[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure
----------------------------------------------------------------------------
NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440
----------------------------------------------------------------------------
[-] Summary:
On 2026-01-19 the issue described below was published as NotCVE-2026-0001
after no CVE identifier was assigned for it. On 2026-07-01 — 163 days
later — Cloudflare assigne
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-11 visionOS 26.5
visionOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127120.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-10 watchOS 26.5
watchOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127119.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Ap
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-9 tvOS 26.5
tvOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127118.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available for: Apple TV
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-8 macOS Sonoma 14.8.7
macOS Sonoma 14.8.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127117.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
APFS
Available
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-7 macOS Sequoia 15.7.7
macOS Sequoia 15.7.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127116.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
APFS
Availabl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-6 macOS Tahoe 26.5
macOS Tahoe 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127115.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accelerate
Available
APPLE-SA-05-11-2026-5 iOS 15.8.8 and iPadOS 15.8.8
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-5 iOS 15.8.8 and iPadOS 15.8.8
iOS 15.8.8 and iPadOS 15.8.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127114.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories
APPLE-SA-05-11-2026-4 iOS 16.7.16 and iPadOS 16.7.16
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-4 iOS 16.7.16 and iPadOS 16.7.16
iOS 16.7.16 and iPadOS 16.7.16 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127113.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security adviso
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-3 iPadOS 17.7.11
iPadOS 17.7.11 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127112.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Notification Services
Ava
APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-2 iOS 18.7.9 and iPadOS 18.7.9
iOS 18.7.9 and iPadOS 18.7.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127111.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5
iOS 26.5 and iPadOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127110.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accel
this is my first time sending to a mailing list so ive chosen
something easy. here goes:
Summary: Horde Groupware’s IMP Webmail solution contains a path
traversal/local file inclusion vulnerability which could be exploited
to escalate privileges or bypass authentication (through CSRF if
unauthenticated).
the vulnerability is in here:
} elseif (strcasecmp($node->tagName, 'IMG') === 0) {
Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
General information
═══════════════════
Multiple vulnerabilities in Sparx Pro Cloud Server (PCS) versions <=
6.1 and Sparx Enterprise Architect versions <=17.1 allow a remote
unauthenticated att
# PHP 8.5.7 `mb_substr()` 'SJIS-mac' size_t underflow
**Author:** Khashayar Fereidani
**Disclosure Date:** 2026-06-18
**Advisory:** https://fereidani.com/php-857-mbsubstr-sjis-mac-sizet-underflow
**Contact:** https://fereidani.com/contact
## Description
The `mb_get_substr()` function in `ext/mbstring/mbstring.c`
deliberately skips an early empty return guard for the `SJIS-mac`
encoding when `fr
------------------------------------------------------------------------
------------------------------------------------------------------------
Affected: OpenBSD -current prior to 2026-06-18 (fixed in -current)
Vendor: OpenBSD
Severity: Medium
Reporter: Argus Systems
Date: 2026-06-12
CVE: CVE-2026-56099
1. SUMMARY
==========
The mpls_do_error() function in sys/netmpls/mpls_
This integer underflow vulnerability enables heap metadata corruption and
information disclosure through carefully crafted LMDB dump files.
*Impact:*
- *Denial of Service*: Immediate crash (confirmed)
- *Information Disclosure*: Heap metadata leak via OOB read
Root Cause:The readline() function fails to validate that the input line
length is non-zero before performing decrement operations
RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction
A stack-based buffer overflow vulnerability exists in the tapslip6 utility
distributed with RIOT OS (and derived from the legacy uIP/Contiki
networking tools). The vulnerability is caused by unsafe string
concatenation in the devopen() function, which constructs a device path
using unbounded user-controlled input.
Specifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed
prefix "/
RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser
A stack-based buffer overflow vulnerability exists in the RIOT OS ethos
utility due to missing bounds checking when processing incoming serial
frame data. The vulnerability occurs in the _handle_char() function, where
incoming frame bytes are appended to a fixed-size stack buffer
(serial->frame) without verifying that the current write index
(serial->framebytes) remains within bounds. An attacker
thttpd v2.26 Stack-Based Buffer Overflow in thttpd htpasswd Utility Allows Local Memory Corruption
*Description:*
A stack-based buffer overflow vulnerability exists in the htpasswd utility
bundled with thttpd. The vulnerability occurs due to unsafe copying of a
user-supplied command-line argument into a fixed-size stack buffer without
proper bounds checking.Specifically, the program copies the username
argument (argv[2]) into a local stack buffer using strcpy(). If an attacker
supplies an overl
CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability
Vulnerability Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS
1CMS v5.6. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field.
- Vulnerability Type: Cross Site Scripting (XSS)
- Vendor: ClassCMS
-
[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path
without credential override (7.2)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in
Royal Server 5.04.50529.0.
Type: Local privilege escalation to LocalSystem on the execution path
[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field
(8.8)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in
QuantaStor 6.8.3.018.
Type: Command injection in the alert-mail command via the smtpPassword field (CWE-78)
CVSS: 8.8 (AV:
[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded
credentials leading to OS command execution (9.8)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in
Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6).
Type: Unauthen
[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading
to JNDI remote class loading (9.8)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in
Accurate Online Private Cloud on-prem (current).
Type: Unauthenticated Hessian deserializ
[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in
DBxtra .NET 13.1.1.0.
Type: Unauthenticated SOAP API to xp_cmdshell code execution (CWE-306)
CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command
injection vulnerability (CWE-78) in the TR-069/CWMP client daemon
(netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into
sprintf, which constructs a shell command executed via system_by_root() as
root.
An attacker operating a rogue LTE base station using SDR hardware (~$300)
can impersonate the carrier's Aut
Hello Full Disclosure,
I'd like to share an independent lab Proof-of-Concept for CVE-2026-15013.
### CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated
Authentication Bypass
SAML Signature Algorithm Confusion vulnerability. An unauthenticated
attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification
against the IdP's public key, allowing full account takeover (includi
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Hello Full Disclosure list,
Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.
CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3
The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-18-2026-1 Safari 26.6.1
Safari 26.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/148286.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
WebKit
Available for: macOS Sonom
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9
macOS Sonoma 14.8.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/148172.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Screen Sharing
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9
macOS Sequoia 15.7.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/148171.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Screen Sharin
NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)
NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML
============================================================================
On a multi-user Linux GPU host where mutually untrusted users can open
the same /dev/nvidia* devices - the driver's default mode is 0666 - an
unprivileged user can enumerate another user's GPU processes and
per-process GPU telemetry through sta
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-8 Safari 26.6
Safari 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128073.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Safari
Available for: macOS Son
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-7 visionOS 26.6
visionOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128070.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Availabl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-6 watchOS 26.6
watchOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128068.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-5 tvOS 26.6
tvOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128069.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available for: A