CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...

Malware in apex-fetch

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18410 Malicious code in apex-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6e333b1835e39c7456b9e9ad49d5582e9c4d0b56f1ca5884ee7ed02e8b5cbc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-119709

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CSRFER

CSRFER / / | \ | | \ | / /\ --.| |/ / | | | | |/ / | | --. \ /| | | || / | /// / |\ | | | || |\ \ //| \| /| | -.--. " '-, ',' 2 \ \q \ . \ .--' '----. / . . \ .'.' \ .-.\ '-, ,/ .---;- . \ \ .\ // '-. \ \ | '. , '-. c=' Cooo -. '-. '. '-. \ snd '-. '. '-. \ ---' CSRFER is a tool to...

CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CVE-2026-119709

The Grimoire software, prior to version 1.0.0 , is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /api/fetch-metadata POST handler. The root cause is the lack of authentication checks when passing user-supplied URLs to the getMetadata() function. An attacker can submit...

EUVD-2026-114114

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

CVE-2026-119709 Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

CVE-2022-32932

CVE-2022-32932 : ZinComputeProgramUpdateMutables OOB write due to double fetch issue 저자 commnet CVE-2022-32932 is another vulnerability I discovered in the ANE kernel interface; this is a double fetch issue that resulted in an interesting OOB write. Analysis: H11ANEIn::patchMutableSurface reachab...

r4ven

If you find this GitHub repo useful, please consider giving it a star! ⭐️ ▶️ Watch Video - How To Use! This project is a security research and awareness tool designed to demonstrate how modern web browsers may expose location data, camera access, IP address, and device information when users...

anubis-fetch

anubis-fetch $ nix run github:fzakaria/anubis-fetch -- --text https://lore.kernel.org/ A Go CLI for fetching URLs behind Anubis proof-of-work challenges. It solves legacy SHA-256 and WASM challenges in-process, with headless Chromium as a fallback. Sites such as lore.kernel.org and kernel.org use...

CVE-2023-28218

Report CVE-2023-28218 Bug overview Bug leading to privilege escalation in the Windows kernel. The bug appears in the driver Windows Ancillary Function Driver for WinSock AFD.sys. The bug was released in the patch dated 11/04/2023. It has a CVSS:3.1 7.0 / 6.1 score and is rated as Important. Bug...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

webscan

webscan webscan is a browser-based network IP scanner and local IP detector. It detects IPs bound to the user/victim by listening on an RTP data channel via WebRTC and looping back to the port across any live IPs, as well as discovering all live IP addresses on valid subnets by monitoring for...

Analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking team Flowchart of code Network IoC https://172\.20\.20\.164 Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS...

CVE-2026-118194

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the paprrestrictpagepostrestapi function, hooked on restpredispatch, re-authenticating the current user from the wordpressloggedin cookie via...

EUVD-2026-113712

The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the paprrestrictpagepostrestapi function, hooked on restpredispatch, re-authenticating the current user from the wordpressloggedin cookie via...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...