ADFSDump

ADFSDump A C tool to dump all sorts of goodies from AD FS. Created by Doug Bienstock @doughsec while at Mandiant FireEye. This tool is designed to be run in conjunction with ADFSpoof. ADFSdump will output all of the information needed in order to generate security tokens using ADFSpoof. Detailed...

CVE-2026-125327 pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query endpoint uses FetchDocuments in internal/database/search.go to read the entire filtered corpus without a LIMIT and rebuild an in-memory BM25 inde...

CVE-2026-125327

The pgEdge RAG Server (prior to version 2.0.0 ) is vulnerable to resource exhaustion via unauthenticated requests. The root cause is located in the FetchDocuments function within internal/database/search.go, which reads the entire filtered corpus without a LIMIT and rebuilds an in-memory BM25 ind...

EUVD-2026-114443

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of "CVE-2026-47735" leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In "internal/database/sandbox.go", "alloweddirectories" uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

PT-2026-107594

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

CVE-2026-84893

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

EUVD-2026-87103

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-84893 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

CVE-2026-84034 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardwareassess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthorized access to the internal database and compromise o...

EUVD-2026-71955

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

PT-2026-86394

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

EUVD-2026-62576

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20327

Cisco Unified Intelligence Center contains a blind SQL injection vulnerability in its web-based management interface , caused by insufficient validation of user-supplied input. An authenticated attacker with valid credentials can send a crafted request to read the contents of the device's interna...