GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

387 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0151

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:52
VLAI
Title
[0day-rubbish] ONE Reporter 13.1 Authenticated RCE / privilege escalation via CommandExecutor (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in ONE Reporter 13.1. Type: Authenticated RCE / privilege escalation via CommandExecutor (CWE-78) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Low-privilege user executes arbitrary commands as local-admin service account Authentication: authenticated Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/veeam-one-commandexecutor-postauth-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Veeam One Reporter Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "One Reporter",
          "vendor": "Veeam",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nONE Reporter 13.1.\n\nType: Authenticated RCE / privilege escalation via CommandExecutor (CWE-78)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\nImpact: Low-privilege user executes arbitrary commands as local-admin service account\nAuthentication: authenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/veeam-one-commandexecutor-postauth-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/75"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/75"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/veeam-one-commandexecutor-postauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/75"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] ONE Reporter 13.1 Authenticated RCE / privilege escalation via CommandExecutor (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0151",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/75",
            "automated": true,
            "contentSha256": "fe0ea42aeb0bb7abb3b0c9282386e3d8e8f3b68487e6211d37282f0b595590c6",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/75",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T05:02:06Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:52:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0151"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0148

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
[0day-rubbish] ActiveFax Server 10.70 Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in ActiveFax Server 10.70. Type: Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (CWE-78) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated attacker executes arbitrary commands as SYSTEM via an LPD print job Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/actfax-unauth-lpd-gs-pipe-system-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Actfax Activefax Server Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Activefax Server",
          "vendor": "Actfax",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nActiveFax Server 10.70.\n\nType: Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (CWE-78)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated attacker executes arbitrary commands as SYSTEM via an LPD print job\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/actfax-unauth-lpd-gs-pipe-system-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/72"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/72"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/actfax-unauth-lpd-gs-pipe-system-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/72"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] ActiveFax Server 10.70 Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0148",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/72",
            "automated": true,
            "contentSha256": "bac24b7aede13403ea4bb2f7f8c5201bb7e8a792272de0e142916a013b64e325",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/72",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T04:59:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0148"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0303

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:51
VLAI
Title
APPLE-SA-08-18-2026-1 Safari 26.6.1
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-18-2026-1 Safari 26.6.1 Safari 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148286. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition WebKit We would like to acknowledge Henock Habte for their assistance. Safari 26.6.1 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH 7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E wl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR 9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So j7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe 1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc SKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe NFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1 n+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp EmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC udOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK vj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI= =LOpe -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Safari Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0303 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-18-2026-1 Safari 26.6.1\n\nSafari 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148286.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nSafari 26.6.1 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH\n7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E\nwl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR\n9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So\nj7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe\n1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc\nSKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe\nNFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1\nn+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp\nEmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC\nudOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK\nvj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI=\n=LOpe\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/69"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148286"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-18-2026-1 Safari 26.6.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0303",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69",
            "automated": true,
            "contentSha256": "e7bc2955faffd4542bd9f546314cba669e5bbd24ea91d092114a1f773497ef5e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T19:51:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0303"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0303"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0131

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
APPLE-SA-08-18-2026-1 Safari 26.6.1
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-08-18-2026-1 Safari 26.6.1 Safari 26.6.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/148286. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: An out-of-bounds access issue was addressed with improved bounds checking. WebKit Bugzilla: 317632 CVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 313452 CVE-2026-43795: wwwlk WebKit Bugzilla: 318348 CVE-2026-65338: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: The issue was addressed with improved memory handling. WebKit Bugzilla: 318405 CVE-2026-65341: Henock Habte WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321480 CVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved input validation. WebKit Bugzilla: 321484 CVE-2026-64781: Thomas Guillem WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 321517 CVE-2026-65351: Niels Hofmans WebKit Bugzilla: 316996 CVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo) WebKit Bugzilla: 317142 CVE-2026-65337: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317349 CVE-2026-65336: Josef Korbel WebKit Bugzilla: 316723 CVE-2026-65335: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317603 CVE-2026-65333: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317450 CVE-2026-65332: OpenAI Codex Security - Amy Burnett WebKit Bugzilla: 317611 CVE-2026-65331: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 316347 CVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: The issue was addressed with improved checks. WebKit Bugzilla: 316918 CVE-2026-64780: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved state management. WebKit Bugzilla: 316791 CVE-2026-65334: OpenAI Codex Security - Amy Burnett WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to memory corruption Description: A memory corruption issue was addressed with improved memory handling. WebKit Bugzilla: 317317 CVE-2026-43794: Dung Do (@_piers2) of Calif.io WebKit Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 313703 CVE-2026-64787: 杉山 壮太, Shubham Chaskar WebKit History Available for: macOS Sonoma and macOS Sequoia Impact: Visiting a maliciously crafted website may leak sensitive data Description: The issue was addressed with improved checks. WebKit Bugzilla: 315528 CVE-2026-64778: Mohit Negi WebKit Storage Available for: macOS Sonoma and macOS Sequoia Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption vulnerability was addressed with improved locking. WebKit Bugzilla: 321485 CVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg) Additional recognition WebKit We would like to acknowledge Henock Habte for their assistance. Safari 26.6.1 may be obtained from the Mac App Store. All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH 7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E wl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR 9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So j7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe 1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc SKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe NFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1 n+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp EmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC udOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK vj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI= =LOpe -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Apple Safari Affected: unknown
Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Safari",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-18-2026-1 Safari 26.6.1\n\nSafari 26.6.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148286.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Sonoma and macOS Sequoia\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nSafari 26.6.1 may be obtained from the Mac App Store.\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqEtoMACgkQ4Ifiq8DH\n7PXAJw//TT8E/xNXFpPvYP4AalRggghX1B0wdLSFdd2py/EsbRloEErOZf5dZ52E\nwl3IwcqcNoCbGrcWYx1zFhSn92sgqV6eOQ6ff4BpLp82BRTeISDllKHpX+aZ1LsR\n9AL69KgQ4nQjoalq0e8vc4+cE3H59YKg4xC5vXMMt/tNZKfdzwB8x8yZNEFkl1So\nj7wAkOtBudbQOo4yaXs7hqBsutkMgxuPr79nIJYv0ye8fbk9IfhA3dKRnSIBYpGe\n1coG9gQ/5DMn1IF0AQ0H3Tg9ZxBZcQVpSMs2EuLYzV84eUZ4Pp8lBansDnMZdaSc\nSKP08qQ0CRD0Q3xh2L8hzYKYocNpXtOW12BSuIaY3BC/QgPHwTZQEECbpTuleQLe\nNFZxY9JEWPtzr5CEq3crlaXihtNbeQA4VhgSrWhYFdUaLKDFBBHIat5wEVlMPgt1\nn+ml4wUzdRdfOI9GMeCPbZqIvySdf+EALS+opMzCeXb6HJ84qo8dLi9BMUESucfp\nEmSW2dwAAHreuYwykHEuZoFjd3uR0eicEmTHPV/Ujm6NJOgD7qv0cO7jTfc91KuC\nudOqx2AcyJLKRupddWeUBYVXZLzQO9XUnUa8K5w2tIqhd3PT+HwsnFb7k4GpaUIK\nvj31dfQghVhRuqRDApLd+CVsjsKR6NkZenBKhhf3knDDoMX/dPI=\n=LOpe\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/69"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148286"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-18-2026-1 Safari 26.6.1",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0131",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/69",
            "automated": true,
            "contentSha256": "e7bc2955faffd4542bd9f546314cba669e5bbd24ea91d092114a1f773497ef5e",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T19:51:27Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0131"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0304

Vulnerability from gna-1988 – Published: 2026-09-08 11:40 – Updated: 2026-09-11 11:51
VLAI
Title
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Summary
Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24. CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3 The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the secret can be recovered from the firmware image, an attacker can forge a valid JWT without the owner's username or password and without user interaction. CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface Severity: High, CVSS 8.7 Once authenticated to MQTT, an attacker can send unsanitized input through the mesh command interface to a shell sink, resulting in arbitrary operating-system command execution as root. Combined attack path: firmware signing key -> forged JWT -> MQTT access -> root commands Remote-scope clarification: The attacker does not need physical proximity to the router and does not need to be connected to the victim's LAN. Exploitation still requires a network path to the relevant MQTT/control-plane interface. This disclosure does not claim that every affected router is directly reachable from the public Internet. Affected scope: Cudy WR3000 hardware revision 2.0 Firmware versions earlier than 2.5.24 Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There is no defensible public estimate of the number of vulnerable devices because neither the vendor nor public datasets provide installed-base figures broken down by hardware revision and firmware version. References: https://github.com/advisories/GHSA-jw4g-pv34-hp37 https://github.com/advisories/GHSA-8jmp-g7g6-gf45 https://www.cudy.com/en-us/pages/download-center/wr3000-2-0 Researcher: Nir Yehoshua Cipher Security Labs https://ciphersecuritylabs.com/ Regards, Nir Yehoshua Cipher Security Labs _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Cudy WR3000 Hard-coded Affected: unknown
Create a notification for this product.
Credits
Nir Yehoshua
Relationships
reference GCVE-1988-2026-0304 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "WR3000 Hard-coded",
          "vendor": "Cudy",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/68"
        },
        {
          "url": "https://ciphersecuritylabs.com/"
        },
        {
          "url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
        },
        {
          "url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/68"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-71960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-71961",
              "type": "related"
            },
            {
              "destId": "GHSA-8JMP-G7G6-GF45",
              "type": "related"
            },
            {
              "destId": "GHSA-JW4G-PV34-HP37",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0304",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
            "automated": true,
            "contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T20:23:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0304"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-11T11:51:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0304"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0156

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Cudy WR3000: Hard-coded JWT Secret to Root Command Injection
Summary
Hello Full Disclosure list, Cipher Security Labs has published details for two vulnerabilities affecting Cudy WR3000 hardware revision 2.0 running firmware before version 2.5.24. CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass Severity: Critical, CVSS 9.3 The device firmware contains a hard-coded HMAC signing secret used by the Mosquitto MQTT JWT authentication plugin. Because the secret can be recovered from the firmware image, an attacker can forge a valid JWT without the owner's username or password and without user interaction. CVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface Severity: High, CVSS 8.7 Once authenticated to MQTT, an attacker can send unsanitized input through the mesh command interface to a shell sink, resulting in arbitrary operating-system command execution as root. Combined attack path: firmware signing key -> forged JWT -> MQTT access -> root commands Remote-scope clarification: The attacker does not need physical proximity to the router and does not need to be connected to the victim's LAN. Exploitation still requires a network path to the relevant MQTT/control-plane interface. This disclosure does not claim that every affected router is directly reachable from the public Internet. Affected scope: Cudy WR3000 hardware revision 2.0 Firmware versions earlier than 2.5.24 Cudy lists firmware 2.5.24 with a release date of July 30, 2026. There is no defensible public estimate of the number of vulnerable devices because neither the vendor nor public datasets provide installed-base figures broken down by hardware revision and firmware version. References: https://github.com/advisories/GHSA-jw4g-pv34-hp37 https://github.com/advisories/GHSA-8jmp-g7g6-gf45 https://www.cudy.com/en-us/pages/download-center/wr3000-2-0 Researcher: Nir Yehoshua Cipher Security Labs https://ciphersecuritylabs.com/ Regards, Nir Yehoshua Cipher Security Labs _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Cudy WR3000 Hard-coded Affected: unknown
Create a notification for this product.
Credits
Nir Yehoshua
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "WR3000 Hard-coded",
          "vendor": "Cudy",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Yehoshua"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure list,\n\nCipher Security Labs has published details for two vulnerabilities\naffecting Cudy WR3000 hardware revision 2.0 running firmware before\nversion 2.5.24.\n\nCVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass\nSeverity: Critical, CVSS 9.3\n\nThe device firmware contains a hard-coded HMAC signing secret used by\nthe Mosquitto MQTT JWT authentication plugin. Because the secret can\nbe recovered from the firmware image, an attacker can forge a valid\nJWT without the owner\u0027s username or password and without user\ninteraction.\n\nCVE-2026-71961 - OS Command Injection via Mesh MQTT Command Interface\nSeverity: High, CVSS 8.7\n\nOnce authenticated to MQTT, an attacker can send unsanitized input\nthrough the mesh command interface to a shell sink, resulting in\narbitrary operating-system command execution as root.\n\nCombined attack path:\n\nfirmware signing key -\u003e forged JWT -\u003e MQTT access -\u003e root commands\n\nRemote-scope clarification:\nThe attacker does not need physical proximity to the router and does\nnot need to be connected to the victim\u0027s LAN. Exploitation still\nrequires a network path to the relevant MQTT/control-plane interface.\nThis disclosure does not claim that every affected router is directly\nreachable from the public Internet.\n\nAffected scope:\nCudy WR3000 hardware revision 2.0\nFirmware versions earlier than 2.5.24\n\nCudy lists firmware 2.5.24 with a release date of July 30, 2026. There\nis no defensible public estimate of the number of vulnerable devices\nbecause neither the vendor nor public datasets provide installed-base\nfigures broken down by hardware revision and firmware version.\n\nReferences:\nhttps://github.com/advisories/GHSA-jw4g-pv34-hp37\nhttps://github.com/advisories/GHSA-8jmp-g7g6-gf45\nhttps://www.cudy.com/en-us/pages/download-center/wr3000-2-0\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nhttps://ciphersecuritylabs.com/\n\nRegards,\nNir Yehoshua\nCipher Security Labs\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/68"
        },
        {
          "url": "https://ciphersecuritylabs.com/"
        },
        {
          "url": "https://github.com/advisories/GHSA-8jmp-g7g6-gf45"
        },
        {
          "url": "https://github.com/advisories/GHSA-jw4g-pv34-hp37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/68"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cudy WR3000: Hard-coded JWT Secret to Root Command Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0156",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/68",
            "automated": true,
            "contentSha256": "f46a5a06f3114e09b165ded208e2a127b30bb244f649c06e56eceae463f7601a",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/68",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T20:23:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0156"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0130

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research is published and a proof-of-concept is available. Pre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication) Telaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False, which is the default. The SaveVerifyActivity handler concatenates the sNotes parameter into an INSERT statement with no escaping. On a SQL Server backend with a sysadmin application account, an unauthenticated attacker uses a COMMIT-breakout payload to enable xp_cmdshell and execute arbitrary commands as LocalSystem. Dynamically verified. Impact: Full compromise of the physical access-control and emergency-mustering system as LocalSystem. The attacker can alter badge records, forge or block entry events, and take over facility-security infrastructure. Advisory: https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research \nis published and a proof-of-concept is available.\n\nPre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication)\n\nTelaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False, \nwhich is the default. The SaveVerifyActivity handler concatenates the sNotes parameter into an INSERT statement with no \nescaping. On a SQL Server backend with a sysadmin application account, an unauthenticated attacker uses a \nCOMMIT-breakout payload to enable xp_cmdshell and execute arbitrary commands as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the physical access-control and emergency-mustering system as LocalSystem. The attacker can \nalter badge records, forge or block entry events, and take over facility-security infrastructure.\n\nAdvisory: https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/67"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/67"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0130",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67",
            "automated": true,
            "contentSha256": "cec91faf2c741e53587ced1d8d970503d5a829e59e42ca3986170652b6ed94ee",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/67",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:06:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0130"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0129

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is published and a proof-of-concept is available. Authenticated RCE (SQL injection) (CVSS 8.8, authenticated) Plixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping in the adminEditLang handler. The default configuration includes the pg_cron extension and a PostgreSQL SUPERUSER database role, so an authenticated administrator can inject a side-effect expression that schedules a cron job executing arbitrary commands as the postgres user. Dynamically verified. Impact: Arbitrary command execution on the flow-analytics appliance as the postgres user inside the default privileged container. The attacker can disrupt monitoring, access network flow data, and take control of the host. Advisory: https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Security advisory Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is \npublished and a proof-of-concept is available.\n\nAuthenticated RCE (SQL injection) (CVSS 8.8, authenticated)\n\nPlixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping \nin the adminEditLang handler. The default configuration includes the pg_cron extension and a PostgreSQL SUPERUSER \ndatabase role, so an authenticated administrator can inject a side-effect expression that schedules a cron job \nexecuting arbitrary commands as the postgres user. Dynamically verified.\n\nImpact: Arbitrary command execution on the flow-analytics appliance as the postgres user inside the default privileged \ncontainer. The attacker can disrupt monitoring, access network flow data, and take control of the host.\n\nAdvisory: https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/66"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/66"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0129",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66",
            "automated": true,
            "contentSha256": "19fee513503623dbb02b93dfc779c6e707ec72663fa43a6037c837f26bd1821c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/66",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:48Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0129"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0128

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology)). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication) Output Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection is treated as authenticated. Through linkserver registration and the file-transfer listener, an unauthenticated attacker uploads a crafted ZIP whose entries escape the plugin directory (Zip-Slip in SharpZipLib 0.85.4). On service restart, the planted plugin constructor executes as LocalSystem. Dynamically verified. Impact: Full compromise of the on-premise enterprise instant-messaging server as LocalSystem. The attacker can read corporate communications, execute arbitrary commands, and move laterally inside the office network. Advisory: https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax \nSoftware (Output Technology)). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)\n\nOutput Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection \nis treated as authenticated. Through linkserver registration and the file-transfer listener, an unauthenticated \nattacker uploads a crafted ZIP whose entries escape the plugin directory (Zip-Slip in SharpZipLib 0.85.4). On service \nrestart, the planted plugin constructor executes as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the on-premise enterprise instant-messaging server as LocalSystem. The attacker can read \ncorporate communications, execute arbitrary commands, and move laterally inside the office network.\n\nAdvisory: https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/65"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/65"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax Software (Output Technology))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0128",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65",
            "automated": true,
            "contentSha256": "1a92cd811d62d57463faa0478429c3f7161b89c57498277dd6b0195e0eb81e9d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/65",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0128"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0127

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is published and a proof-of-concept is available. Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication) MidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and auth.servers commented out, making the JBoss Remoting layer network-reachable with no authentication. The invocation handler accepts any connection and performs arbitrary-path file writes on the target host; writing a cron entry yields root command execution. This is a shipped default-deployment template vulnerability. Dynamically verified. Impact: Full compromise of CI/CD target hosts as root. The attacker can overwrite deployed artifacts, inject trojans into build and deploy pipelines, and take control of every managed server. Advisory: https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)\n\nMidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and \nauth.servers commented out, making the JBoss Remoting layer network-reachable with no authentication. The invocation \nhandler accepts any connection and performs arbitrary-path file writes on the target host; writing a cron entry yields \nroot command execution. This is a shipped default-deployment template vulnerability. Dynamically verified.\n\nImpact: Full compromise of CI/CD target hosts as root. The attacker can overwrite deployed artifacts, inject trojans \ninto build and deploy pipelines, and take control of every managed server.\n\nAdvisory: https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/64"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/64"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0127",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64",
            "automated": true,
            "contentSha256": "fc0393166254f6d5713a53b47d9f607569d48138ab4898e4f9a03efadd28761f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/64",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0127"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 31 - 40 publications in total 387