postfetch

postfetch Postfetch posture fetch is a fastfetch-style privacy and security audit tool for Linux, written in rust. Instead of cosmetic system info, postfetch shows whether your system is configured to support privacy, security, local control, and digital sovereignty. Modules Module| Checks ---|--...

rmx3888-cve-2026-43499-config

CVE-2026-43499 Exploit Configuration for realme RMX3888 Device Information Brand/Model : realme RMX3888 Android Version : 16 SDK 36 Build ID : BP2A.250605.015 Kernel : Linux 6.1.141-android14-11-o-gffc54a6d2287 SoC : Qualcomm SM8650 Snapdragon 8 Gen 3 Architecture : ARM64 aarch64 Overview This...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...

CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

CVE-2020-13405

CVE-2020-13405 Base Score: 7.5 HIGH🟥 MicroWeber is an open-source Content Management System CMS written in PHP. It allows web administrators to easily build a website by dragging and dropping components where they want them to be. It is a popular choice among those looking to start a website that...

Check-vuln-CVE-2019-0708

CVE-2019-0708 Unauthenticated CVE-2019-0708 "BlueKeep" Scanner PoC by @JaGoTu and @zerosum0x0. Metasploit module PR: https://github.com/rapid7/metasploit-framework/pull/11869 In this repo A scanner fork of rdesktop that can detect if a host is vulnerable to CVE-2019-0708 Microsoft Windows Remote...

CVE-2025-47256

CVE-2025-47256 Stack overflow in LibXMP Description A stack-based buffer overflow vulnerability exists in the depackpha function of libxmp, a library for module music playback. The vulnerability is triggered when parsing malformed Pha Packer PHA module files. Improper bounds checking on a local...

PGP-Tools

PGP Tools Open-source browser extension for PGP encryption, decryption, and signing. Built with Rust/WebAssembly. Private keys never touch the JS heap unless they have to. Get it here Why PGP Tools? Open source and transparent. Most PGP browser extensions are closed source. You shouldn't trust a...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control MSI Modern 15H AI C1MG-096IT Linux thermal management - Reverse engineered EC control with fan profiles and battery threshold 🎯 Purpose of this Project This application was born out of necessity for MSI laptop users on Linux. The journey began when I discovered that...

PT-2026-118059

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project view id in the task position endpoint v1 and v2 in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped t...

Malicious code in animatecss-tailwind-plugin (npm)

animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

ROS-20261019-73-0014

The vulnerability of the nftbyteordereval function in the net/netfilter/nftbyteorder.c module of the Linux operating system’s kernel is related to incorrect handling of values. Exploiting this vulnerability could allow an attacker to cause service failures or have other adverse effects...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

RHEL 8 : gimp:2.8 (RHSA-2026:84744)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84744 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

RHEL 9 : rsyslog (RHSA-2026:84571)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:84571 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering o...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS-STREAM8:CLSA-2026:1792425300)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1792425300 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.4:CLSA-2026:1792411866)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792411866 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

PT-2026-118039

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-118058

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118056

Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...