SEC Consult Vulnerability Lab Security Advisory < 20260126-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: dormakaba Kaba exos 9300 vulnerable version: < 4.4.1 fixed version: 4.4.1 CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092 CVE-2025-59093, CVE
SEC Consult Vulnerability Lab Security Advisory < 20260202-0 > ======================================================================= title: Multiple vulnerabilities product: Native Instruments - Native Access (MacOS) vulnerable version: verified up to 3.22.0 fixed version: n/a CVE number: CVE-2026-24070, CVE-2026-24071 impact: high
---------------------------------------------------------------------------- SmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability ---------------------------------------------------------------------------- [-] Software Link: https://www.smartertools.com/smartermail/business-email-server [-] Affected Versions: Build 9518 and prior builds. [-] Vulnerability Descripti
Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691 Researcher: Nelson Adhepeau (privexploits () protonmail com) Date: February 2026 == RESPONSIBLE DISCLOSURE NOTICE == This advisory is published in accordance with responsible disclosure practices. The vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would
During tests of electronic invoicing tools, I discovered multiple XXE and Blind XXE vulnerabilities in online tools parsing electronic invoices in XML formats. While most of the affected tools have fixed these vulnerabilities, two online tools remain vulnerable to Blind XXE attacks, allowing exfiltration of files. Disclosure to the affected operators happened more than 90 days ago. Vulnerable to
Hello everyone, Kindly let me introduce myself. This is the first – and potentially, last – message on this mailing list. I am Marco, the CISO of EQS Group. Kindly allow me to address some of the statements expressed publicly here. About the Convercent application Convercent was acquired by OneTrust in 2021, and in turn, EQS has acquired it from OneTrust at the end of 2024. Before being
Hello Full Disclosure list, Cipher Security Labs has published technical details for three High-severity vulnerabilities affecting HP Easy Start for macOS. The issues were coordinated with HP and are addressed in HP Easy Start 2.16.7.260722 and later under HPSBPI04124. Research title: Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries Affected product: HP Easy Start for macOS
Description Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled. The built-in filesystem shortcode accepts a file path and returns the contents of the specified file without restricting the path to
Description Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability caused by the interaction between globally processed entry expressions, the mutable registry object exposed to expressions, and the PHP entry directive. Attacker-controlled entry fields are automatically processed as expressions during entry retrieval. The expression environment exposes the application's mutab
Description Flextype CMS v1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare access_token as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied request data. Authentication verification is subsequently performed inside an isset($data ['acc
Description Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination new_id parameters submitted to /api/v1/entries/copy. Flextype constructs entry directory paths by directly concatenating the supplied entry identifier with the configu
Description Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF) vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch() function, causing the Flextype server to initiate an outbound HTTP request to an attacker-controlled destination. The applicati
Description Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field. When the affected field is subsequently retrieved or processed, Flextype passes the stored value to parsers(
*Description:* A signedness vulnerability exists in the li_chunkqueue_append_mem() function in lighttpd2, where a signed length parameter (gssize len) is not properly validated before being used in memory operations that expect an unsigned size. When a negative length value is supplied, it is implicitly converted to a large unsigned value, resulting in an out-of-bounds memory read and a stack buff
*Description:* Eclipse Paho MQTT C Client contains a heap use-after-free vulnerability in the synchronous MQTT client (libpaho-mqtt3c) when handling incoming PUBLISH messages with retry semantics. When a user-supplied messageArrived() callback frees the received message and returns 0 (indicating processing failure and requesting retry), the library retains internal references to the freed message
*Description:* Arbitrary code execution is possible in the MQTTVersion utility due to unsafe loading and execution of untrusted shared libraries. When a user supplies a shared library path as a command-line argument, the application loads the library using dlopen() and resolves an exported symbol using dlsym(). The resolved function pointer is invoked directly without validating the origin or trus
*Description:* Arbitrary code execution is possible in the MQTTVersion utility due to uncontrolled loading of shared libraries using non-absolute paths. The application invokes dlopen() with relative library names and relies on the dynamic loader’s search path to resolve the target library. Because the library origin is not restricted to trusted directories and no integrity or authenticity checks
0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Enterprise 2025.10.0. Type: Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Root command execution on the PE master, the control plane of the managed fleet: catalogs, certificates, secrets, and orchestration unde
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958) - Software Link: https://www.acunetix.com - Affected Versions: Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well. - Vulnerability Description: A local privilege escalation vulnerability has been identified in Acunetix (Web Vuln
Description Flextype CMS contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content containing PHP code to be written outside the intended entries directory. The /api/v1/query endpoint subsequ
Subject: The DCHECK Illusion: Chrome's "Trusted Path" Policy Creates Vulnerabilities Full article: https://potatobullet.com/chrome-dcheck-illusion-trusted-path-vulnerabilities/ Summary: An analysis of Chrome Mojo IPC finding 296 DCHECK instances across mojo/core/ and mojo/public/cpp/bindings/lib/, at least 15 guarding security-relevant conditions (bounds checks, offset validation, handle state)
0day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets DataCollector 6.4.1 (official Docker image). Type: Default credentials plus unsandboxed Shell Executor to root RCE (CWE-798) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Remote code execution as root on the DataCollector host or container, exposing pipeline data, credentials, and connected system
0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Enterprise 2025.10.0. Type: Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Root command execution on the PE master, the control plane of the managed fleet: catalogs, certificates, secrets, and orchestration unde
0day Rubbish Research Team is publicly disclosing two vulnerabilities in NoMachine Terminal Server 10.0.57. Vulnerability 1 — Pre-authentication heap memory corruption (out-of-bounds write to double-free) (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-787) NoMachine Terminal Server is a closed-source remote-desktop gateway used by enterprises to deliver virtual desktops and remot
0day Rubbish Research Team is publicly disclosing a vulnerability in Minuteman UPS Network Management Card 1.60.3. Type: Unauthenticated OS command injection to root RCE (CWE-78) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Root command execution on the UPS/PDU power-management card: power telemetry, configuration, credentials, and power-infrastructure settings under attacker
0day Rubbish Research Team is publicly disclosing two vulnerabilities in Lantronix EDS3000PR 3.2.0.0R2. Vulnerability 1 — Authenticated command injection to root RCE in FsUnmount (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-78) Lantronix EDS3000PR is an industrial serial device server (CII/OT). Its FsUnmount page handler validates a user-supplied path against a character bitmas
0day Rubbish Research Team is publicly disclosing a vulnerability in GeoVision GV-TBL4700 V1.06. Type: Authenticated command injection to root RCE via SNMPv3 user configuration (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Impact: Root command execution on the IP camera / access-control device: video, credentials, configuration, and device state under attacker control; a foot
0day Rubbish Research Team is publicly disclosing a vulnerability in DrayTek Vigor 2960 v1.5.1.6. Type: Authenticated command injection to root RCE in uploadlangs (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Impact: Root command execution on the SMB edge gateway: VPN keys, firewall rules, routing state, VoIP services, and proxied traffic under attacker control. Authenticatio
0day Rubbish Research Team is publicly disclosing a vulnerability in Codoforum 5.4.1. Type: Authenticated arbitrary file upload to PHP RCE (CWE-434) CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Impact: Arbitrary PHP code execution as www-data: the forum database, user data, and application files under attacker control, commonly escalating to the underlying host. Authentication: authe
0day Rubbish Research Team is publicly disclosing a vulnerability in Akana API Platform 8.4.29. Type: Unauthenticated RCE via path-normalization filter/dispatcher discrepancy (CWE-863) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated code execution inside the API platform container: gateway policies, credentials, proxied traffic, and the management plane become ac
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958) - Software Link: https://www.acunetix.com - Affected Versions: Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC) Other versions may be affected as well. - Vulnerability Description: A local privilege escalation vulnerability has been identified in Acunetix (Web Vuln
TO: fulldisclosure () seclists org FROM: disclosure () 0day-rubbish com SUBJECT: [FD] batch-2: 15 vulnerabilities incl. multiple pre-auth RCE across 10 enterprise/SCADA products - full analyses + reproducible exploits ----BODY---- 0day Rubbish Research Team is publishing its second batch of AI-assisted vulnerability research: 15 vulnerabilities across 10 enterprise, SCADA, and industrial software
Hello Full Disclosure, I'd like to share an independent lab Proof-of-Concept for CVE-2026-15013. ### CVE-2026-15013 – miniOrange SAML SSO <= 5.4.3 Unauthenticated Authentication Bypass SAML Signature Algorithm Confusion vulnerability. An unauthenticated attacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification against the IdP's public key, allowing full account takeover (includi
# Synology stale DNS allows practical interception of traffic from vulnerable DSM clients Vendor case: 904909 Suggested severity: High ## Customer advisory Synology customers using the affected DSM and Relayd versions listed below should upgrade immediately. The relevant man-in-the-middle vulnerabilities were fixed in DSM 6.2.3-25426 Update 3. Customers should install the latest DSM version av
Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24. CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3 The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0011 ---------------------------------------------------------------------------- [-] Summary: Nmap 7.99 and earlier contain a loop with an unreachable exit condition in the Packet:parse_options() method of nselib/packet.lua. A remote host that is the target of a scan can exhaust the memory
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0010 ---------------------------------------------------------------------------- [-] Summary: Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability in the IPC command interface exposed by the barrierd.exe service on 127.0.0.1:24801. The IPC server accepts local TCP c
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0009 ---------------------------------------------------------------------------- [-] Summary: NitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN file transfer receive path. The transfer service is reachable from the local network on TCP port 40818 and processes inco
0day Rubbish Research Team is publicly disclosing a vulnerability in VMS 6.48.809. Type: Authenticated command injection to root RCE (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Authenticated attacker executes arbitrary commands as root via unsanitized command injection Authentication: authenticated Full technical analysis and a reproducible proof-of-concept: https
0day Rubbish Research Team is publicly disclosing a vulnerability in ONE Reporter 13.1. Type: Authenticated RCE / privilege escalation via CommandExecutor (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Low-privilege user executes arbitrary commands as local-admin service account Authentication: authenticated Full technical analysis and a reproducible proof-of-concept:
0day Rubbish Research Team is publicly disclosing a vulnerability in Gemini 7.3.0. Type: Authenticated SQL injection to xp_cmdshell RCE (CWE-89) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Authenticated user executes OS commands via stacked SQL and xp_cmdshell as sa/sysadmin Authentication: authenticated Full technical analysis and a reproducible proof-of-concept: https://
0day Rubbish Research Team is publicly disclosing a vulnerability in RoboTask 11.0.5.1229. Type: Unauthenticated REST API remote task execution (CWE-306) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated attacker enumerates and triggers pre-existing tasks with Administrator privileges Authentication: unauthenticated / pre-auth Full technical analysis and a reproduc
0day Rubbish Research Team is publicly disclosing a vulnerability in ActiveFax Server 10.70. Type: Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (CWE-78) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated attacker executes arbitrary commands as SYSTEM via an LPD print job Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof
0day Rubbish Research Team is publicly disclosing a vulnerability in Tornado 2.11.3. Type: Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (CWE-22) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Impact: Unauthenticated attacker writes arbitrary files and achieves root command execution via cron Authentication: unauthenticated / pre-auth Full technical analysis
0day Rubbish Research Team is publicly disclosing a vulnerability in Datalore On-Premises 2026.2.3. Type: Unauthenticated RCE via InteractiveReport access-mapping flaw (CWE-306) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Impact: Anonymous attacker executes arbitrary code in the notebook agent container Authentication: unauthenticated / pre-auth Full technical analysis and a reprodu
--------------------------------------------------------------------- Control Web Panel <= 0.9.8.1224 (userRes) SQL Injection Vulnerability --------------------------------------------------------------------- [-] Software Link: https://control-webpanel.com [-] Affected Versions: Version 0.9.8.1224 and prior versions. [-] Vulnerability Description: User input passed through the "userRes"
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-003 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-003 ------------------------------------------------------------------------ Date: 2026-06-25 Risk Level: Medium to High Appl
Hello, I am submitting the following security disclosure for publication on the Full Disclosure mailing list. Title: Pairing Without Consent: CVE-2025-20701 Behavior on Skullcandy Dime 3 Affected product: Skullcandy Dime 3 wireless earbuds Vulnerability: Unauthorized Bluetooth Classic pairing and persistent bond creation Description: Testing demonstrated that a previously unknown Linux compu
0day Rubbish Research Team is publicly disclosing a vulnerability in VitalPBX 4.5.2 (Asterisk 20.20.1). Type: Authenticated root RCE via asterisk_cli to dialplan System() (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Impact: Authenticated escalation from web administrator to root shell on the PBX host, exposing call recordings, SIP credentials, and CDRs. Authentication: authe
0day Rubbish Research Team is publicly disclosing a vulnerability in Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI). Type: Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (CWE-78) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Impact: Unauthenticated remote code execution on the analytics server, exposing proc