[0day-rubbish] NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected) Pre-authentication RCE (missing auth + attacker assembly load) (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in NCache Enterprise 5.3.6 (other versions with the
same default-disabled security and handler logic are likely affected).
Type: Pre-authentication RCE (missing auth + attacker assembly load) (CWE-94)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Unauthenticated remote code execution on the cache server as the n
[0day-rubbish] myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected) Authenticated RCE (admin file editor + default credentials) (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in myDBR 7.5.4 (build 5454) (other versions with the
same file-editor are likely affected).
Type: Authenticated RCE (admin file editor + default credentials) (CWE-94)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Impact: Authenticated remote code execution on the reporting server as www-data, exposing business reports a
[0day-rubbish] Microsip 2026 (ASD data-service agent) 2026 Eval (other builds with the same backup-runner path handling are likely affected) Pre-authentication RCE (attacker-controlled binary path, LocalSystem) (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in Microsip 2026 (ASD data-service agent) 2026 Eval
(other builds with the same backup-runner path handling are likely affected).
Type: Pre-authentication RCE (attacker-controlled binary path, LocalSystem) (CWE-426)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Impact: Unauthenticated remote code execution as LocalSyste
[0day-rubbish] CFEngine Enterprise Nova Hub 3.27.1 (other versions with the same generateScriptFromTemplates quoting are likely affected) Authenticated RCE (command injection via VCS settings, root) (8.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in CFEngine Enterprise Nova Hub 3.27.1 (other
versions with the same generateScriptFromTemplates quoting are likely affected).
Type: Authenticated RCE (command injection via VCS settings, root) (CWE-78)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Authenticated admin-to-root full server takeover of the manageme
[0day-rubbish] Brekeke PBX 3.19.1.8 (other versions with the same Bean dispatch model are likely affected) Pre-authentication RCE (fail-open auth gate + reflection to exec) (9.8)
0day Rubbish Research Team is publicly disclosing a vulnerability in Brekeke PBX 3.19.1.8 (other versions with the same
Bean dispatch model are likely affected).
Type: Pre-authentication RCE (fail-open auth gate + reflection to exec) (CWE-917)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Unauthenticated remote code execution on the PBX host as the Tomcat user, compromising th
[NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0013
----------------------------------------------------------------------------
[-] Summary:
Eval injection in the Kenwood ITM file format driver of CHIRP, an
open-source application for programming amateur radios, allows an attacker
who can persuade a user to open a crafted radio file to
NVIDIA Linux GPU driver: unprivileged Xid 31 MMU fault via undocumented peer-teardown ordering, no CVE (vendor: intended)
NVIDIA Linux GPU driver - unprivileged Xid 31 copy-engine MMU fault
during an NVLink peer transfer
==================================================================================================
An unprivileged local user with no GPU group, no admin group and no
capabilities, using only the driver's default 0666 /dev/nvidia*
permissions and public CUDA Runtime APIs, deterministically causes a
NVIDIA Linux GPU driver: cross-UID GPU process telemetry via NVML, no CVE (vendor: expected behavior)
NVIDIA Linux GPU driver - cross-UID GPU process telemetry disclosure via NVML
============================================================================
On a multi-user Linux GPU host where mutually untrusted users can open
the same /dev/nvidia* devices - the driver's default mode is 0666 - an
unprivileged user can enumerate another user's GPU processes and
per-process GPU telemetry through sta
Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure
An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.
An attacker capable of reaching the debugger int
Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path
An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.
By launching Escargot using a crafted executable
Escargot contains a remotely triggerable one-byte stack-based out-of-bounds
write in the WebSocket message handling logic used by the debugger.
When Escargot::DebuggerTcp::receive() receives a binary WebSocket payload
that completely fills the caller-provided stack buffer, the function
successfully copies the payload into the available buffer space but
subsequently appends an additional NUL byte
UltraJSON contains an out-of-bounds read in its native C JSON decoder when
processing certain incomplete JSON values supplied through an explicitly
length-bounded input buffer.
The affected native entry point, JSON_DecodeObject(), accepts both a buffer
pointer and an explicit buffer length:
JSON_DecodeObject(
JSONObjectDecoder *dec,
const char *buffer,
size_t cbBuffer
)
The decoder
The Realtek in-band ioctl bridge contains a heap-buffer overflow when
processing peer-supplied ioctl response data.
inband_ioctl() receives a response through the Realtek in-band transport
and extracts a 32-bit data_get_len value from that response. For several
wireless "get" operations, this peer-controlled value is subsequently used
directly as the length argument to memcpy().
For SIOCGIWSCAN,
WatsonWebserver contains an HTTP/1 request body size-limit bypass when
processing requests using Transfer-Encoding: chunked.
The framework's configured Settings.IO.MaxRequestBodySize limit is enforced
when a request declares its body size using Content-Length. However,
requests using chunked transfer encoding are processed through a separate
body-reading path that accumulates decoded chunks into
Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags
Chronicle Wire permits YAML type tags supplied within serialized input to
influence Java class selection and object instantiation during untyped
deserialization.
When applications deserialize attacker-controlled or otherwise untrusted
YAML through APIs such as readObject() or object(Object.class), an
externally controlled YAML type tag can identify a Java class that
Chronicle Wire resolves throug
Chronicle Wire's MethodReader implements message dispatch by dynamically
mapping serialized wire events to Java handler methods. During
initialization, the framework discovers public methods exposed by the
registered handler interfaces and registers those methods as callable wire
events.
When a message is processed, the event name supplied within the wire data
determines which registered handler
Chronicle Wire's FileMarshallableOut follows symbolic links when writing
files in append mode. When ?append=true is enabled, the implementation
opens the supplied output path directly using FileOutputStream(path, true)
without preventing symbolic-link resolution.
If an attacker can create or replace the expected output file with a
symbolic link before the append operation occurs, the operating sy
[0day-rubbish] Call Center Suite 10.10.1 Pre-authentication RCE (auth bypass + webroot write) (9.8)
TO: fulldisclosure () seclists org
SUBJECT: [0day-rubbish] Call Center Suite 10.10.1 Pre-authentication RCE (auth bypass + webroot write) (9.8)
FROM: disclosure () 0day-rubbish com
----BODY----
0day Rubbish Research Team is publicly disclosing a vulnerability in Call Center Suite 10.10.1.
Type: Pre-authentication RCE (auth bypass + webroot write) (CWE-306)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/
SCHUTZWERK-SA-2025-001: Authentication Bypass for SafeLine SL6 and SL6+
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Authentication Bypass for SafeLine SL6 and SL6+
===============================================
gain unauthorized administrative access to the device configuration.
Metadata
========
* Affected product: SafeLine SL6/SL6+
* Affected version: Introduced in version 4.82, patched in version 4.97
* Vendor: SafeLine
* Problem type(s): CWE-305 Authenti
Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics
Technologies). The research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)
A framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header,
X-SM_SAVE_BODY_4DEBUGGING, as an a
0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The
research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
vMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The
HTTP API endpoint GET /api/?Function=ScriptStart
Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)
0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon
Industries). The research is published and a proof-of-concept is available.
Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
Vicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to
/NVR/api/v1 on ports 808
Security advisory: Pre-authentication RCE in Plastic SCM (Unity Version Control On-Prem) 11.0.16.10303 (Unity Technologies)
0day Rubbish Research Team is publicly disclosing a vulnerability in Plastic SCM (Unity Version Control On-Prem)
11.0.16.10303 (Unity Technologies). The research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
Plastic SCM ships a self-developed binary version-control protocol on port 8087, reachable by default on 0.0.0.0. Under
the defaul
Security advisory: Pre-authentication SYSTEM RCE in Stimulsoft Server 2026.3.1 (Stimulsoft)
0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The
research is published and a proof-of-concept is available.
Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
A default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by
default with email activation disabled, so an
Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0
(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)
The native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\SYSTEM.
The sha
Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)
0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The
research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)
A three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server
mint a ClientID using its
Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)
0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann
Visutec). The research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)
The main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP
backend that verifi
0day Rubbish Research Team is publicly disclosing a vulnerability in Apache Struts 2 2.6.11.0 (Apache Software
Foundation). The research is published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
Apache Struts 2.6.11.0 is vulnerable to unauthenticated remote code execution under a documented REST mapper
configuration combined with wildcard dynamic d
Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)
0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI Cyber Backup v2.3.0 (AOMEI). The research is
published and a proof-of-concept is available.
Pre-authentication RCE (CVSS 9.8, pre-authentication)
AOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four Thrift binary-protocol ports, but only
the 9072 Gateway enforces JWT authentication. The three in
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-06-29-2026-3 Safari 26.5.2
Safari 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127685.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Web Extensions
Available fo
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2
macOS Tahoe 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127595.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
IOGPUFamily
Avail
APPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2
iOS 26.5.2 and iPadOS 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127594.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories
Zig std.http chunked reader integer overflow -> unauthenticated remote DoS
Agent Spooky’s Fun Parade hereby reports, with the solemnity of a raccoon presenting a subpoena, an integer-overflow
panic in Zig’s std.http chunked request-body reader. In Zig 0.16.0 and master commit 8f7febfa6f59,
Reader.chunkedReadEndless and Reader.chunkedDiscardEndless compute cp.chunk_len + 2 - n after ChunkParser.feed has
accepted chunk lengths up to 0xffffffffffffffff. Unfortunately, th
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-8 Safari 26.6
Safari 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128073.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Safari
Available for: macOS Son
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-7 visionOS 26.6
visionOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128070.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Availabl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-6 watchOS 26.6
watchOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128068.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-5 tvOS 26.6
tvOS 26.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128069.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts Framework
Available for: A
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-4 macOS Sonoma 14.8.8
macOS Sonoma 14.8.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128072.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Availa
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-07-27-2026-3 macOS Sequoia 15.7.8
macOS Sequoia 15.7.8 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/128071.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accounts
Avai