-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8 macOS Sonoma 14.8.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128072. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Availa
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8 macOS Sequoia 15.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128071. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Avai
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-2 macOS Tahoe 26.6 macOS Tahoe 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128067. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available fo
----------------------------------------------------------------- vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability ----------------------------------------------------------------- [-] Software Link: https://www.vbulletin.com [-] Affected Versions: Version 5.7.5 and prior 5.x versions. Version 6.2.1 and prior 6.x versions. [-] Vulnerability Description: The vulnerable cod
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2 macOS Tahoe 26.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/148281. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: ma
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1 iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Aud
Hello, I am submitting the following security disclosure for publication on the Full Disclosure mailing list. Title: Pairing Without Consent: CVE-2025-20701 Behavior on Skullcandy Dime 3 Affected product: Skullcandy Dime 3 wireless earbuds Vulnerability: Unauthorized Bluetooth Classic pairing and persistent bond creation Description: Testing demonstrated that a previously unknown Linux compu
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6 iOS 26.6 and iPadOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128066. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Acces
SUMMARY: an authenticated heap buffer overflow in cisco catalyst c8000v sd-wan allows an attacker with low privileges to corrupt process memory and achieve remote code execution by sending a crafted message of type 0x0d (13) with device mode 5. this was tested on 17.06.03 as it is the only image i had access to. https://bst.cisco.com/quickview/bug/CSCwu48719 https://sec.cloudapps.cisco.com/secur
OpenClaw MEDIA: Protocol Prompt Injection - File Disclosure Bypassing Tool Permissions ====================================================================================== OVERVIEW -------- A file disclosure vulnerability in OpenClaw (AI personal assistant platform) allows any group chat member (Discord/Telegram/WhatsApp) to exfiltrate local files - including LLM provider API keys, conver
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-04-22-2026-2 iOS 18.7.8 and iPadOS 18.7.8 iOS 18.7.8 and iPadOS 18.7.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127003. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-04-22-2026-1 iOS 26.4.2 and iPadOS 26.4.2 iOS 26.4.2 and iPadOS 26.4.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/127002. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories
SEC Consult Vulnerability Lab Security Advisory < 20260318-0 > ======================================================================= title: Multiple Privilege Escalation Vulnerabilities product: Arturia Software Center MacOS vulnerable version: 2.12.0.3157 fixed version: - CVE number: CVE-2026-24062, CVE-2026-24063 impact: high ho
SEC Consult Vulnerability Lab Security Advisory < 20260415-0 > ======================================================================= title: Exposed Private Key of X.509 Certificate product: SAP HANA Cockpit & SAP HANA Database Explorer vulnerable version: HANA Cockpit <2.18.2 (HRTT <2.16.254002) fixed version: HANA Cockpit 2.18.2 (HRTT 2.16.254002) CVE n
--------------------------------------------------------------------------- MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability --------------------------------------------------------------------------- [-] Software Link: https://www.metinfo.cn [-] Affected Versions: Versions 7.9, 8.0, and 8.1. [-] Vulnerability Description: The vulnerable code is located into the
SEC Consult Vulnerability Lab Security Advisory < 20260401-0 > ======================================================================= title: Broken Access Control product: Open WebUI vulnerable version: <v0.8.11 fixed version: v0.8.11 CVE number: CVE-2026-34222 impact: high homepage:https://openwebui.com found: 2026-0
# Security Advisory: ESP-RFID-Tool v2 PRO **Product:** ESP-RFID-Tool v2 PRO **Vendor:** Raik Schneider (Einstein2150), foto-video-it.de **Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2 **Affected Version:** v2.2.1 (latest as of 2026-04-28) **Severity:** CRITICAL **Disclosure Type:** Full Public Disclosure **Disclosure Date:** 2026-04-28 **Researcher:** Milan 't4c' Berger --- ##
*Update 2026-04-28:* The vendor contacted us and now provides a patched version v1.3.674 which can be obtained at the following URL: https://desktime.com/download On 4/27/26 12:53, SEC Consult Vulnerability Lab wrote: SEC Consult Vulnerability Lab Security Advisory < 20260427-0 > ======================================================================= title: Missing TLS Certifi
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-10 Xcode 26.4 Xcode 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126801. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. otool Available for: macOS Tahoe 26.2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-9 Safari 26.4 Safari 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126800. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma an
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-8 visionOS 26.4 visionOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126799. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: Apple Visio
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-7 watchOS 26.4 watchOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126798. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: Apple Watch S
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-6 tvOS 26.4 tvOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126797. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: Apple TV HD and App
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-5 macOS Sonoma 14.8.5 macOS Sonoma 14.8.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/126796. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-4 macOS Sequoia 15.7.5 macOS Sequoia 15.7.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/126795. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available fo
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-3 macOS Tahoe 26.4 macOS Tahoe 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126794. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Available for: macOS
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7 iOS 18.7.7 and iPadOS 18.7.7 addresses the following issues. Information about the security content is also available at https://support.apple.com/126793. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4 iOS 26.4 and iPadOS 26.4 addresses the following issues. Information about the security content is also available at https://support.apple.com/126792. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. 802.1X Avai
SEC Consult Vulnerability Lab Security Advisory < 20260421-0 > ======================================================================= title: Broken Access Control in Config Endpoint product: LiteLLM vulnerable version: <=v1.83.0 fixed version: v1.83.0-nightly CVE number: CVE-2026-35029 impact: high homepage:https://www.litellm.ai/
Qualys Security Advisory Good things come to those who wait: snap-confine + systemd-tmpfiles = root (CVE-2026-3888) ======================================================================== Contents ======================================================================== Summary Case study: Ubuntu Desktop 24.04 - Analysis - Exploitation Case study: Ubuntu Desktop 25.10 - Overview - Exploitation
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/126604. Apple maint
SEC Consult Vulnerability Lab Security Advisory < 20260317-0 > ======================================================================= title: Multiple vulnerabilities product: PEGA Infinity platform vulnerable version: CVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0 CVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2
CyberDanube Security Research 20260408-1 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| <=V25.30 fixed version| V26.10 CVE number| CVE-2026-27664 impact| High homepage| https
CyberDanube Security Research 20260408-0 ------------------------------------------------------------------------------- title| Remote Operation Denial of Service product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| <=V25.30 fixed version| V26.10 CVE number| CVE-2026-27663 impact| Medium hom
SEC Consult Vulnerability Lab Security Advisory < 20260414-0 > ======================================================================= title: Improper Enforcement of Locked Accounts in WebUI (SSO) product: Kiuwan SAST on-premise (KOP) & cloud/SaaS vulnerable version: <2.8.2509.4 fixed version: 2.8.2509.4 CVE number: CVE-2026-24069 impact: medi
Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory is also published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html --- Classification: TLP:GREEN Internal reference: DOV-8967 Type: CWE-235 (Improper Handling of Extra Parameters) Component
VULNERABILITY Non-sanitised submission of malicious SVG files on the Edupage portal in combination with CSRF vulnerability allows triggering various actions on behalf of other users, e.g. identity spoofing, sending fake messages, giving fake approvals, etc. Full disclosure report: https://jkosik.github.io/posts/edupage/ Reference: https://www.edupage.org/ VENDOR: Applied Software Consultants PR
VULNERABILITY Both authenticated and publicly accessible anonymous guest accounts on Edupage portal allow an attacker to capture the complete list of user IDs, names (students, parents, and teachers), and the associated banking details (IBAN codes) Full disclosure report: https://jkosik.github.io/posts/edupage/ Reference: https://www.edupage.org/ VENDOR: Applied Software Consultants PRODUCT: Ed
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Lobster_pro ============================================================================================ arbitrary services. Metadata ======== - - Affected product: Lobster_pro - - Affected version: versions prior to 4.12.6-GA - - Vendor: Lobster DATA GmbH - - CVE ID: CVE-2024-13971 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-13971
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 SOAP =============================================================================================== services. Metadata ======== - - Affected product: 4D Server - - Affected version: v20 R3 - - Vendor: 4D - - CVE ID: CVE-2024-39847 - - CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-39847 - - CVSS 4.0 score: 8.7 - - Advisory URL: https://ww
SEC Consult Vulnerability Lab Security Advisory < 20260326-0 > ======================================================================= title: Local Privilege Escalation product: Vienna Assistant (MacOS) - Vienna Symphonic Library vulnerable version: 1.2.542 fixed version: - CVE number: CVE-2026-24068 impact: high homepage:https://ww
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 # GoAnywhere MFT Email HTML Injection # Link: https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection ## Vulnerability Overview ## GoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability in its email templating functionality. If an attacker is able to influence the con
SEC Consult Vulnerability Lab Security Advisory < 20260423-0 > ======================================================================= title: DLL Hijacking product: EfficientLab Controlio (cloud-based employee monitoring service) vulnerable version: <1.3.95 fixed version: 1.3.95 CVE number: CVE-2025-10549 impact: High homepage:https://cont
----------------------------------------------------------------- SocialEngine <= 7.8.0 (get-memberall) SQL Injection Vulnerability ----------------------------------------------------------------- [-] Software Link: https://socialengine.com [-] Affected Versions: Versions 7.8.0, 7.7.0, and likely prior versions. [-] Vulnerability Description: User input passed through the "text" request
--------------------------------------------------------------------- SocialEngine <= 7.8.0 Blind Server-Side Request Forgery Vulnerability --------------------------------------------------------------------- [-] Software Link: https://socialengine.com [-] Affected Versions: Versions 7.8.0, 7.7.0, and likely prior versions. [-] Vulnerability Description: User input passed through the "ur
Subject: Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3) # Alipay DeepLink + JSBridge Attack Chain # Silent GPS Exfiltration via Crafted URL ## Overview Researcher: Jiqiang Feng / Innora AI Security Research Vendor: Ant Group (蚂蚁集团) / Alibaba Group Product: Alipay (支付宝) v10.x (Android & iOS) Users Affected: 1 billion+ CVEs: 6 submitted to MITRE CNA-LR
[This is an update to communications sent March 12-14 regarding Alipay security vulnerabilities.] --- On March 15, 2026, four WeChat articles documenting security vulnerabilities in Alipay were forcibly deleted from the public account AI-security-innora. The deletion was carried out by Tencent at the request of Beijing Geyun Law Firm, acting on behalf of Ant Group, citing China's Cybersecurity
Hi, I'm disclosing five vulnerabilities discovered during an authorised security assessment of the Cohesity TranZman Migration Appliance (formerly Stone Ram TranZman), Release 4.0 Build 14614. CVE-2025-67840 - Web API Command Injection (CVSS 7.2 High) The /api/v1/scheduler/run and /api/v1/actions/run endpoints allow authenticated administrators to execute arbitrary commands as root by inject