Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-010\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 OS Command Injection (CWE-78)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 High\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing neutralization of special elements, OS commands can\nbe injected via the handshake of a TLS-SRP connection, which are\nultimately run as the root user.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MR9600 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060 (all interfaces except WAN), which is\nused to integrate other mesh devices into the network. The service\naccepts TLS-SRP connections with a username and password.\n\nThe service uses a different script (smcdb_auth) to receive credential\ninformation using the given username. Since the service does not\nneutralize special elements and appends the username as a command\nline argument, arbitrary OS commands can be injected via the username\nof the TLS-SRP handshake. These commands are run as the root user\nwithout the need of a valid username or password.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will result\nin the LED indicator at the top turning yellow, indicating that the OS\ncommand was successfully executed. No valid username or password is\nneeded.\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2024-11-11: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-010\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-010.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:39Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/13"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-010.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-010] Linksys MX9600/MX4200 - OS Command Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0202",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/13",
            "automated": true,
            "contentSha256": "1b4117351f99057c5c80ebb7961a5d3a00ace528728a9ff653b946ad51f061f2",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:13:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:39Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0202"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-011\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 OS Command Injection (CWE-78)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 High\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to missing neutralization of special elements, OS commands can\nbe injected via the update functionality of a TLS-SRP connection,\nwhich is normally used for configuring devices inside the mesh\nnetwork.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060, which is used to integrate other mesh\ndevices into the network. The service accepts TLS-SRP connections with\na username and password.\n\nThe service supports an update request, which can be used to set\n\"syscfg\" variables on the device. The script\n\"/tmp/cron/cron.everyminute/offline-notifier.cron\" is executed every\nminute and sets \"syscfg\" variables containing \"node-off\" as environment\nvariables using the following lines:\n\n\u00a0 VARS=\"$(syscfg show |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 grep node-off |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 sed -r \"s/^[^:]+:://g\" |\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 while read i; do\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 echo \"$i;\"\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 done)\"\n\u00a0 eval $VARS\n\nUsually, the variable \"VARS\" is set to a value similar to the following:\n\n\u00a0 $ syscfg show | grep node-off\n\n\u00a0 node-off::min_offline_time=3\n\u00a0 node-off::enabled=1\n\u00a0 node-off::cache_dir=/tmp/msg\n\u00a0 node-off::enable_cloud=1\n\u00a0 node-off::debug=0\n\n\n\nBy using the service on port 6060, an update request can be sent to the\ndevice, which can be used to set an arbitrary \"syscfg\" entry. If this\nentry contains \";\", OS commands can be injected into the \"VARS\"\nvariable, which will be used by eval.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will result\nin the LED indicator at the top of the device turning yellow, indicating\nthat the OS command got successfully executed:\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 conn.handshakeClientSRP(srp_username, srp_pass)\n\nconn.sendall(bytes.fromhex(\"4f53435479e0b43120fcf435000000600000\"))\n\n\nThis code results in the following \"syscfg\" value to be set:\n\n\u00a0 $ syscfg show | grep SySS\n\u00a0 node-off::SySS=; combo_solid yellow on\n\nWhen parsed by the script \"offline-notifier.cron\", the following line\nwill be executed by eval, resulting in the indicator LED turning yellow\nafter a maximum of 60 seconds:\n\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-011\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:38Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/18"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-011] Linksys MX9600/MX4200 - OS Command Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0203",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/18",
            "automated": true,
            "contentSha256": "531f353f04bac3f2bbcd04494b568489988470502612900246967d7ef58ce0fb",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:13:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T10:09:38Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0203"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-014\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\nAffected Version(s):\u00a0 \u00a0 \u00a0 \u00a01.0.13.210200 (and potentially others)\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.13.210200 MX4200\n\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Critical\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Fixed\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a02025-06-24\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to an improperly configured firewall rule, the router will accept\nany connection on the WAN port with the source port 5222, exposing all\nservices which are normally only accessible through the local network.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and potentially other models) contains the following\niptables rules:\n\n\u00a0 -A INPUT -i eth0 -j wan2self\n\u00a0 -A wan2self -j wan2self_ports\n\u00a0 -A wan2self_ports -p tcp -m tcp --sport 5222 -j xlog_accept_wan2self\n\u00a0 -A xlog_accept_wan2self -j ACCEPT\n\nThis chain of rules allows any incoming packets on port eth0 (WAN port)\nwhich originate from port 5222. This leads to the exposure of any\nservices listening on 0.0.0.0 to be exposed to the internet if no\nadditional firewall is used. This is especially critical because of\n\nwhich can ultimately lead to unauthorized OS command injection over the\ninternet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following Python code will exploit SYSS-2025-010 over the internet:\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.bind((\u00270.0.0.0\u0027, 5222))\n\u00a0 sock.connect((\"203.0.113.100\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\n\nThe only change to SYSS-2025-010 is the fixed source port 5222 and the\nendpoint. This is no longer the local IP address, but the public IP\naddress that is accessible via the internet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2025-06-24: Fix published by manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SYSS-2025-009, SYSS-2025-010 and SYSS-2025-011\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-010.txt\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt\n[3] SySS Security Advisory SYSS-2025-014\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-014.txt\n[4] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:37Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/19"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-010.txt"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-011.txt"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-014.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-014] Linksys MX4200 - Improper Verification of Source of a Communication Channel",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0204",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/19",
            "automated": true,
            "contentSha256": "f3a48a24336995bc194ee9eb4691c8ad7fadc6c327b6ef9b6d70b2bf1bd34099",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:13:33Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-09T10:09:37Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0204"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-20079 - Cisco",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Banks Tools"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication\nBypass to Root RCE\n\nProduct:\nCisco Secure Firewall Management Center\n\nTested version:\n10.0.1-1\n\nCVE:\nCVE-2026-20079\n\nPoC author:\nArian Eidizadeh (CyberAuth)\n\nPublic PoC:\nhttps://github.com/CyberAuth/CVE-2026-20079\n\nTechnical write-up:\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n\nThe publicly documented authentication-bypass-to-root-RCE chain was\nindependently reproduced against Cisco Secure FMC 10.0.1-1 with confirmed\nuid=0(root) execution.\n\nThe published Python implementation provides separate fingerprint,\nauthentication-bypass check, bounded root-proof, exploit, verification, and\ncleanup functionality.\n\nThis work does not claim discovery of CVE-2026-20079 or independent\ndiscovery of the original exploit chain. The contribution is the\nindependent reproduction and public PoC implementation.\n\nReferences:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2\nhttps://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079\nhttps://github.com/CyberAuth/CVE-2026-20079\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/80"
        },
        {
          "url": "https://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc"
        },
        {
          "url": "https://github.com/CyberAuth/CVE-2026-20079"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/80"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-20079",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0302",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80",
            "automated": true,
            "contentSha256": "f1c16fd7453f7a8545272853cf3a9362e688760671daf88c47751d45bcef0303",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/80",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-20T18:53:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0302"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-09T10:09:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0302"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-20079 - Cisco",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Banks Tools"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication\nBypass to Root RCE\n\nProduct:\nCisco Secure Firewall Management Center\n\nTested version:\n10.0.1-1\n\nCVE:\nCVE-2026-20079\n\nPoC author:\nArian Eidizadeh (CyberAuth)\n\nPublic PoC:\nhttps://github.com/CyberAuth/CVE-2026-20079\n\nTechnical write-up:\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n\nThe publicly documented authentication-bypass-to-root-RCE chain was\nindependently reproduced against Cisco Secure FMC 10.0.1-1 with confirmed\nuid=0(root) execution.\n\nThe published Python implementation provides separate fingerprint,\nauthentication-bypass check, bounded root-proof, exploit, verification, and\ncleanup functionality.\n\nThis work does not claim discovery of CVE-2026-20079 or independent\ndiscovery of the original exploit chain. The contribution is the\nindependent reproduction and public PoC implementation.\n\nReferences:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2\nhttps://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079\nhttps://github.com/CyberAuth/CVE-2026-20079\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/80"
        },
        {
          "url": "https://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc"
        },
        {
          "url": "https://github.com/CyberAuth/CVE-2026-20079"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/80"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0105",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80",
            "automated": true,
            "contentSha256": "f1c16fd7453f7a8545272853cf3a9362e688760671daf88c47751d45bcef0303",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/80",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-20T18:53:01Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:09:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0105"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-0972 GoAnywhere MFT",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SBA Research Security Advisory via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n# GoAnywhere MFT Email HTML Injection #\n\nLink: https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection\n\n## Vulnerability Overview ##\n\nGoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability\nin its email templating functionality. If an attacker is able to influence\nthe content of a template variable, malicious HTML can be embedded into\noutgoing emails generated by the application. As these messages originate\nfrom a trusted system, the vulnerability may facilitate phishing and other\nsocial-engineering attacks. The issue arises from insufficient HTML encoding\nof untrusted input before inclusion in HTML email content.\n\n* **Identifier**            : SBA-ADV-20251120-01\n* **Type of Vulnerability** : HTML Injection\n* **Software/Product Name** : [GoAnywhere MFT](https://www.goanywhere.com/products/goanywhere-mft)\n* **Vendor**                : [Fortra](https://www.fortra.com/)\n* **Affected Versions**     : \u003c= 7.9.1\n* **Fixed in Version**      : 7.10.0\n* **CVE ID**                : CVE-2026-0972\n* **CVSS Vector**           : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n* **CVSS Base Score**       : 5.4 (Medium)\n\n## Vendor Description ##\n\nGoAnywhere Managed File Transfer is a comprehensive managed file transfer\nsolution that will manage your organization\u2019s file transfer software,\nfile sharing, secure FTP, and automation needs through a single interface.\n\n\nSource: \u003chttps://www.goanywhere.com/products/goanywhere-mft\u003e\n\n## Impact ##\n\nAttackers can abuse the email templating functionality by injecting\nmalicious content into template variables, resulting in HTML injection in\noutgoing emails.\n\n## Vulnerability Description ##\n\nIt is possible to manipulate HTML emails generated via the \"Send Email\"\nfunctionality if an attacker is able to control the content of a template\nvariable. User-supplied data inserted into the email body is not properly\nHTML-encoded, and there is no option to enforce encoding for variables\nduring email template configuration.\n\n![Send Email Configuration](images/send_email_configuration.png)\n\nAs a result, an attacker can inject arbitrary HTML content into outgoing\nemails. Since these emails are sent by the legitimate mail server and\ntherefore appear to originate from a trusted sender, recipients are more\nlikely to trust their contents. An attacker could, for example, insert links\nthat redirect users to a phishing website designed to capture credentials\nor other sensitive information, or to deliver further malicious content.\n\nThis vulnerability can therefore be used to conduct effective phishing or\nsocial engineering attacks leveraging the trust relationship between the\napplication and its users.\n\n## Proof of Concept ##\n\n1. Configure an \"Upload Successful\" trigger: Set up an automation rule or\nworkflow that is triggered whenever a user uploads a file in the application\n[1]. This trigger should fire on each successful upload and proceed to\nexecute the subsequent action.\n\n2. Attach the \"Send Email\" functionality to the trigger: Add a \"Send\nEmail\" action that is executed whenever the \"Upload Successful\" trigger\nfires. Configure this action to send an HTML email to an internal recipient\n(for example, a support or operations mailbox) to notify them that a new\nfile has been uploaded. [2]\n\n3. Include the uploaded filename as a variable in the email template:\nIn the HTML email template, insert the variable representing the uploaded\nfilename into the email body, for example: A new file has been uploaded:\n${VARIABLE_NAME}. The email will then be sent automatically to the internal\nrecipient whenever a file is uploaded.\n\n4. Upload a file with HTML special characters in the filename: Upload a file\nwhose filename contains HTML markup instead of a normal, benign filename. For\ninstance:\n`Please enter your password here: \u003ca href=\u0027evil.site\u0027\u003eevil.site\u003ca\u003e.jpg`.\nBecause the filename is treated as data but inserted directly into\nthe HTML email without encoding, the HTML tags are preserved as-is.\n\n5. Observe the manipulated HTML content in the received confirmation\nemail: When the internal recipient receives the confirmation email, the\nfilename variable will be rendered as part of the HTML content. Instead of\ndisplaying the raw text of the filename, the email client interprets the\ninjected HTML: the phishing link appears as a clickable hyperlink. This\ndemonstrates that attacker-controlled input can manipulate the structure\nand content of outgoing HTML emails, enabling the injection of malicious\nlinks and other HTML elements into messages that appear to come from a\ntrusted internal system.\n\n## Recommended Countermeasures ##\n\nWe recommend updating to GoAnywhere MFT version 7.10.0 or later.\n\nGoAnywhere MFT should not allow unencoded HTML special characters from\nuser provided sources in email output and instead apply correct encoding\naccording to the output context. For example, when displaying the content\nwithin an HTML email, HTML encoding must be performed before the untrusted\ndata is displayed.\n\n## Timeline ##\n\n* `2025-10-19` Identified the vulnerability in version 7.8.3 Build 7\n* `2025-12-01` First contact with Fortra support team\n* `2025-12-12` Disclosed vulnerability to Fortra support team and started\n               our 90 day disclosure timeline\n* `2026-01-20` Vulnerability was assigned CVE-2026-0972 by Fortra\n* `2026-03-18` Disclosure timeline extended due to promised fix\n               with release 7.10 at the end of March\n* `2026-04-07` Disclosure timeline extended again due to delayed release\n* `2026-04-20` Fortra published a fix with release 7.10\n* `2026-04-23` Public disclosure\n\n## References ##\n\n1. GoAnywhere MFT Triggers:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/automation/triggers\u003e\n2. GoAnywhere MFT Email Connectivity:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/connectivity/email\u003e\n3. Vendor Security Advisory:\n   \u003chttps://www.fortra.com/security/advisories/product-security/fi-2026-006\u003e\n\n## Credits ##\n\n* Philipp Schweinzer ([SBA Research](https://www.sba-research.org/))\n\nThe discovery of this vulnerability was made possible through support from\n[CYSSDE](https://cyssde.eu/) and the European Union.\n\n![CYSSDE](images/cyssde.png)\n-----BEGIN PGP SIGNATURE-----\n\niQJPBAEBCAA5FiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmnqfbcbFIAAAAAABAAO\nbWFudTIsMi41KzEuMTIsMiwxAAoJEPu4hi9Y93WyzUwP/R71yiNhsJF2yZMNqxEx\nwPSH2FKSSMC2AU+nV7ukYpbfK0APhq/8NLOXG6jXpmXH1F5pmWvoPdVQeGQinqef\ndGH19oe7Wd+lhBEK5icO10L6NNEGyxy+gev21Kbykf6+wrMzJz+ICjpyMBdi/4zV\nYaiIlprrtCtTylSTBUMV9fXqcj1HKWWtWTDObXI9JgvGh4IfYzNrV6AgfGv6GvIJ\ngSKHSmVvCmd1WWQMA/JiuEBCpgCeJIXcApKK+vuxmduh4fGRnpcWc0LxCb82ny+O\n/qOdYOt+nSvwEttVBARYS1d+uMYfLiiWYNZD3g84o8VAaelR9AT9NeCkOUPhEGAd\nxbM9A+Y46HqdPt0mJQ81bPi938r6Xruvg3rAw4JoQSV8/VCtzWmicIiLsVZJNRdb\nCVDgCX8tg8gpMlzcssmnNUrpsBolb3ovxiBVj1SXfi1c/ln6FWbvnnjNYBmkWPSg\nQUK/m7ZgKFuNCqf6z8gBK7jOtK2Bv7OiMZ4s+gVEuNRYFFZOoQn9DtnWgAUcSbI5\n3l0I56qPNgWqWUG3AwnP6P24x/6qjOn3jyLo5CKONd1NeGyIe1XL44Xh6I2B5hou\nC4qkUGB67wNS/wQwDUuEdlo62TLGnd48N9dG8VGzw+AI9DBR0DXjFvvlLfz5cQ5q\nxg2FGsgh2xDnCa3KBno+0HOr\n=2+hu\n-----END PGP SIGNATURE-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/8"
        },
        {
          "url": "https://cyssde.eu/"
        },
        {
          "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.fortra.com/"
        },
        {
          "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-006"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/automation/triggers"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/connectivity/email"
        },
        {
          "url": "https://www.sba-research.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SBA-ADV-20251120-01] CVE-2026-0972: GoAnywhere MFT Email HTML Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-0972",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0247",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8",
            "automated": true,
            "contentSha256": "b86c1665c4c67e4fa72469aea279d0ddfbbe325fcd127bedbc4c583f89905d93",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T20:15:13Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0247"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:09:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0247"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-03-17-2026-1 Background Security",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1,\niPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2\n\nBackground Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS\n26.3.1, and macOS 26.3.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126604.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\niOS 26.3.1 (a), iPadOS 26.3.1 (a), macOS 26.3.1 (a), macOS 26.3.2 (a)\n\nWebKit\nAvailable for: iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, macOS 26.3.2\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmm54C8ACgkQ4Ifiq8DH\n7PUGUw//S0SC2lJmp6tTNVubRojkwa1ppYTX/UXyJimhlpefU0mkxE4dRlqKzQP7\nWA4VRAbKwCZMSoIMrsh+xAkk5noy70jKthNGRpWTi+YIVmxzxChmjbAjrueugiwJ\nCZWUyhshmbbFVIMB5agDx6OIvNm4J+eazERM8FHuqKFBkb2V4gcEuzsGd0LQa3BO\nEN0UYoU5vBDK7OaEYy7yYYTAcjQgLBW2A799ospesduvz9LY3R6ewenowAQAoxjF\noxz426lRYkuOQ/cFNn1ejrBYBPadgDN4MkIiBmayU0fRqJHMBUZwjde4osJnHKz0\nOKbVAlklfLExqtD3W5McOsNUbdncgLz/AL/gSE+Mi2SfK3gyE0ER5KF4ZaSfIBzM\nOeZm7jqkr+NORFf3BgoYmbzA4+J5UJ/FVN4aLoKQCLCYS8zq+lG1QNLSBkd3RWHW\nV3ieTzyI40SIVH/nFtPwxpcus0ckfrJkDqcEEpfFVadaenuw4QF6mW5ctdAOu1Zf\nDvluADw/kXnNRI4ENFMz5qctTQbCOCodmaA0jO46UekXFMpe/emOteA3yTMsIZXq\nC4WDFQDwaPqB6SRZoUw2l87bE3liHoS1mKKtb+YcPP0/MJLlU5N4YMLLHhaiz3DJ\nAV0gg/q7dGv0l2TJocWybRReTRhXuwVBaCCt9RKjjyUdD79vw0w=\n=dtpg\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:08:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/10"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126604"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-17-2026-1 Background Security Improvements for iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-20643",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0258",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/10",
            "automated": true,
            "contentSha256": "a407069f3e2e365a22b8811ffc6d3daeab4f5d3e25753f3c52142f7928e2a097",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-17T23:43:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0258"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:08:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0258"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-03-24-2026-1 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4\n\niOS 26.4 and iPadOS 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126792.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAccounts\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-28877: Rosyna Keller of Totally Not Malicious Software\n\nApp Protection\nAvailable for: iPhone 11 and later\nImpact: An attacker with physical access to an iOS device with Stolen\nDevice Protection enabled may be able to access biometrics-gated\nProtected Apps with the passcode\nDescription: The issue was addressed with improved checks.\nCVE-2026-28895: Zack Tickman\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nAudio\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An attacker may be able to cause unexpected app termination\nDescription: A type confusion issue was addressed with improved memory\nhandling.\nCVE-2026-28822: Jex Amro\n\nBaseband\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may cause an unexpected app termination\nDescription: The issue was addressed with improved checks.\nCVE-2026-28874: Hazem Issa, Tuan D. Hoang, and Yongdae Kim @ SysSec,\nKAIST\n\nBaseband\nAvailable for: iPhone 16e\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A buffer overflow was addressed with improved bounds\nchecking.\nCVE-2026-28875: Tuan D. Hoang and Yongdae Kim @ KAIST SysSec Lab\n\nCalling Framework\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A remote attacker may be able to cause a denial-of-service\nDescription: A denial-of-service issue was addressed with improved input\nvalidation.\nCVE-2026-28894: an anonymous researcher\n\nClipboard\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nCoreMedia\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreUtils\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\ncurl\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nGeoServices\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to access sensitive user data\nDescription: An information leakage was addressed with additional\nvalidation.\nCVE-2026-28870: XiguaSec\n\niCloud\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\nCVE-2026-28833: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20698: DARKNAVY (@DarkNavyOrg)\n\nKernel\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nlibxpc\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: This issue was addressed with improved checks.\nCVE-2026-28882: Ilias Morad (A2nkF) of Voynich Group, Duy Tr\u1ea7n\n(@khanhduytran0), @hugeBlack\n\nMail\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: \"Hide IP Address\" and \"Block All Remote Content\" may not apply\nto all mail content\nDescription: A privacy issue was addressed with improved handling of\nuser preferences.\nCVE-2026-20692: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nPrinting\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to break out of its sandbox\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2026-20688: wdszzml and Atuin Automated Vulnerability Discovery\nEngine\n\nSandbox Profiles\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: An app may be able to fingerprint the user\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28863: Gongyu Ma (@Mezone0)\n\nSecurity\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, and iPad mini 5th\ngeneration and later\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nSiri\nAvailable for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation\nand later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd\ngeneration and later, iPad 8th generation and later, a"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:08:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126792"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-1 iOS 26.4 and iPadOS 26.4",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14524",
              "type": "related"
            },
            {
              "destId": "CVE-2025-64505",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20643",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20664",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20688",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28822",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28833",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28856",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28858",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28861",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28863",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28864",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28865",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28866",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28867",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28874",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28875",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28877",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28878",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28879",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28880",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28882",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28886",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28894",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28895",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0261",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/16",
            "automated": true,
            "contentSha256": "5204d651f4d908c4aa97b259f1fdea8f816c8b6481369f7cef3ed97e53ec75a5",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:00:35Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0261"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:08:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0261"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "APPLE-SA-03-24-2026-2 iOS",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7\n\niOS 18.7.7 and iPadOS 18.7.7 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126793.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\n802.1X\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An attacker in a privileged network position may be able to\nintercept network traffic\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-28865: H\u00e9lo\u00efse Gollier and Mathy Vanhoef (KU Leuven)\n\nAppleKeyStore\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20637: Johnny Franks (zeroxjf), an anonymous researcher\n\nAudio\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nCVE-2026-28879: Justin Cohen of Google\n\nClipboard\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved validation of\nsymlinks.\nCVE-2026-28866: Cristian Dinca (icmd.tech)\n\nCoreMedia\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing an audio stream in a maliciously crafted media file\nmay terminate the process\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nCVE-2026-20690: Hossein Lotfi (@hosselot) of Trend Micro Zero Day\nInitiative\n\nCoreUtils\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A user in a privileged network position may be able to cause a\ndenial-of-service\nDescription: A null pointer dereference was addressed with improved\ninput validation.\nCVE-2026-28886: Etienne Charron (Renault) and Victoria Martini (Renault)\n\nCrash Reporter\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A privacy issue was addressed by removing sensitive data.\nCVE-2026-28878: Zhongcheng Li from IES Red Team\n\ncurl\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An issue existed in curl which may result in unintentionally\nsending sensitive information via an incorrect connection\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-14524\n\nDeviceLink\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: A parsing issue in the handling of directory paths was\naddressed with improved path validation.\nCVE-2026-28876: Andreas Jaegersberger \u0026 Ro Achterberg of Nosebeard Labs\n\nFocus\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to access sensitive user data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-20668: Kirin (@Pwnrin)\n\niCloud\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to enumerate a user\u0027s installed apps\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28880: Zhongcheng Li from IES Red Team\n\nImageIO\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing a maliciously crafted file may lead to unexpected app\ntermination\nDescription: This is a vulnerability in open source code and Apple\nSoftware is among the affected projects. The CVE-ID was assigned by a\nthird party. Learn more about the issue and CVE-ID at cve.org.\nCVE-2025-64505\n\niTunes Store\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A user with physical access to an iOS device may be able to\nbypass Activation Lock\nDescription: A path handling issue was addressed with improved\nvalidation.\nCVE-2025-43534: iG0x72 and JJ of XiguaSec, Lehan Dilusha Jayasinghe\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to disclose kernel memory\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-28868: \uc774\ub3d9\ud558 (Lee Dong Ha of BoB 0xB6)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nKernel\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-20687: Johnny Franks (@zeroxjf)\n\nmDNSResponder\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to leak sensitive kernel state\nDescription: This issue was addressed with improved authentication.\nCVE-2026-28867: Jian Lee (@speedyfriend433)\n\nSecurity\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A local attacker may gain access to user\u0027s Keychain items\nDescription: This issue was addressed with improved permissions\nchecking.\nCVE-2026-28864: Alex Radocea\n\nUIFoundation\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: An app may be able to cause a denial-of-service\nDescription: A stack overflow was addressed with improved input\nvalidation.\nCVE-2026-28852: Caspian Tarafdar\n\nVision\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Parsing a maliciously crafted file may lead to an unexpected app\ntermination\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-20657: Andrew Becker\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may prevent Content\nSecurity Policy from being enforced\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 304951\nCVE-2026-20665: webb\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Processing maliciously crafted web content may bypass Same\nOrigin Policy\nDescription: A cross-origin issue in the Navigation API was addressed\nwith improved input validation.\nWebKit Bugzilla: 306050\nCVE-2026-20643: Thomas Espach\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A remote attacker may be able to view leaked DNS queries with\nPrivate Relay turned on\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 295943\nCVE-2025-43376: Mike Cardwell of grepular.com, Bob Lord\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: A malicious website may be able to access script message\nhandlers intended for other origins\nDescription: A logic issue was addressed with improved state management.\nWebKit Bugzilla: 307014\nCVE-2026-28861: Hongze Wu and Shuaike Dong from Ant Group Infrastructure\nSecurity Team\n\nWebKit\nAvailable for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation\nImpact: Visiting a maliciously crafted website may lead to a cross-site\nscripting attack\nDescription: A logic issue was addressed with improved checks.\nWebKit Bugzilla: 305859\nCVE-2026-28871: @hamayanhamayan\n\nAdditional recognition\n\nSafari\nWe would like to acknowledge @RenwaX23 for their assistance.\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device.\n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device.\n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. The version after applying this update\nwill be \"iOS 18.7.7 and iPadOS 18.7.7\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDIq0ACgkQ4Ifiq8DH\n7PUFaw/9G3jAXEudRiecXeZp9k/N+UQjmqDFpRyTWcWna8xafXl+XdMP0oLha0P6\nENk+zYbval1EO32jsxGjD04APryEkIBIMeQzeNTdlFTH6jUhPT1gFc1n6kXIMviZ\n+dw31YSO6iz4gbYe3rMGqeDinE7IoPxFVky+6t70YseqE9HBq6Hn2ABpVlfoSwpm\nqicn+A6GrN7vAfHlnPXnehaJjOaVRJY55w5F4ISwqa/RcPlbdYtakXpon0be2Aun\nuq6Syarq69l3T4rCqfzhZMoq8QsnqT5V6aYewMHuojsg2etPHc/NPM5PjgaM4CB0\nvy6eHLMXXvhofNdNIBw54glm6JZf9+ARrTDuHdsu3tLMteJeHdyLcFsANTztYeyQ\ntmBJgDWGZipwXC+ju5n8SF1f+i5oU1cMSRtu19EyeeWK2HZOCq603w+uk99SOZqK\nEZuc0/dmH4BYt0CvZ7P0wYh5oiIkAkRLznQE86a/+7K7PyKBgE6ezxRuq3tN9ExI\nn09WVCXCW47n1dUEs9FfGNRO0Cb6YIQ2hX4zQQJWEfQcKwYzr66mSEQvzTglDJPk\nyUF9Y5FbcJ/h7IWWGQr1PfnFTpbCMv9Pym1SRe0NrhoNWGxEP9ewHBkPRc3Gc1aB\nsNwyHy+M4iMaF1AFHHu4OjRf8vG7NLJdPx26RhIeL8ihIUcfF9U=\n=JY61\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:08:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/126793"
        },
        {
          "url": "https://www.apple.com/itunes/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-03-24-2026-2 iOS 18.7.7 and iPadOS 18.7.7",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-14524",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43376",
              "type": "related"
            },
            {
              "destId": "CVE-2025-43534",
              "type": "related"
            },
            {
              "destId": "CVE-2025-64505",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20637",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20643",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20657",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20665",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20668",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28861",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28864",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28865",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28866",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28867",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28868",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28871",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28878",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28879",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28880",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28886",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0262",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/17",
            "automated": true,
            "contentSha256": "90119543045bfefb1591d9baed175decdfa659d2dfb92443eff5c4d1b6670c03",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-25T00:01:12Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0262"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:08:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0262"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Leostream Connection Broker",
          "vendor": "Leostream",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Leostream Connection Broker 9.1.37.0.\n\nVulnerability 1 \u2014 Authenticated SQL injection to webshell to root RCE (CVSS 9.1, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-89)\n\ncall_back.pl?action=user concatenates the unsigned _where parameter into a PostgreSQL WHERE clause; the default \ninstallation grants SUPERUSER, runs postgres as the webroot owner, and configures NOPASSWD sudo, so lo_export writes a \nwebshell and /welcome.pl?c= triggers commands as root.\n\nVulnerability 2 \u2014 Unauthenticated rogue-agent registration + SSRF (CVSS 7.0, \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-306)\n\nServer.Register is dispatched without the session gate and its token check is optional, letting an anonymous caller \ninject VM records and drive broker outbound TLS connections to attacker-controlled hosts.\n\nAuthentication: Vulnerability 1 authenticated (requires valid session); Vulnerability 2 unauthenticated / pre-auth.\n\nFull technical analyses and reproducible proofs-of-concept:\n  https://0day-rubbish.com/blog/leostream-postauth-sqli-lo-export-webshell-rce\n  https://0day-rubbish.com/blog/leostream-unauth-server-register-ssrf\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:08:09Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/96"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/96"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/leostream-postauth-sqli-lo-export-webshell-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/leostream-unauth-server-register-ssrf"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/96"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Leostream Connection Broker 9.1.37.0 two vulnerabilities (SQLi to root RCE, unauth SSRF)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0137",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/96",
            "automated": true,
            "contentSha256": "1cf8d2c5db456ca635e632c66da234db75b4b9ab7d593e5251eaa7d5b7786b04",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/96",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:11:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:08:09Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0137"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}