https://vulnerability.circl.lu/sightings/feed 2026-08-11T06:25:02.959722+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/191a760c-7cfb-456c-8f60-89481b8c38c0/export 2026-08-11T06:25:02.986531+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "191a760c-7cfb-456c-8f60-89481b8c38c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "published-proof-of-concept", "source": "https://t.me/hn_best_comments/23447", "content": "Re: Gaining access to anyones Arc browser without them...\n \nI\u2019m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We\u2019ve written up some technical details and how we\u2019ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response.\n\nI'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here \u2013 everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.\n \nha470, 10 hours ago", "creation_timestamp": "2026-08-02T00:01:12.157962Z"} 2026-08-02T00:01:12.157962+00:00 https://vulnerability.circl.lu/sighting/9619201f-6915-4621-9b00-dc0a4f0fb1df/export 2026-08-11T06:25:02.989890+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9619201f-6915-4621-9b00-dc0a4f0fb1df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "published-proof-of-concept", "source": "https://t.me/hn_best_comments/23447", "content": "Re: Gaining access to anyones Arc browser without them...\n \nI\u2019m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We\u2019ve written up some technical details and how we\u2019ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response.\n\nI'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here \u2013 everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.\n \nha470, 10 hours ago", "creation_timestamp": "2026-08-01T08:00:04.771115Z"} 2026-08-01T08:00:04.771115+00:00 https://vulnerability.circl.lu/sighting/ed3adaff-b0e9-45c3-a0e9-9d9076462d42/export 2026-08-11T06:25:02.990205+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ed3adaff-b0e9-45c3-a0e9-9d9076462d42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "seen", "source": "https://t.me/hn_best_comments/23447", "content": "Re: Gaining access to anyones Arc browser without them...\n \nI\u2019m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We\u2019ve written up some technical details and how we\u2019ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response.\n\nI'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here \u2013 everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.\n \nha470, 10 hours ago", "creation_timestamp": "2026-07-30T00:01:47.139270Z"} 2026-07-30T00:01:47.139270+00:00 https://vulnerability.circl.lu/sighting/a47154b4-5e3e-4b1a-8739-49e5fc522e91/export 2026-08-11T06:25:02.990323+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a47154b4-5e3e-4b1a-8739-49e5fc522e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "seen", "source": "https://t.me/hn_best_comments/23447", "content": "Re: Gaining access to anyones Arc browser without them...\n \nI\u2019m Hursh, cofounder and CTO of The Browser Company (the company that makes Arc). Even though no users were affected and we patched it right away, the hypothetical depth of this vulnerability is unacceptable. We\u2019ve written up some technical details and how we\u2019ll improve in the future (including moving off Firebase and setting up a proper bug bounty program) here: https://arc.net/blog/CVE-2024-45489-incident-response.\n\nI'm really sorry about this, both the vuln itself and the delayed comms around it, and really appreciate all the feedback here \u2013 everything from disappointment to outrage to encouragement. It holds us accountable to do better, and makes sure we prioritize this moving forward. Thank you so much.\n \nha470, 10 hours ago", "creation_timestamp": "2026-07-29T12:01:06.943417Z"} 2026-07-29T12:01:06.943417+00:00 https://vulnerability.circl.lu/sighting/d536a163-ea65-46e4-9dd9-319a5b821f7c/export 2026-08-11T06:25:02.990426+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d536a163-ea65-46e4-9dd9-319a5b821f7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11202", "content": "#exploit\n1. CVE-2024-45489:\nArc Browser RCE in JavaScript Boosts\nhttps://kibty.town/blog/arc\n\n2. CVE-2024-44623:\nBlind RCE issue(SPX-GC) in SPX-GC\nhttps://github.com/merbinr/CVE-2024-44623\n\n3. CVE-2024-6769:\nPoisoning the activation cache to elevate from medium to high integrity in Windows 10/11/Srv2019/Srv2022\nhttps://github.com/fortra/CVE-2024-6769\n\n4. CVE-2024-45519: \nZimbra SMTP RCE\nhttps://blog.projectdiscovery.io/zimbra-remote-code-execution\n]-> https://github.com/p33d/CVE-2024-45519", "creation_timestamp": "2024-11-01T03:20:06.000000Z"} 2024-11-01T03:20:06+00:00 https://vulnerability.circl.lu/sighting/ac7cd0c9-6124-47fb-98e7-a5e0731bf442/export 2026-08-11T06:25:02.990497+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ac7cd0c9-6124-47fb-98e7-a5e0731bf442", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/1582", "content": "#exploit\n1. CVE-2024-45489:\nArc Browser RCE in JavaScript Boosts\nhttps://kibty.town/blog/arc\n\n2. CVE-2024-44623:\nBlind RCE issue(SPX-GC) in SPX-GC\nhttps://github.com/merbinr/CVE-2024-44623\n\n3. CVE-2024-6769:\nPoisoning the activation cache to elevate from medium to high integrity in Windows 10/11/Srv2019/Srv2022\nhttps://github.com/fortra/CVE-2024-6769", "creation_timestamp": "2024-10-02T16:38:48.000000Z"} 2024-10-02T16:38:48+00:00 https://vulnerability.circl.lu/sighting/973cbb16-66bd-42e2-a496-ea24db34b121/export 2026-08-11T06:25:02.990570+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "973cbb16-66bd-42e2-a496-ea24db34b121", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/4904", "content": "#exploit\n1. CVE-2024-45489:\nArc Browser RCE in JavaScript Boosts\nhttps://kibty.town/blog/arc\n\n2. CVE-2024-44623:\nBlind RCE issue(SPX-GC) in SPX-GC\nhttps://github.com/merbinr/CVE-2024-44623\n\n3. CVE-2024-6769:\nPoisoning the activation cache to elevate from medium to high integrity in Windows 10/11/Srv2019/Srv2022\nhttps://github.com/fortra/CVE-2024-6769", "creation_timestamp": "2024-10-02T16:38:47.000000Z"} 2024-10-02T16:38:47+00:00 https://vulnerability.circl.lu/sighting/03abccc2-937f-4316-b10d-98358ef0385c/export 2026-08-11T06:25:02.990636+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "03abccc2-937f-4316-b10d-98358ef0385c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "exploited", "source": "https://t.me/xakep_ru/16487", "content": "\u0411\u0440\u0430\u0443\u0437\u0435\u0440 Arc \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 bug bounty \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Arc, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f The Browser Company, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b bug bounty, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u043e\u0431\u0449\u0430\u0442\u044c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f. \u041a \u044d\u0442\u043e\u043c\u0443 \u0448\u0430\u0433\u0443 \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0435\u0439 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 \u043f\u043e\u0434\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2024-45489, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441\u043e\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Arc.\n\nhttps://xakep.ru/2024/10/02/arc-bug-bounty/", "creation_timestamp": "2024-10-02T14:39:58.000000Z"} 2024-10-02T14:39:58+00:00 https://vulnerability.circl.lu/sighting/e043661b-59be-4ef7-a178-389df46ce78b/export 2026-08-11T06:25:02.990707+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e043661b-59be-4ef7-a178-389df46ce78b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "seen", "source": "Telegram/7gCCrXcF7kplbW8vCcSuolSiDuLcYtPRKYzfdVi7ua9f0qw", "content": "", "creation_timestamp": "2024-09-23T08:30:38.000000Z"} 2024-09-23T08:30:38+00:00 https://vulnerability.circl.lu/sighting/dc7cd4e5-1207-4838-a03a-44bfb3f16d17/export 2026-08-11T06:25:02.990768+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "dc7cd4e5-1207-4838-a03a-44bfb3f16d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-45489", "type": "seen", "source": "https://t.me/cvedetector/6113", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-45489 - Arc Remote Code Execution Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-45489 \nPublished : Sept. 20, 2024, 5:15 p.m. | 24\u00a0minutes ago \nDescription : Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however, it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and runs arbitrary Javascript on that browser in a privileged context. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"20 Sep 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-09-20T19:45:10.000000Z"} 2024-09-20T19:45:10+00:00