MacHound

What is MacHound MacHound is an extension to the Bloodhound audting tool allowing collecting and ingesting of Active Directory relationships on MacOS hosts. MacHound collects information about logged-in users, and administrative group members on Mac machines and ingest the information into the...

the-endorser

🚨 The Endorser is no longer maintained. If you need support or consultation for your OSINT endeavours, drop me an e-mail [email protected] 🚨 The Endorser An OSINT tool that allows you to draw out relationships between people on LinkedIn via endorsements/skills. Check out the example digraph,...

Gotenberg < 8.34.0 - Local File Disclosure

Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document such as a:blip r:link TargetMode="External" can instruct LibreOffice to fetch...

sccmhound

SCCMHound SCCMHound is a C BloodHound collector for Microsoft Configuration Manager MCM. If you're looking for a way to collect BloodHound session information from Configuration Manager's users and computers then this is the tool for you! Highly recommend importing collected data with another...

CVE-2026-82742

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

EUVD-2026-68947

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82742

CVE-2026-82742 is an uncontrolled resource consumption vulnerability in the ash Elixir framework (versions 1.29.0-rc0 through before 3.32.2 ). The root cause is in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex), which eagerly materializes the full Cartesian prod...

EEF-CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations...

CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. Ash.Filter.Runtime matches a filter against an in-memory record by first expanding the record into combinations of its...

CVE-2026-82725

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

EUVD-2026-68337

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

EEF-CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-77454

CVE-2026-77454 is an Incorrect Authorization vulnerability in the ash-project ash_sql Elixir package, affecting versions 0.4.1 through 0.7.0 . The root cause lies in AshSql.Join.related_query/3: when a relationship declares both a limit (or from_many?) and a parent(...)-referencing filter or sort...

EUVD-2026-54939

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-70395

The CVE-2026-70395 description identifies a vulnerability in ash-project where, for belongs_to relationships using on_lookup: :relate, a client-provided lookup value is passed to Ash.Query.filter/2 without type casting. This can cause a nested map to be treated as a filter predicate rather than a...

CVE-2026-64556 perf/core: Detach event groups during remove_on_exec

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

EUVD-2026-38636

Fortra File Integrity Monitoring FIM, formerly Tripwire Enterprise, versions prior to 9.4.0 may assign incorrect or elevated effective permissions to users created by the tetool import command while FIM is running, particularly when the import also creates or changes roles or role-permission...

CVE-2026-11852

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in...