Mailing-list archive
No vulnerabilities published in this period.
August 2026
- [0day-rubbish] VLink Virtual Matrix 6.60 (other versions with the same unquoted openssl command construction are likely affected) Authenticated RCE (OpenSSL argument injection to SYSTEM) (8.8)
full-disclosure - [0day-rubbish] NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected) Pre-authentication RCE (missing auth + attacker assembly load) (9.8)
full-disclosure - [0day-rubbish] myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected) Authenticated RCE (admin file editor + default credentials) (8.8)
full-disclosure - [0day-rubbish] Microsip 2026 (ASD data-service agent) 2026 Eval (other builds with the same backup-runner path handling are likely affected) Pre-authentication RCE (attacker-controlled binary path, LocalSystem) (9.8)
full-disclosure - [0day-rubbish] LogicalDOC Enterprise Edition 9.3 (the incomplete CVE-2024-54448 fix suggests earlier 9.x versions are likely affected) Authenticated RCE (automation sandbox bypass + default credentials) (8.8)
full-disclosure - [0day-rubbish] CFEngine Enterprise Nova Hub 3.27.1 (other versions with the same generateScriptFromTemplates quoting are likely affected) Authenticated RCE (command injection via VCS settings, root) (8.8)
full-disclosure - [0day-rubbish] Brekeke PBX 3.19.1.8 (other versions with the same Bean dispatch model are likely affected) Pre-authentication RCE (fail-open auth gate + reflection to exec) (9.8)
full-disclosure - Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure
full-disclosure - Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path
full-disclosure - Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow
full-disclosure - UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing
full-disclosure - Realtek edimax 52fc10d19 In-Band Ioctl Response Length Confusion Causes Heap Buffer Overflow
full-disclosure - WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize
full-disclosure - Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags
full-disclosure - Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation
full-disclosure - Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection
full-disclosure - [NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File
full-disclosure - [NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records
full-disclosure - CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE
full-disclosure - Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
full-disclosure - [NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service
full-disclosure - [NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM
full-disclosure - [NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write
full-disclosure - [0day-rubbish] VMS 6.48.809 Authenticated command injection to root RCE (8.8)
full-disclosure - [0day-rubbish] ONE Reporter 13.1 Authenticated RCE / privilege escalation via CommandExecutor (8.8)
full-disclosure - [0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)
full-disclosure - [0day-rubbish] RoboTask 11.0.5.1229 Unauthenticated REST API remote task execution (9.8)
full-disclosure - [0day-rubbish] ActiveFax Server 10.70 Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (9.8)
full-disclosure - [0day-rubbish] Tornado 2.11.3 Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (9.8)
full-disclosure - [0day-rubbish] Datalore On-Premises 2026.2.3 Unauthenticated RCE via InteractiveReport access-mapping flaw (9.8)
full-disclosure - APPLE-SA-08-18-2026-1 Safari 26.6.1
full-disclosure - Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)
full-disclosure - Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)
full-disclosure - Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))
full-disclosure - Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)
full-disclosure - Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)
full-disclosure - Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)
full-disclosure - Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)
full-disclosure - Security advisory: Pre-authentication RCE (BinaryFormatter deserialization) in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH)
full-disclosure - Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))
full-disclosure - Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)
full-disclosure - Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)
full-disclosure - Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)
full-disclosure - Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)
full-disclosure - Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)
full-disclosure - Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)
full-disclosure - Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)
full-disclosure - APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2
full-disclosure - APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
full-disclosure - APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10
full-disclosure