0day Rubbish Research Team is publicly disclosing a vulnerability in Raritan EMX firmware emx_ecx_3.6.1_46982 (EMX/ECX
gateway).
Type: Authenticated config injection to root RCE (CWE-74)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Impact: Full root compromise of the PDU management gateway, placing power telemetry and rack power infrastructure under
attacker control.
Authentication:
[0day-rubbish] mySCADA PRO Runtime 9.4.0 (container deployment msxrun; earlier versions with the same upgrade branch are likely affected) Unauthenticated OS command injection to root RCE (9.4)
0day Rubbish Research Team is publicly disclosing a vulnerability in mySCADA PRO Runtime 9.4.0 (container deployment
msxrun; earlier versions with the same upgrade branch are likely affected).
Type: Unauthenticated OS command injection to root RCE (CWE-78)
CVSS: 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Impact: Unauthenticated root command execution on the SCADA runtime, enabling proces
0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Gallery v2.1.
Type: Authenticated unrestricted file upload to PHP RCE (CWE-434)
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Impact: Authenticated remote code execution as the web-server user, giving control of gallery files, server data, and
commonly the underlying host.
Authentication: authenticated (require
[0day-rubbish] Leostream Connection Broker 9.1.37.0 two vulnerabilities (SQLi to root RCE, unauth SSRF)
0day Rubbish Research Team is publicly disclosing two vulnerabilities in Leostream Connection Broker 9.1.37.0.
Vulnerability 1 — Authenticated SQL injection to webshell to root RCE (CVSS 9.1,
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-89)
call_back.pl?action=user concatenates the unsigned _where parameter into a PostgreSQL WHERE clause; the default
installation grants SUPERUSER, runs po
0day Rubbish Research Team is publicly disclosing a vulnerability in Delta DIAEnergie IEMS V1.11.
Type: Authenticated (conditional) SQL injection to VBScript RCE (CWE-89)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact: Remote code execution in the CEBC service context, giving control of energy-management data and PLC
connectivity in industrial facilities.
Authentication: authent
[0day-rubbish] CacheGuard OS UF-2.5.2 Authenticated RCE via config-import eval injection (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in CacheGuard OS UF-2.5.2.
Type: Authenticated RCE via config-import eval injection (CWE-94)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact: Authenticated escalation from the restricted admin shell to arbitrary command execution, placing gateway
configuration, WAF rules, and TLS keys under attacker control.
Authen
FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)
https://blog.evan.lat/posts/CVE-2026-65053/
the blog talks about two vulns that are chainable together. for the sake of
brevity ill write up on the stored xss one.
in lib/Mime/Status.php, we see a pretty viable xss sink:
$out .= '<tr><td>' . $val . '</td></tr>';
xrefing this we see that most impls are sanitized with the exception of
lib/Mime/Viewer/Appledouble.php:
$data_name = $this->getConf
A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits
I came across a project, "0day Rubbish", that states it will continuously
disclose 0-day vulnerabilities discovered by an AI-driven research process
(a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each
vulnerability the project publishes a full technical analysis together with
a working exploit script and step-by-step reproduction instructions. The
project's content is hosted at:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-18-2026-1 Safari 26.6.1
Safari 26.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/148286.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
WebKit
Available for: macOS Sonom
0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research
is published and a proof-of-concept is available.
Pre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication)
Telaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False,
which is the default. The SaveVerifyActiv
Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)
0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is
published and a proof-of-concept is available.
Authenticated RCE (SQL injection) (CVSS 8.8, authenticated)
Plixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping
in the adminEditLang handler. The default configuration
Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))
0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax
Software (Output Technology)). The research is published and a proof-of-concept is available.
Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)
Output Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credenti
0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is
published and a proof-of-concept is available.
Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)
MidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and
auth.servers commented out, making the JBoss
0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6)
(Lansweeper). The research is published and a proof-of-concept is available.
Authenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated)
Lansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name
containing a sin
0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI
Software). The research is published and a proof-of-concept is available.
Authenticated RCE (command injection) (CVSS 8.8, authenticated)
Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method
Server.startEncryption. The password
0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE
Vernova). The research is published and a proof-of-concept is available.
Pre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)
GE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage
t
0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy
GmbH). The research is published and a proof-of-concept is available.
Pre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication)
Cinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that
dese
Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))
0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)).
The research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
Wyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation
is skipped (parse-only ReadToken) with a
Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)
0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software).
The research is published and a proof-of-concept is available.
Pre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)
ObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability:
JDOQL query filter e
Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)
0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The
research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
nanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST
/formula evaluates user-supplied JavaScript in an embe
Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)
0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The
research is published and a proof-of-concept is available.
Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
MAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the
caller-supplied byte array before any authen
0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent,
Inc.). The research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
Confluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB
(HTTP 8089), the Kafka broker (909
Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)
0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The
research is published and a proof-of-concept is available.
Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
iMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with
no global [Authorize] filter. Three flaws
0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext /
Graphwise). The research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
Ontotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter
chain. As a result, /rest/repositor
Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)
0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax Enterprise (DSE) 6.8.49 (DataStax). The
research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
DataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The default configuration has the
gremlin_server authentication section commented out, whic
Hi Community,
I am glad to present a new release of this tool:
- https://ufonet.03c8.net
---------
"UFONet is a free software, P2P and cryptographic -disruptive toolkit-
that allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP)
through the exploitation of Open Redirect vectors on third-party
websites to act as a botnet and on the Layer3 (Network) abusing the
protocol."
"It also
Hi FD,
I am glad to present a new release of this tool:
- https://xsser.03c8.net
---------
"Cross Site "Scripter" (aka XSSer) is an automatic -framework- to
detect, exploit and report XSS vulnerabilities in web-based
applications. It provides several options to try to bypass certain
filters and various special techniques for code injection."
---------
XSSer has pre-installed [ > 1500 XSS ]
CyberDanube Security Research 20260611-0 | Multiple Denial of Service Vulnerabilities in Dahua IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC Camera Series
CyberDanube Security Research 20260611-0
-------------------------------------------------------------------------------
title| Multiple Denial of Service
product| Dahua DH-IPC-HFW Series
vulnerable version| <=V3.142.0000000.8.R.250826
fixed version| Versions build including and after 2026-03-26.
CVE number| CVE-2026-29115, CVE-2026-29116
impact| High
homepage| https://www.dahuasecurity.com/
found
The Asterisk Development Team would like to announce security release
Asterisk 23.4.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/23.4.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 23.4.1
## Change Log for Release asterisk-23.4.1
### Links:
- [Full Cha
The Asterisk Development Team would like to announce security release
Asterisk 22.10.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.10.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 22.10.1
## Change Log for Release asterisk-22.10.1
### Links:
- [Full
The Asterisk Development Team would like to announce security release
Asterisk 21.12.3.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.12.3
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 21.12.3
## Change Log for Release asterisk-21.12.3
### Links:
- [Full
The Asterisk Development Team would like to announce security release
Asterisk 20.20.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.20.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tag: 20.20.1
## Change Log for Release asterisk-20.20.1
### Links:
- [Full
The Asterisk Development Team would like to announce security release
Certified Asterisk 22.8-cert3.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-22.8-cert3
## Change Log f
The Asterisk Development Team would like to announce security release
Certified Asterisk 20.7-cert11.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-20.7-cert11
## Change Lo
NotCVE registry index — public records of vulnerabilities that shipped without a CVE
----------------------------------------------------------------------------
NotCVE Registry Index — 2026-07-16
----------------------------------------------------------------------------
[-] About the NotCVE registry:
NotCVE (https://notcve.org) assigns public identifiers to real, verifiable
vulnerabilities that did not receive a CVE — typically because the affected
vendor did not acknowledge
ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping in ASUS Business/Software Manager kernel driver
Hi all,
I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys /
AsusBSItf.sys kernel driver, shipped with ASUS Business Manager and
Software Manager. ASUS has assigned the CVE and published a vendor advisory
with countermeasures.
Summary: The driver exposes a device (\\.\bsitf, admin-required to open)
with an IOCTL that allocates a caller-specified amount of physically
contiguous
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-06-2026-3 macOS Sonoma 14.8.9
macOS Sonoma 14.8.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/148172.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Screen Sharing
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9
macOS Sequoia 15.7.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/148171.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Screen Sharin
OpenBlow Multiple Deanonymization Vulnerabilities
Summary
A production deployment was observed (HTTP archive of a full, real whistleblower
submission) to route its anonymous reporting flow through Google. The intake
CAPTCHA is Google reCAPTCHA, enforced as a mandatory, server-validated gate
on report submission, and the UI additionally pulls a web font from
fonts.gstatic.com. As a result, every
OpenZFS Linux open zpool manipulation and escapes via unprivileged userns
I am hopeful that upstream patches and remediation guidance will be
available soon. I have been sitting on these for a bit, and have run this
through AI services hosted in Singapore and the United States, and had
notified CERT on 8/12/2026. In order to minimize the risk of asymmetric
knowledge of these threats being used against defenders, I am opting for
full-disclosure.
Cheers from HOPE
--Bird
Skillable's SCORM lab launch endpoint validates a launch token but
enforces per-user allocation limits using a browser-supplied userId
that is not bound to the validated token. An authenticated learner
can modify this identifier to bypass configured limits, launch
concurrent lab instances, and consume another learner's allocation.
Skillable states that no fix is planned for the legacy SCORM launch
JSON Deserialiser Unconstrained Resource Consumption Proof of Concept
On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March
2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of
concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other
JSON parsers. We are publishing, in part, be
[0day-rubbish] SpiraTeam 9.3.0.0 (other versions with the same RetrieveByIndentLevel implementation are likely affected) Authenticated SQL injection to RCE (sysadmin + xp_cmdshell) (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in SpiraTeam 9.3.0.0 (other versions with the same
RetrieveByIndentLevel implementation are likely affected).
Type: Authenticated SQL injection to RCE (sysadmin + xp_cmdshell) (CWE-89)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Authenticated SQL injection to OS command execution on the SQL Server host, compro
[0day-rubbish] webMethods Microservices Runtime (MSR) 10.x (other versions with the same XSLT module are likely affected) Pre-authentication RCE (default factory credentials + XSLT extension functions) (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in webMethods Microservices Runtime (MSR) 10.x (other
versions with the same XSLT module are likely affected).
Type: Pre-authentication RCE (default factory credentials + XSLT extension functions) (CWE-94)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Remote code execution on the integration server as the integr
[0day-rubbish] Scan2x ScanWebClient 2.3.3.0 (other versions with the same handler are likely affected) Pre-authentication RCE (unrestricted upload to executable webroot) (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in Scan2x ScanWebClient 2.3.3.0 (other versions with
the same handler are likely affected).
Type: Pre-authentication RCE (unrestricted upload to executable webroot) (CWE-434)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Unauthenticated remote code execution on the scanning server as the IIS app-pool identity, e
[0day-rubbish] VLink Virtual Matrix 6.60 (other versions with the same unquoted openssl command construction are likely affected) Authenticated RCE (OpenSSL argument injection to SYSTEM) (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in VLink Virtual Matrix 6.60 (other versions with the
same unquoted openssl command construction are likely affected).
Type: Authenticated RCE (OpenSSL argument injection to SYSTEM) (CWE-78)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Authenticated admin-to-SYSTEM remote code execution on the intercom server,