

A flaw was found in NanoSVG. An attacker could exploit this vulnerability by providing a specially crafted Scalable Vector Graphics SVG file containing extreme arc radius values. Improper numeric conversion during arc calculations causes the parser to process invalid values without appropriate...

EUVD-2026-114443

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735...

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

GHSA-93CM-2V4M-C56C Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

GHSA-M3QR-FVP4-78XJ Arc has unauthenticated application log disclosure via `/api/v1/logs`

Summary Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. Details A...

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer

npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer vulnerability discovered by ? in WordPress npm node-forge versions = 1.4.0...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...