-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-2 macOS Tahoe 26.6 macOS Tahoe 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128067. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accounts Available fo
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6 iOS 26.6 and iPadOS 26.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/en-us/128066. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Acces
----------------------------------------------------------------- vBulletin <= 6.2.1 (runMaths) Remote Code Execution Vulnerability ----------------------------------------------------------------- [-] Software Link: https://www.vbulletin.com [-] Affected Versions: Version 5.7.5 and prior 5.x versions. Version 6.2.1 and prior 6.x versions. [-] Vulnerability Description: The vulnerable cod
Full-Disclosure List, An unauthenticated remote code execution vulnerability chain in SonicWall SMA 1000 series appliances is being disclosed here. The chain yields code execution as the `mgmt-server` user (uid=1011) on the management plane, with no credentials and no prior knowledge of the appliance beyond a reachable address. A full technical writeup with a reproducible proof-of-concept is p
Two stored XSS vulnerabilities have been disclosed in the NethServer WebTop module, affecting versions 1.5.6 and earlier. CVE-2026-78331 (CVSS 4.0: 8.7) affects the calendar component, while CVE-2026-78332 (CVSS 4.0: 8.2) affects the contacts component. Both vulnerabilities allow malicious content to be stored and JavaScript code to be executed when the affected calendar event or contact is vi
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2 macOS Tahoe 26.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/148281. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Audio Available for: ma
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-2 iOS 18.7.10 and iPadOS 18.7.10 iOS 18.7.10 and iPadOS 18.7.10 addresses the following issues. Information about the security content is also available at https://support.apple.com/148287. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-17-2026-1 iOS 26.6.1 and iPadOS 26.6.1 iOS 26.6.1 and iPadOS 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148282. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Aud
Reference: https://seclists.org/fulldisclosure/2026/Aug/5 I tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two findings. --- Vulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE The ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied: WebMI login(
Subject: The DCHECK Illusion: Chrome's "Trusted Path" Policy Creates Vulnerabilities Full article: https://potatobullet.com/chrome-dcheck-illusion-trusted-path-vulnerabilities/ Summary: An analysis of Chrome Mojo IPC finding 296 DCHECK instances across mojo/core/ and mojo/public/cpp/bindings/lib/, at least 15 guarding security-relevant conditions (bounds checks, offset validation, handle state)
---------------------------------------------------------------------------- NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440 ---------------------------------------------------------------------------- [-] Summary: On 2026-01-19 the issue described below was published as NotCVE-2026-0001 after no CVE identifier was assigned for it. On 2026-07-01 — 163 days later — Cloudflare assigne
SUMMARY: an authenticated heap buffer overflow in cisco catalyst c8000v sd-wan allows an attacker with low privileges to corrupt process memory and achieve remote code execution by sending a crafted message of type 0x0d (13) with device mode 5. this was tested on 17.06.03 as it is the only image i had access to. https://bst.cisco.com/quickview/bug/CSCwu48719 https://sec.cloudapps.cisco.com/secur
Advisory ID: SYSS-2026-050 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date:
Advisory ID: SYSS-2026-049 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date:
Advisory ID: SYSS-2026-048 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date:
Advisory ID: SYSS-2026-047 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Path traversal (CWE-22) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07
Advisory ID: SYSS-2026-046 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date:
SUMMARY: a stored XPATH injection allows any user with just ca manager/certificate manager perms to leak any secret key/any value in config.xml, thus achieving privilege escalation and potentially remote code execution. this can also likely be chained via csrf and some clever hiding. see https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r == VULN == the primary vulnerable si
this is my first time sending to a mailing list so ive chosen something easy. here goes: Summary: Horde Groupware’s IMP Webmail solution contains a path traversal/local file inclusion vulnerability which could be exploited to escalate privileges or bypass authentication (through CSRF if unauthenticated). the vulnerability is in here: } elseif (strcasecmp($node->tagName, 'IMG') === 0) {
Hi! We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. This advisory will also be published at https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html --- Classification: TLP:GREEN Internal reference: DOV-8476 Type: CWE-403 (Exposure of File Descriptor to Unintended C
# Summary The hostname resolved to an address within a dynamic cloud IP pool. The address had been released and was no longer controlled by the organisation operating the hostname. This condition is referred to as an "afterlife" issue. Unlike a conventional CNAME-based subdomain takeover, the DNS record pointed directly to a reusable cloud IP address. An attacker obtaining that address could re
# Summary I reported the issue to the Microsoft Security Response Center twice: * VULN-165381, MSRC case 102964 * VULN-165876, MSRC case 103259 In both cases, they do not appear to have even looked at the PoCs, and so have failed to adequately investigate before reaching a decision. # Vulnerability CWE-444: HTTP Request/Response Smuggling The observed behaviour was consistent with CL.0 HTTP
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0012 ---------------------------------------------------------------------------- [-] Summary: kamalpanse18 EmpManageX, a Flask-based employee management application, ships hard-coded administrative credentials in its authentication logic. The username admin and the plaintext password admin1
## Advisory Information - Advisory IDs: SKYLINE-2026-001, SKYLINE-2026-002, SKYLINE-2026-003 - Title: Pre-Authentication Remote Root via Tomcat Manager Header Injection + Hardcoded Credentials - CVSSv3.1: 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CWE: CWE-798, CWE-644, CWE-269 - Product: Cisco Unified Communications Manager 15.0.1.12900-234 - Vendor: Cisco Systems, Inc. - Public Dis
Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() functionality. Next.js attempts to prevent requests to private network resources by resolving the supplied hostname and checking the resulting addresses using isPrivateIp(): const records = await lookup(hostname, { family: 0, all: true, hints: ALL
Description Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery (SSRF) vulnerability in its shortcode-processing functionality. Attacker-controlled entry fields can be automatically processed by Flextype's shortcode parser. The built-in fetch shortcode accepts an attacker-controlled resource and passes the resulting value to the server-side fetch() helper without sufficient
Description Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled. The built-in filesystem shortcode accepts a file path and returns the contents of the specified file without restricting the path to
Description Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability caused by the interaction between globally processed entry expressions, the mutable registry object exposed to expressions, and the PHP entry directive. Attacker-controlled entry fields are automatically processed as expressions during entry retrieval. The expression environment exposes the application's mutab
Description Flextype CMS v1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare access_token as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied request data. Authentication verification is subsequently performed inside an isset($data ['acc
Description Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the Entries copy functionality. An authenticated remote attacker can supply directory traversal sequences within both the source id and destination new_id parameters submitted to /api/v1/entries/copy. Flextype constructs entry directory paths by directly concatenating the supplied entry identifier with the configu
Description Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF) vulnerability in the expression-processing functionality exposed through the /api/v1/query endpoint. An authenticated remote attacker can supply an arbitrary URL to the exposed fetch() function, causing the Flextype server to initiate an outbound HTTP request to an attacker-controlled destination. The applicati
Description Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field. When the affected field is subsequently retrieved or processed, Flextype passes the stored value to parsers(
*Description:* Payara Server contains a vulnerability in its Server-Side Includes (SSI) implementation that allows arbitrary operating system command execution via the #exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec() without validation, sanitization, or restriction. An attacker who can cause the server to process an SSI file (e.g., .sht
Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB business methods via reflection without sufficient authorization enforcement or input restriction. Both
*Description:* A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. The vulnerability occurs in the find_type_by_name() function, where the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). If a crafted or oversized attribute value is present, the unbounded read causes a write beyo
*Description:* A stack-based buffer overflow vulnerability exists in the redirect CGI program distributed with thttpd. The vulnerability is caused by unsafe string concatenation when constructing redirect URLs using attacker-controlled CGI environment variables. A remote, unauthenticated attacker can trigger the vulnerability via a crafted HTTP request, resulting in a crash of the CGI process and
Description O-CMS version 1.0.0 contains an authenticated OS command injection vulnerability in the AI CLI configuration functionality. An authenticated attacker with sufficient privileges can supply shell metacharacters and additional commands through the ai_cli_script parameter of /admin/settings/save. When the configured AI provider is subsequently tested through /admin/settings/test-ai, the
Description Flextype CMS contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes(). The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content containing PHP code to be written outside the intended entries directory. The /api/v1/query endpoint subsequ
Hello Full Disclosure list, Cipher Security Labs has published technical details for three High-severity vulnerabilities affecting HP Easy Start for macOS. The issues were coordinated with HP and are addressed in HP Easy Start 2.16.7.260722 and later under HPSBPI04124. Research title: Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries Affected product: HP Easy Start for macOS
A heap buffer underflow vulnerability exists in the readline() function of OpenLDAP's Lightning Memory-Mapped Database (LMDB) mdb_load utility. The vulnerability is triggered through malformed input data and results in an out-of-bounds read one byte before an allocated heap buffer. This can lead to information disclosure through heap memory leakage. *Root Cause:* The vulnerability occurs in the r
Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker can exploit this behavior by supplying a crafted or corrupted .bfmemo file—either fully attack
Bio-Formats contains an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component. The vulnerability is caused by the use of an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files (e.g., XLEF). When a crafted XML file is supplied, the parser allows external entity resolution and external DTD loading, enabling attackers to t
Hello Full Disclosure, I would like to disclose a security vulnerability identified in a smartphone application: *Koller Secret: Real Hidden App*. This report is shared in the interest of responsible disclosure and improving overall security awareness. --- *Summary* - Application: Koller Secret: Real Hidden App - Package / Bundle ID: com.koller.secret.hidemyphoto - Platform: Android - Affected
================================================================================ FULL DISCLOSURE: Linux Kernel Block Subsystem Vulnerabilities Date: 2025-12-29 Affected: Linux Kernel (all versions with affected code) ================================================================================ ================================================================================ [1/4] Integer Overfl