Mail Thread Index

• Date Index

• [FD] [NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service, advisories
• [FD] [NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service, advisories
• [FD] [NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read, advisories
• [FD] [NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read, advisories
• [FD] SEC Consult SA-20260924-0 :: Multiple Vulnerabilities in Paessler PRTG Network Monitor #CVE-2026-4637 #CVE-2026-4638, SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mail, SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] [0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Asustor ADM 3.5.9.RWM1 (AS602T) music.cgi act=live stored-filename command injection reaching system() (8.8 primary, PR:L), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Circutor LineEds 24.11.14-r0 unauthenticated pwrstudio events.xml shellExecute command injection (9.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] IPConfigure Orchid VMS 26.3.0 authenticated DNF repository GPG-key property command injection to root (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H), disclosure via Fulldisclosure
• [FD] [0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary), disclosure via Fulldisclosure
• [FD] SmarterMail <9777 Pre-Auth RCE (half click lol): CVE-2026-104082, CVE-2026-104083, CVE-2026-104084, evan via Fulldisclosure
• [FD] 1-click MMI/USSD execution in Android via CALL_PHONE and browser-reachable dialer deeplinks (ACR Phone / com.nll.cb), Karan Saini
• [FD] SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series, SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] [0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H), disclosure via Fulldisclosure
• [FD] [0day-rubbish] PacsOne Server 7.3.9 authenticated DICOMweb STOW-RS SOP Instance UID path traversal to www-data code execution on a PACS host (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5), disclosure via Fulldisclosure
• [FD] [0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5), disclosure via Fulldisclosure
• [FD] [SYSS-2026-077]: dcm4che - Path Traversal (CWE-22), Matthias Deeg via Fulldisclosure
• [FD] [SYSS-2026-078]: dcm4che - Path Traversal (CWE-22), Matthias Deeg via Fulldisclosure
• [FD] [SYSS-2026-079]: dcm4che - Path Traversal (CWE-22), Matthias Deeg via Fulldisclosure
• [FD] [SYSS-2026-080]: dcm4che - Path Traversal (CWE-22), Matthias Deeg via Fulldisclosure
• [FD] VestaCP <= 0.9.8-26: authenticated config-parser eval sinks -> root RCE (VESTACP-2026-001), Bryan Ramirez via Fulldisclosure
• [FD] [ROOTEDCON] Call for Papers 2027 · RootedCON2027 (Madrid), Román Ramírez
• [FD] [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] ProSoft Technology RLX-IFH24E v2.2.44 unsigned firmware upgrade package to root command execution and full account-database overwrite (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High), disclosure via Fulldisclosure
• [FD] [0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H), disclosure via Fulldisclosure
• [FD] SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying, David Brown via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2, KC Chambers via Fulldisclosure
  • <Possible follow-ups>
  • [FD] APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2, Apple Product Security via Fulldisclosure
• [FD] SEC Consult SA-20261023-0 :: Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem, SEC Consult Vulnerability Lab via Fulldisclosure
• [FD] CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2), jose
  • Re: [FD] CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2), fulldisclosure
• [FD] APPLE-SA-10-26-2026-1 iOS 27.2 and iPadOS 27.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-7 tvOS 27.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-8 watchOS 27.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-9 visionOS 27.2, Apple Product Security via Fulldisclosure
• [FD] APPLE-SA-10-26-2026-10 Safari 27.2, Apple Product Security via Fulldisclosure
• [FD] Continued Apache Struts2 JSON Plugin Insecure Deserialisation, Daniel Owens via Fulldisclosure
• [FD] Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept, Daniel Owens via Fulldisclosure
• [FD] [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2), disclosure via Fulldisclosure
• [FD] [0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical), disclosure via Fulldisclosure
• [FD] [0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8), disclosure via Fulldisclosure
• [FD] [0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure), disclosure via Fulldisclosure