# usvg SVGZ decompression bomb in `Tree::from_data`
**Author:** Khashayar Fereidani
**Disclosure Date:** 2026-09-18
**Advisory:** https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata
**Contact:** https://fereidani.com/contact
## Description
`Tree::from_data` in `crates/usvg/src/parser/mod.rs:102` detects the gzip magic
bytes at the start of the input and decompresses the data befo
SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742
SEC Consult Vulnerability Lab Security Advisory < 20260923-0 >
=======================================================================
title: Local Privilege Escalation
product: Honeywell IQ MultiAccess Update Service
vulnerable version: IQ V27 & IQ V28
fixed version: IQ V27 SP1 & IQ V28 SP1
CVE number: CVE-2026-13742
impact: high
h
[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)
0day Rubbish Research Team is publicly disclosing a vulnerability in Server
Technology (Legrand group) PRO3X series intelligent rack PDUs, firmware
spdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).
Type: authenticated listener program override leading to root command execution
(CWE-78, CWE-269; a separate hard-coded factory credential is reported as
CWE-798). PRO3X PDUs run port_mux, an in
[0day-rubbish] Netsis NetOpenX REST 2.0.6.9 Unauthenticated SQL injection to xp_cmdshell SYSTEM command execution (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in Logo
Netsis NetOpenX REST 2.0.6.9 (also distributed as Netsis Nox REST), the REST
API gateway of the Netsis enterprise ERP suite.
Type: unauthenticated SQL injection in the OAuth 2.0 token endpoint leading to
operating-system command execution via SQL Server xp_cmdshell
(CWE-89, CWE-306, CWE-78). A single POST /api/v2/token carr
0day Rubbish Research Team is publicly disclosing a vulnerability in MultiTech
Conduit AEP (models mtcdt / mtcdtip / mtcdtiphp), IoT gateways running mLinux on
ARM 32-bit.
Type: authenticated OS command injection (CWE-78) through the uploaded filename
of the admin-only upload_config command. The management API is served by lighttpd
on TCP 8080 and proxied to the proprietary FastCGI daemon /usr/bi
0day Rubbish Research Team is publicly disclosing a vulnerability in
Lightstreamer Server 7.4.8 build 3506 (with JMS Extender 2.1.0).
Type: unauthenticated JMX inspection console allowing an anonymous caller to
invoke any MBean operation, reaching jvmtiAgentLoad on
com.sun.management:type=DiagnosticCommand to load and run a native agent
library inside the broker JVM (CWE-306, CWE-345, CWE-20, CWE
[0day-rubbish] Lightstreamer Server 7.4.8 Shipped placeholder JMX/RMI credentials plus MLet remote class loading to root RCE (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
Lightstreamer Server 7.4.8 build 3506 ENTERPRISE (with JMS Extender 2.1.0).
Type: a hard-coded placeholder credential shipped in the distribution
(user_changeme / password_changeme) authenticating a cleartext RMI management
connector on TCP 8888 bound to every interface; because the connector exposes
createMBean, an attacker reg
0day Rubbish Research Team is publicly disclosing a vulnerability in Lantronix
SGX5150, firmware 9.13.0.0R7, an IT/OT device server.
Type: authenticated OS command injection (CWE-78) in the FsBrowseClean AJAX
handler (0x5eea0) of /bin/ltrx_evo. A per-character filter blocks & | < ; ! $
backslash backtick and > but permits single quote, hash and newline. The path
POST parameter is concatenated int
[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in Safe
Software FME Flow 2026.2 build 26333.
Type: path-traversal write inside archive extraction (Zip-Slip) in
COM.safe.web.upload.StoreManager.extract(), shipped in
clients-webservicesutil-1.0.jar (CWE-22). The sink builds each destination path
from ZipArchiveEntry.getName() verbatim; commons-compress 1.26.2 does not
normalise "
0day Rubbish Research Team is publicly disclosing a vulnerability in the Cambium
cnMatrix EX3024F managed switch, firmware 6.2.1-r4.
Type: OS command injection (CWE-78, with CWE-20 bearing on it because
percent-decoding is the only processing applied; CWE-250/CWE-269 bear on
remediation priority). The COMMON_NAME form field submitted to
POST /iss/specific/ssl_digitalcert.html is extracted by Http
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0019
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the VGM command interpreter of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .vgm or .vgz file to r
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0018
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the GYM playback path of game-music-emu (libgme),
the open-source video game music emulation library, allows an attacker who
supplies a crafted .gym file to read heap memor
[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0017
----------------------------------------------------------------------------
[-] Summary:
A NULL pointer dereference in the AY file loader of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .ay file to terminate any
[NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0016
----------------------------------------------------------------------------
[-] Summary:
An out-of-bounds read in the VGM command interpreter of game-music-emu
(libgme), the open-source video game music emulation library, allows an
attacker who supplies a crafted .vgm or .vgz file to c
Teams meeting audio and roster data remain accessible via ACS Call Automation connectCall after a participant is removed from the meeting
Hi Full Disclosure team,
I'm not a traditional security researcher by background - I found this
while working with the ACS and Teams SDKs and followed it through to a full
writeup and PoC. I've done my best to be accurate and responsible
throughout (reporting to MSRC first, giving advance notice of this
disclosure date, and only testing against meetings/tenants I own), but if
anything here is imp
No cON Name 2026 - Palma, Mallorca - Balearic Islands
************************************
***** Call For Papers ******
************************************
https://www.noconname.org/call-for-papers/
Exact place not disclosed until a few weeks before due celebration.
* INTRODUCTIONfulldisclosure () seclists org
most respected hacker conferences in Palma and Spain, NcN (No cON
Na
checksec:
$ checksec --file Sofia
[*] '/redacted/Sofia'
Arch: arm-32-little
RELRO: No RELRO
Stack: Canary found
NX: NX unknown - GNU_STACK missing
PIE: No PIE (0x8000)
Stack: Executable
RWX: Has RWX segments
this ones interesting. sofia uses an internal flash fs called WFS. per
an online search:
WFS is a proprietary filesyst
# dive tar-slip in image file extraction
**Author:** Khashayar Fereidani
**Disclosure Date:** 2026-09-24
**Advisory:** https://fereidani.com/dive-tar-slip-in-image-file-extraction
**Contact:** https://fereidani.com/contact
## Description
dive is a terminal UI for exploring Docker image layers, and inspecting images
pulled from public registries is its main use case. The filetree view has an
ext
HP Advance / Output Central: unauthenticated SYSTEM RCE and two additional vulnerabilities (CVE-2026-89082/89083/89084)
HP Advance / HP Output Central
CVE-2026-89082, CVE-2026-89083, CVE-2026-89084
================================================================
SUMMARY
================================================================
Vendor: HP Inc.
Product family named by HP: HP Advance
Products in HP's update table: HP AC Print & Scan; HP Output Central
Components: Drivve SecureScan, MFPsecure
Severity: two Cr
CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)
Posting this as an update rather than a first disclosure. The advisory
went public on 2026-08-04 with no vendor fix. Penpot has shipped two
releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on
2026-08-27 -- and I re-checked the code this morning: the missing
permission check is still missing in both, and in every release before
them. It was fixed on develop the day after this advis
[0day-rubbish] TigerGraph Community Edition 4.2.4 Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
TigerGraph Community Edition 4.2.4.
Type: Default credentials plus GSQL TO_CSV arbitrary file write to SSH code execution (CWE-798)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: command execution as the tigergraph service user (uid 1001), which owns the engine, graph data, catalog and
configuration tree
Authentication
0day Rubbish Research Team is publicly disclosing a vulnerability in
Teltonika RutOS 00.07.06.21.
Type: Authenticated ipsec.lua logread command injection with reflected output (CWE-78)
CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact: root command execution on the router, with command output reflected into the JSON response
Authentication: authenticated administrator
Full technical analysi
[0day-rubbish] Opengear NGCS 25.11.8 Authenticated PDU name command injection to root via io.popen (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
Opengear NGCS 25.11.8.
Type: Authenticated PDU name command injection to root via io.popen (CWE-78)
CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact: root command execution on the out-of-band console manager
Authentication: authenticated administrator
Full technical analysis and a reproducible proof-of-concept:
https://
0day Rubbish Research Team is publicly disclosing a vulnerability in
LCDS Laquis SCADA.
Type: Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (CWE-434)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: arbitrary native code execution inside the SCADA web and HMI process, which also hosts the Modbus TCP listener
Authentication: unauthenticated (no password configur
[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
Ecava IntegraXor IGX 16.0.701.10.
Type: Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (CWE-306)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: arbitrary command execution as Administrator on a Web SCADA HMI host
Authentication: unauthenticated
Full technical analysis and a reproducible proof-o
[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)
0day Rubbish Research Team is publicly disclosing a vulnerability in
Devolutions Server (DVLS) 2026.2.14.0.
Type: PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (CWE-862)
CVSS: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Impact: arbitrary PowerShell execution as NT AUTHORITY\SYSTEM on the Devolutions Server host
Authentication: authenticated administrator (no PAM lice
[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
CaptureBites MetaServer.
Type: Anonymous WCF SOAP workflow leading to RunPrograms code execution (CWE-306)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: arbitrary command execution as NT AUTHORITY\SYSTEM on the MetaServer host
Authentication: unauthenticated
Full technical analysis and a reproducible proof-of-concept:
[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in
PrizmDoc for Java (VirtualViewer) 5.22.1.
Type: Unauthenticated uploadDocument write into the webapp root to JSP webshell (CWE-306)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: JSP webshell execution with the JVM privileges, uid 0 (root) in the verified deployment
Authentication: unauthenticated
Full technical analys
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1
macOS Sequoia 15.8.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149229.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
CoreGraphics
Availa
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-28-2026-2 macOS Tahoe 26.7.1
macOS Tahoe 26.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149228.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
CoreGraphics
Available
APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-28-2026-1 iOS 26.7.1 and iPadOS 26.7.1
iOS 26.7.1 and iPadOS 26.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149226.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Cor
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-10 Xcode 27
Xcode 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149040.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Xcode IDE
Available for: macOS Tahoe 26.6
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-9 Safari 27
Safari 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149039.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Safari
Available for: macOS Sequoia and m
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-8 visionOS 27
visionOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149038.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: A
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-7 watchOS 27
watchOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149037.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: App
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-6 tvOS 27
tvOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149036.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Available for: Apple TV
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-5 macOS Sequoia 15.8
macOS Sequoia 15.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149043.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Av
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-4 macOS Tahoe 26.7
macOS Tahoe 26.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149042.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framework
Availa
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-3 macOS Golden Gate 27
macOS Golden Gate 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149035.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framewor
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-2 iOS 26.7 and iPadOS 26.7
iOS 26.7 and iPadOS 26.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/149041.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accel
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-09-14-2026-1 iOS 27 and iPadOS 27
iOS 27 and iPadOS 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149034.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate Framewor