dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE)

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

r4ven

If you find this GitHub repo useful, please consider giving it a star! ⭐️ ▶️ Watch Video - How To Use! This project is a security research and awareness tool designed to demonstrate how modern web browsers may expose location data, camera access, IP address, and device information when users...

CSRFER

CSRFER / / | \ | | \ | / /\ --.| |/ / | | | | |/ / | | --. \ /| | | || / | /// / |\ | | | || |\ \ //| \| /| | -.--. " '-, ',' 2 \ \q \ . \ .--' '----. / . . \ .'.' \ .-.\ '-, ,/ .---;- . \ \ .\ // '-. \ \ | '. , '-. c=' Cooo -. '-. '. '-. \ snd '-. '. '-. \ ---' CSRFER is a tool to...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

webscan

webscan webscan is a browser-based network IP scanner and local IP detector. It detects IPs bound to the user/victim by listening on an RTP data channel via WebRTC and looping back to the port across any live IPs, as well as discovering all live IP addresses on valid subnets by monitoring for...

YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

YesWiki 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of |URL wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication. id: CVE-2026-116205 info: name: YesWiki 4.7.0 - Unauthenticated Server-Si...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch

When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code executio...

CVE-2026-120058

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

EUVD-2026-115371

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120058 psqlODBC row cache overflow when a later FETCH changes the column count

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120058

The psqlODBC driver is vulnerable to an out-of-bounds write and integer underflow because it sizes its row cache based on the first result of a cursor but fails to verify column counts in subsequent FETCH replies. If UseDeclareFetch is enabled, a malicious server can provide a FETCH with more col...

CVE-2026-120058 psqlODBC row cache overflow when a later FETCH changes the column count

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-120058: PostgreSQL psqlODBC: psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from…

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

PT-2026-135648

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

anubis-fetch

anubis-fetch $ nix run github:fzakaria/anubis-fetch -- --text https://lore.kernel.org/ A Go CLI for fetching URLs behind Anubis proof-of-work challenges. It solves legacy SHA-256 and WASM challenges in-process, with headless Chromium as a fallback. Sites such as lore.kernel.org and kernel.org use...

CVE-2026-5061

CVE-2026-5061 Consul Template validated where a symlink pointed during template evaluation, but its later dependency fetch read the original path. Retargeting the link between those operations turned an in-sandbox file reference into an out-of-sandbox file disclosure. Intro I found this issue whi...