Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

445 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0153

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write
Summary
---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0009 ---------------------------------------------------------------------------- [-] Summary: NitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN file transfer receive path. The transfer service is reachable from the local network on TCP port 40818 and processes incoming transfer metadata without authentication in the reported default configuration. A LAN-adjacent attacker can write attacker-controlled file content outside the intended download directory. CVSS:3.1 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L). [-] Affected: NitroShare Desktop, versions through 0.3.4 (application). No fixed version is currently verified. [-] Technical Description: When receiving a transfer, NitroShare parses sender-controlled JSON item metadata, creates a receive-side filesystem item from that metadata, opens the item for writing, and writes subsequent binary packet content to it. In the filesystem plugin, the received item name is used as a relative filename and combined with the configured transfer directory using QDir::cleanPath(root + QDir::separator() + mRelativeFilename), without a visible check that the resolved path remains inside the transfer directory. An attacker on the same local network can send a crafted transfer item name containing relative path traversal sequences such as ../, causing NitroShare to write received file content outside the intended download directory. The write is limited to locations accessible to the NitroShare process user. On Windows, writing to the current user's Startup folder can result in code execution when the affected user next logs in. Weaknesses: CWE-22: Improper Limitation of a Pathname to a Restricted Directory CWE-35: Path Traversal: '.../...//' CAPEC-126: Path Traversal A proof-of-concept is published in the researcher's repository (see References). [-] Timeline: [12/04/2026] - CVE ID requested through the MITRE CVE request form; request ignored, no CVE assigned. [22/07/2026] - NotCVE ID reserved. [23/07/2026] - Published as NotCVE-2026-0009. [-] Credit: Discovered by Christopher Duram (https://github.com/cduram). [-] Full Details and Updates: https://notcve.org/notcve/NotCVE-2026-0009 [-] References: https://github.com/cduram/NotCVE-2026-0009 https://github.com/cduram/NotCVE-2026-0009/blob/main/poc_path_traversal.py https://github.com/nitroshare/nitroshare-desktop https://github.com/nitroshare/nitroshare-desktop/blob/master/libnitroshare/src/transfer/transfer.cpp https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/file.cpp https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/filehandler.cpp [-] About NotCVE: NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE? Request a NotCVE: https://notcve.org/form/ · Contributors: https://notcve.org/hall/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
advisories
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NitroShare Desktop",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "advisories"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0009\n----------------------------------------------------------------------------\n\n[-] Summary:\nNitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN\nfile transfer receive path. The transfer service is reachable from the local\nnetwork on TCP port 40818 and processes incoming transfer metadata without\nauthentication in the reported default configuration. A LAN-adjacent attacker\ncan write attacker-controlled file content outside the intended download\ndirectory. CVSS:3.1 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L).\n\n[-] Affected:\nNitroShare Desktop, versions through 0.3.4 (application).\nNo fixed version is currently verified.\n\n[-] Technical Description:\nWhen receiving a transfer, NitroShare parses sender-controlled JSON item\nmetadata, creates a receive-side filesystem item from that metadata, opens\nthe item for writing, and writes subsequent binary packet content to it.\n\nIn the filesystem plugin, the received item name is used as a relative\nfilename and combined with the configured transfer directory using\nQDir::cleanPath(root + QDir::separator() + mRelativeFilename), without a\nvisible check that the resolved path remains inside the transfer directory.\n\nAn attacker on the same local network can send a crafted transfer item name\ncontaining relative path traversal sequences such as ../, causing NitroShare\nto write received file content outside the intended download directory. The\nwrite is limited to locations accessible to the NitroShare process user. On\nWindows, writing to the current user\u0027s Startup folder can result in code\nexecution when the affected user next logs in.\n\nWeaknesses:\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory\nCWE-35: Path Traversal: \u0027.../...//\u0027\nCAPEC-126: Path Traversal\n\nA proof-of-concept is published in the researcher\u0027s repository (see\nReferences).\n\n[-] Timeline:\n[12/04/2026] - CVE ID requested through the MITRE CVE request form; request\n               ignored, no CVE assigned.\n[22/07/2026] - NotCVE ID reserved.\n[23/07/2026] - Published as NotCVE-2026-0009.\n\n[-] Credit:\nDiscovered by Christopher Duram (https://github.com/cduram).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0009\n\n[-] References:\nhttps://github.com/cduram/NotCVE-2026-0009\nhttps://github.com/cduram/NotCVE-2026-0009/blob/main/poc_path_traversal.py\nhttps://github.com/nitroshare/nitroshare-desktop\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/libnitroshare/src/transfer/transfer.cpp\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/file.cpp\nhttps://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/filehandler.cpp\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-35",
              "description": "CWE-35",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/110"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/110"
        },
        {
          "url": "https://github.com/cduram"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0009"
        },
        {
          "url": "https://github.com/cduram/NotCVE-2026-0009/blob/main/poc_path_traversal.py"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/libnitroshare/src/transfer/transfer.cpp"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/file.cpp"
        },
        {
          "url": "https://github.com/nitroshare/nitroshare-desktop/blob/master/plugins/filesystem/filehandler.cpp"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://notcve.org"
        },
        {
          "url": "https://notcve.org/form/"
        },
        {
          "url": "https://notcve.org/hall/"
        },
        {
          "url": "https://notcve.org/notcve/NotCVE-2026-0009"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/110"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0153",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/110",
            "automated": true,
            "contentSha256": "c9f3fde7dcd9b8fb154f6cb2464f0764c7a069954c507359d4361214aaa738c0",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/110",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T10:57:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0153"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0150

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Gemini 7.3.0. Type: Authenticated SQL injection to xp_cmdshell RCE (CWE-89) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Impact: Authenticated user executes OS commands via stacked SQL and xp_cmdshell as sa/sysadmin Authentication: authenticated Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/countersoft-gemini-sqli-xp-cmdshell-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version
unknown Gemini Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Gemini",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nGemini 7.3.0.\n\nType: Authenticated SQL injection to xp_cmdshell RCE (CWE-89)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\nImpact: Authenticated user executes OS commands via stacked SQL and xp_cmdshell as sa/sysadmin\nAuthentication: authenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/countersoft-gemini-sqli-xp-cmdshell-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/74"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/74"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/countersoft-gemini-sqli-xp-cmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/74"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0150",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/74",
            "automated": true,
            "contentSha256": "1e992764fbc072fd1ca5b1f5320f15498c8ab96d0754f3285c0ea12d196e4a2c",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/74",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T05:01:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0150"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0149

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] RoboTask 11.0.5.1229 Unauthenticated REST API remote task execution (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in RoboTask 11.0.5.1229. Type: Unauthenticated REST API remote task execution (CWE-306) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated attacker enumerates and triggers pre-existing tasks with Administrator privileges Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/robotask-rest-api-unauth-task-execution Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version
unknown RoboTask Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RoboTask",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nRoboTask 11.0.5.1229.\n\nType: Unauthenticated REST API remote task execution (CWE-306)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated attacker enumerates and triggers pre-existing tasks with Administrator privileges\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/robotask-rest-api-unauth-task-execution\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/73"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/73"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/robotask-rest-api-unauth-task-execution"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/73"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] RoboTask 11.0.5.1229 Unauthenticated REST API remote task execution (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0149",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/73",
            "automated": true,
            "contentSha256": "269bc68215463a8cdadb5caf508a19e8759d4502c9f286cee585fa2f949b1d51",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/73",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T05:00:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0149"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0146

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Datalore On-Premises 2026.2.3 Unauthenticated RCE via InteractiveReport access-mapping flaw (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Datalore On-Premises 2026.2.3. Type: Unauthenticated RCE via InteractiveReport access-mapping flaw (CWE-306) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Impact: Anonymous attacker executes arbitrary code in the notebook agent container Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/jetbrains-datalore-interactive-report-unauth-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Datalore On-Premises",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nDatalore On-Premises 2026.2.3.\n\nType: Unauthenticated RCE via InteractiveReport access-mapping flaw (CWE-306)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nImpact: Anonymous attacker executes arbitrary code in the notebook agent container\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/jetbrains-datalore-interactive-report-unauth-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/70"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/70"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/jetbrains-datalore-interactive-report-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/70"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Datalore On-Premises 2026.2.3 Unauthenticated RCE via InteractiveReport access-mapping flaw (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0146",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/70",
            "automated": true,
            "contentSha256": "1e1753ed1c16f04d76fb52be9c4839b8ffb90b777008258fee4f82c3a558c21c",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/70",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T04:57:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0146"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0144

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities
Summary
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-003 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-003 ------------------------------------------------------------------------ Date: 2026-06-25 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.7 Versions not affected: >= 6.0.8 Website: https://www.revive-adserver.com/ ======================================================================== ======================================================================== 1. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-50739 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780709 https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d https://cwe.mitre.org/data/definitions/284.html ======================================================================== 2. Reflected XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50740 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780806 https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b https://cwe.mitre.org/data/definitions/79.html ======================================================================== 3. Remote Code Execution ======================================================================== Vulnerability Type: CWE-94: Code Injection CVE-ID: CVE-2026-50741 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780854 https://hackerone.com/reports/3781492 https://github.com/revive-adserver/revive-adserver/commit/3d1485de https://github.com/revive-adserver/revive-adserver/commit/becaf6e7 https://cwe.mitre.org/data/definitions/94.html ======================================================================== 4. Stored XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50742 Risk level: Medium CVSS Base Score: 4.4 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3781311 https://github.com/revive-adserver/revive-adserver/commit/91abb6ab https://cwe.mitre.org/data/definitions/79.html ======================================================================== 5. Cross-Site Request Forgery ======================================================================== Vulnerability Type: CWE-352: Cross-Site Request Forgery CVE-ID: CVE-2026-50743 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3781691 https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f https://cwe.mitre.org/data/definitions/352.html ======================================================================== 6. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-50744 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3783738 https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a https://cwe.mitre.org/data/definitions/284.html ======================================================================== 7. Reflected XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50745 Risk level: Medium CVSS Base Score: 4.7 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3793243 https://github.com/revive-adserver/revive-adserver/commit/a570a0c1 https://cwe.mitre.org/data/definitions/79.html ======================================================================== Solution ======================================================================== ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. Please review https://www.revive-adserver.com/security/ before doing so. -- Matteo Beccati On behalf of the Revive Adserver Team https://www.revive-adserver.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
Matteo Beccati
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-003\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-003\n------------------------------------------------------------------------\nDate: 2026-06-25\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.7\nVersions not affected: \u003e= 6.0.8\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50739\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780709\nhttps://github.com/revive-adserver/revive-adserver/commit/c03a0b6d\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50740\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780806\nhttps://github.com/revive-adserver/revive-adserver/commit/03d9ad8b\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n3. Remote Code Execution\n========================================================================\nVulnerability Type:    CWE-94: Code Injection\nCVE-ID:                CVE-2026-50741\nRisk level:            High\nCVSS Base Score:       8.8\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780854\nhttps://hackerone.com/reports/3781492\nhttps://github.com/revive-adserver/revive-adserver/commit/3d1485de\nhttps://github.com/revive-adserver/revive-adserver/commit/becaf6e7\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n4. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50742\nRisk level:            Medium\nCVSS Base Score:       4.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781311\nhttps://github.com/revive-adserver/revive-adserver/commit/91abb6ab\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Cross-Site Request Forgery\n========================================================================\nVulnerability Type:    CWE-352: Cross-Site Request Forgery\nCVE-ID:                CVE-2026-50743\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781691\nhttps://github.com/revive-adserver/revive-adserver/commit/e3c84d6f\nhttps://cwe.mitre.org/data/definitions/352.html\n\n\n========================================================================\n6. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50744\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3783738\nhttps://github.com/revive-adserver/revive-adserver/commit/3e04cb4a\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n7. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50745\nRisk level:            Medium\nCVSS Base Score:       4.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3793243\nhttps://github.com/revive-adserver/revive-adserver/commit/a570a0c1\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-352",
              "description": "CWE-352",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/352.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3d1485de"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/91abb6ab"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/a570a0c1"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/becaf6e7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f"
        },
        {
          "url": "https://hackerone.com/reports/3780709"
        },
        {
          "url": "https://hackerone.com/reports/3780806"
        },
        {
          "url": "https://hackerone.com/reports/3780854"
        },
        {
          "url": "https://hackerone.com/reports/3781311"
        },
        {
          "url": "https://hackerone.com/reports/3781492"
        },
        {
          "url": "https://hackerone.com/reports/3781691"
        },
        {
          "url": "https://hackerone.com/reports/3783738"
        },
        {
          "url": "https://hackerone.com/reports/3793243"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-003"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0144",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19",
            "automated": true,
            "contentSha256": "c5bcb5ce1b70d5aea4ade5341e47213742f349f29dea887b1d4dc890d0f3bbce",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-07T07:20:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0144"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0143

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
Skullcandy Dime 3 unauthorized Bluetooth pairing behavior
Summary
Hello, I am submitting the following security disclosure for publication on the Full Disclosure mailing list. Title: Pairing Without Consent: CVE-2025-20701 Behavior on Skullcandy Dime 3 Affected product: Skullcandy Dime 3 wireless earbuds Vulnerability: Unauthorized Bluetooth Classic pairing and persistent bond creation Description: Testing demonstrated that a previously unknown Linux computer could pair with a Skullcandy Dime 3 earbud set and store a persistent Bluetooth bond without the earbuds being intentionally placed into pairing mode. No confirmation or physical interaction with the earbuds was required during the pairing process. The observed behavior is consistent with CVE-2025-20701. Security impact: A nearby attacker within Bluetooth range may be able to establish an unauthorized trusted relationship with the earbuds. The stored bond could allow subsequent connections from the unauthorized device and potentially interfere with the legitimate user’s Bluetooth connection. Evidence: The public research repository includes: - A detailed technical report - Reproduction information - Screenshots - A sanitized BTSnoop capture - A packet-level description of the pairing sequence Repository: https://github.com/x0jac0b0x/skullcandy-dime3-cve-2025-20701 The published BTSnoop capture preserves the pairing and connection sequence. The 16-byte BR/EDR link key was replaced with zero bytes before publication. The original, unmodified capture has been retained privately. This research was conducted on hardware I own and is being published for defensive research, independent verification, and vendor awareness. Regards, Jacob Nowak Independent Security Researcher GitHub: https://github.com/x0jac0b0x _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
Jacob Nowak
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Skullcandy Dime 3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacob Nowak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello,\n\nI am submitting the following security disclosure for publication on the\nFull Disclosure mailing list.\n\nTitle: Pairing Without Consent: CVE-2025-20701 Behavior on Skullcandy Dime 3\n\nAffected product:\nSkullcandy Dime 3 wireless earbuds\n\nVulnerability:\nUnauthorized Bluetooth Classic pairing and persistent bond creation\n\nDescription:\n\nTesting demonstrated that a previously unknown Linux computer could pair\nwith a Skullcandy Dime 3 earbud set and store a persistent Bluetooth bond\nwithout the earbuds being intentionally placed into pairing mode.\n\nNo confirmation or physical interaction with the earbuds was required\nduring the pairing process.\n\nThe observed behavior is consistent with CVE-2025-20701.\n\nSecurity impact:\n\nA nearby attacker within Bluetooth range may be able to establish an\nunauthorized trusted relationship with the earbuds. The stored bond could\nallow subsequent connections from the unauthorized device and potentially\ninterfere with the legitimate user\u2019s Bluetooth connection.\n\nEvidence:\n\nThe public research repository includes:\n\n   - A detailed technical report\n   - Reproduction information\n   - Screenshots\n   - A sanitized BTSnoop capture\n   - A packet-level description of the pairing sequence\n\nRepository:\n\nhttps://github.com/x0jac0b0x/skullcandy-dime3-cve-2025-20701\n\nThe published BTSnoop capture preserves the pairing and connection\nsequence. The 16-byte BR/EDR link key was replaced with zero bytes before\npublication. The original, unmodified capture has been retained privately.\n\nThis research was conducted on hardware I own and is being published for\ndefensive research, independent verification, and vendor awareness.\n\nRegards,\n\nJacob Nowak\nIndependent Security Researcher\nGitHub: https://github.com/x0jac0b0x\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/7"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/7"
        },
        {
          "url": "https://github.com/x0jac0b0x"
        },
        {
          "url": "https://github.com/x0jac0b0x/skullcandy-dime3-cve-2025-20701"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/7"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Skullcandy Dime 3 unauthorized Bluetooth pairing behavior",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0143",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/7",
            "automated": true,
            "contentSha256": "76718710d96bdc9795176214e35243cb3e582c997a565fae63c5f0d93fde612b",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/7",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-28T20:00:34Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0143"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0141

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI) Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI). Type: Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (CWE-78) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Impact: Unauthenticated remote code execution on the analytics server, exposing process analytics data, notebooks, and platform keys. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/seeq-server-unauth-selfreg-datalab-jupyter-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Seeq Server R65.2.3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Seeq Server R65.2.3 (default deployment with Data \nLab installed via the official CLI).\n\nType: Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (CWE-78)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nImpact: Unauthenticated remote code execution on the analytics server, exposing process analytics data, notebooks, and \nplatform keys.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/seeq-server-unauth-selfreg-datalab-jupyter-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/100"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/100"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/seeq-server-unauth-selfreg-datalab-jupyter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/100"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Seeq Server R65.2.3 (default deployment with Data Lab installed via the official CLI) Unauthenticated RCE (open self-registration + Data Lab Jupyter missing authorization) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0141",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/100",
            "automated": true,
            "contentSha256": "105ea84f9cd82224ea3e42b5e5708b956ca112e15f91d8c876dcb50394528e88",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/100",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:12:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0141"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0136

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Delta DIAEnergie IEMS V1.11 Authenticated (conditional) SQL injection to VBScript RCE (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Delta DIAEnergie IEMS V1.11. Type: Authenticated (conditional) SQL injection to VBScript RCE (CWE-89) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact: Remote code execution in the CEBC service context, giving control of energy-management data and PLC connectivity in industrial facilities. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/delta-diaenergie-iems-postauth-commandtag-sqli-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Delta DIAEnergie IEMS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Delta DIAEnergie IEMS V1.11.\n\nType: Authenticated (conditional) SQL injection to VBScript RCE (CWE-89)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Remote code execution in the CEBC service context, giving control of energy-management data and PLC \nconnectivity in industrial facilities.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/delta-diaenergie-iems-postauth-commandtag-sqli-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/95"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/95"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/delta-diaenergie-iems-postauth-commandtag-sqli-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/95"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Delta DIAEnergie IEMS V1.11 Authenticated (conditional) SQL injection to VBScript RCE (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0136",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/95",
            "automated": true,
            "contentSha256": "0f9bac918acaeb844f5025ffc5671be63b6cf6a465a652545d4e3943651dc39f",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/95",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:11:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0136"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0133

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)
Summary
https://blog.evan.lat/posts/CVE-2026-65053/ the blog talks about two vulns that are chainable together. for the sake of brevity ill write up on the stored xss one. in lib/Mime/Status.php, we see a pretty viable xss sink: $out .= '<tr><td>' . $val . '</td></tr>'; xrefing this we see that most impls are sanitized with the exception of lib/Mime/Viewer/Appledouble.php: $data_name = $this->getConfigParam('imp_contents')->getPartName($data_part); // ... sprintf(_("This message contains a Macintosh file (named \"%s\")."), $data_name) exploiting this is trivial obviously. we just need to craft an email like this: From: d () x com To: victim () target com Subject: mac file MIME-Version: 1.0 Content-Type: multipart/appledouble; boundary="BOUND" --BOUND Content-Type: application/applefile Content-Transfer-Encoding: base64 cmVzb3VyY2UtZm9yay1ieXRlcw== --BOUND Content-Type: application/octet-stream; name="<img src=x onerror=alert('hi')>" Content-Disposition: attachment; filename="<img src=x onerror=alert('hu2')>" Content-Transfer-Encoding: base64 ZGF0YS1mb3JrLWJ5dGVz --BOUND-- given the nature of this xss it is very much wormable and turns our existing arb file read to a half click exploit. obviously we wouldnt really want to use a half click primitive just to read files (although grabbing db creds is very trivial with these two vulns chained), so naturally we can try to achieve rce with this xss worm primitive. to get an rce from this is easy. we can either target an admin or craft an xss worm thatll eventually reach an admin. admins can access a PHP shell which let us run arbitrary php code, so we can simply use the xss to hit the PHP shell at /horde/admin/phpshell.php this constitutes a half click since the user simply needs to click on the email to trigger the xss in question. an exp poc is provided in the blog. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version
unknown FD - Half-click Affected: unknown
Create a notification for this product.
Credits
Evan Tang
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FD - Half-click",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Evan Tang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "https://blog.evan.lat/posts/CVE-2026-65053/\n\nthe blog talks about two vulns that are chainable together. for the sake of\nbrevity ill write up on the stored xss one.\n\nin lib/Mime/Status.php, we see a pretty viable xss sink:\n\n$out .= \u0027\u003ctr\u003e\u003ctd\u003e\u0027 . $val . \u0027\u003c/td\u003e\u003c/tr\u003e\u0027;\n\nxrefing this we see that most impls are sanitized with the exception of\nlib/Mime/Viewer/Appledouble.php:\n\n$data_name = $this-\u003egetConfigParam(\u0027imp_contents\u0027)-\u003egetPartName($data_part);\n// ...\nsprintf(_(\"This message contains a Macintosh file (named \\\"%s\\\").\"),\n$data_name)\n\nexploiting this is trivial obviously. we just need to craft an email like\nthis:\n\nFrom: d () x com\nTo: victim () target com\nSubject: mac file\nMIME-Version: 1.0\nContent-Type: multipart/appledouble; boundary=\"BOUND\"\n\n--BOUND\nContent-Type: application/applefile\nContent-Transfer-Encoding: base64\n\ncmVzb3VyY2UtZm9yay1ieXRlcw==\n\n--BOUND\nContent-Type: application/octet-stream; name=\"\u003cimg src=x\nonerror=alert(\u0027hi\u0027)\u003e\"\nContent-Disposition: attachment; filename=\"\u003cimg src=x onerror=alert(\u0027hu2\u0027)\u003e\"\nContent-Transfer-Encoding: base64\n\nZGF0YS1mb3JrLWJ5dGVz\n\n--BOUND--\ngiven the nature of this xss it is very much wormable and turns our\nexisting arb file read to a half click exploit. obviously we wouldnt really\nwant to use a half click primitive just to read files (although grabbing db\ncreds is very trivial with these two vulns chained), so naturally we can\ntry to achieve rce with this xss worm primitive.\n\n\nto get an rce from this is easy. we can either target an admin or craft an\nxss worm thatll eventually reach an admin. admins can access a PHP shell\nwhich let us run arbitrary php code, so we can simply use the xss to hit\nthe PHP shell at /horde/admin/phpshell.php\n\n\nthis constitutes a half click since the user simply needs to click on the\nemail to trigger the xss in question. an exp poc is provided in the blog.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/115"
        },
        {
          "url": "https://blog.evan.lat/posts/CVE-2026-65053/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/115"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0133",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/115",
            "automated": true,
            "contentSha256": "994cae962871473fc31c842afa1725265e1e9be8bc37bb82c27388c4c46efad8",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/115",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T16:24:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0133"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0132

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits
Summary
I came across a project, "0day Rubbish", that states it will continuously disclose 0-day vulnerabilities discovered by an AI-driven research process (a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each vulnerability the project publishes a full technical analysis together with a working exploit script and step-by-step reproduction instructions. The project's content is hosted at: https://0day-rubbish.com/blog The first batch already covers ten previously undisclosed vulnerabilities across eight enterprise products, ranging from CVSS 7.3 to 9.8. The list below summarises them for the community's awareness. The vulnerabilities, in descending CVSS order: 1. InterSystems IRIS - FolderManager Property Injection RCE - Product: InterSystems IRIS - Version: 2026.1.0.234.1 (Community Edition); versions sharing the FolderManager / broker surface - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Class: Unauthenticated remote code execution - Link: https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce 2. AdRem NetCrunch - Cross-Session Hijack RCE - Product: AdRem NetCrunch (Windows network monitoring) - Version: 16.0.0.8397 RC; versions sharing the Node.js session-reuse path - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - Class: Unauthenticated remote code execution (SYSTEM) - Link: https://0day-rubbish.com/blog/adrem-netcrunch-session-hijack-rce 3. Altus BluePlant - Hardcoded Credentials RCE - Product: Altus BluePlant (SCADA HMI / ICS software) - Version: 9.1.40; versions sharing the T.InfoService.Service / FileServer.RunProcess path - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - Class: Unauthenticated remote code execution - Link: https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce 4. Brekeke SIP Server - Unauthenticated Nashorn JS Engine RCE - Product: Brekeke SIP Server (SIP Proxy / Registrar) - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the ProvisioningTest bean - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Class: Unauthenticated remote code execution - Link: https://0day-rubbish.com/blog/brekeke-sip-server-nashorn-rce 5. Brekeke SIP Server - Unauthenticated Zip Slip Webshell RCE - Product: Brekeke SIP Server - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the ProvisioningModelImport / Zip.extractAll code - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Class: Unauthenticated remote code execution (Zip Slip) - Link: https://0day-rubbish.com/blog/brekeke-sip-server-zipslip-rce 6. DataSunrise Suite - Email Verification Code Brute Force RCE - Product: DataSunrise Suite - Version: 11.2.17.12820; versions sharing the forgotten-password flow - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Class: Unauthenticated remote code execution - Link: https://0day-rubbish.com/blog/datasunrise-email-bruteforce-rce 7. Brekeke SIP Server - Authentication Fail-Open Primitive - Product: Brekeke SIP Server - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the ScopeBean.checkScope() framework - CVSS: 9.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - Class: Authentication bypass exposing 23 unauthenticated beans - Link: https://0day-rubbish.com/blog/brekeke-sip-server-auth-failopen 8. Acumatica ERP - Customization Publish Webshell RCE - Product: Acumatica ERP (.NET ERP platform) - Version: 2026 R1 (build 26.101.0225); versions sharing the CstRollbackList.WriteFile / CstFileWriter.UpdateFile publish path - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - Class: Authenticated remote code execution (webshell via path traversal in customization publish) - Link: https://0day-rubbish.com/blog/acumatica-customization-webshell-rce 9. AdRem NetCrunch - Startup Script RCE - Product: AdRem NetCrunch - Version: 16.0.0.8397 RC; versions exposing the INcStartupScript.SetScriptOptions / INetCrunchServer.RestartNCServer RPC - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - Class: Authenticated remote code execution (SYSTEM) - Link: https://0day-rubbish.com/blog/adrem-netcrunch-startup-script-rce 10. Altus iX Developer - XAML Deserialization RCE - Product: Altus iX Developer (SCADA HMI engineering IDE) - Version: 2.53.65422; versions sharing the ScreenXamlSerializer / XamlReader.Load path - CVSS: 7.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - Class: Local / user-interaction remote code execution via malicious screen file - Link: https://0day-rubbish.com/blog/altus-ix-developer-xaml-rce Observations on the project's disclosure posture The project presents its work as defensive security research and, according to its own pages, operates a risk-driven disclosure model: it publishes full root-cause details, exploit code and reproduction steps so that vendors can verify and patch and defenders can detect and mitigate. Each advisory page includes a self-contained exploit script (Python or shell, pure standard library where possible) against a default or evaluation deployment of the affected product; the unauthenticated entries require no credentials beyond product defaults. The project attributes discovery to its automated AI research process. I am noting this only to characterise what the project says about itself; I make no claim about its disclosure ethics. Reference https://0day-rubbish.com/blog _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version
unknown A project is Affected: unknown
Create a notification for this product.
Credits
zz lin
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "A project is",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "zz lin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "I came across a project, \"0day Rubbish\", that states it will continuously\ndisclose 0-day vulnerabilities discovered by an AI-driven research process\n(a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each\nvulnerability the project publishes a full technical analysis together with\na working exploit script and step-by-step reproduction instructions. The\nproject\u0027s content is hosted at:\n\n    https://0day-rubbish.com/blog\n\nThe first batch already covers ten previously undisclosed vulnerabilities\nacross eight enterprise products, ranging from CVSS 7.3 to 9.8. The list\nbelow summarises them for the community\u0027s awareness.\n\nThe vulnerabilities, in descending CVSS order:\n\n1. InterSystems IRIS - FolderManager Property Injection RCE\n   - Product: InterSystems IRIS\n   - Version: 2026.1.0.234.1 (Community Edition); versions sharing the\n     FolderManager / broker surface\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce\n\n2. AdRem NetCrunch - Cross-Session Hijack RCE\n   - Product: AdRem NetCrunch (Windows network monitoring)\n   - Version: 16.0.0.8397 RC; versions sharing the Node.js session-reuse path\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution (SYSTEM)\n   - Link: https://0day-rubbish.com/blog/adrem-netcrunch-session-hijack-rce\n\n3. Altus BluePlant - Hardcoded Credentials RCE\n   - Product: Altus BluePlant (SCADA HMI / ICS software)\n   - Version: 9.1.40; versions sharing the T.InfoService.Service /\n     FileServer.RunProcess path\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce\n\n4. Brekeke SIP Server - Unauthenticated Nashorn JS Engine RCE\n   - Product: Brekeke SIP Server (SIP Proxy / Registrar)\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ProvisioningTest bean\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-nashorn-rce\n\n5. Brekeke SIP Server - Unauthenticated Zip Slip Webshell RCE\n   - Product: Brekeke SIP Server\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ProvisioningModelImport / Zip.extractAll code\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution (Zip Slip)\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-zipslip-rce\n\n6. DataSunrise Suite - Email Verification Code Brute Force RCE\n   - Product: DataSunrise Suite\n   - Version: 11.2.17.12820; versions sharing the forgotten-password flow\n   - CVSS: 9.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Unauthenticated remote code execution\n   - Link: https://0day-rubbish.com/blog/datasunrise-email-bruteforce-rce\n\n7. Brekeke SIP Server - Authentication Fail-Open Primitive\n   - Product: Brekeke SIP Server\n   - Version: v3.19.1.8p1 (Evaluation Edition); versions sharing the\n     ScopeBean.checkScope() framework\n   - CVSS: 9.1 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\n   - Class: Authentication bypass exposing 23 unauthenticated beans\n   - Link: https://0day-rubbish.com/blog/brekeke-sip-server-auth-failopen\n\n8. Acumatica ERP - Customization Publish Webshell RCE\n   - Product: Acumatica ERP (.NET ERP platform)\n   - Version: 2026 R1 (build 26.101.0225); versions sharing the\n     CstRollbackList.WriteFile / CstFileWriter.UpdateFile publish path\n   - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Authenticated remote code execution (webshell via path traversal\n     in customization publish)\n   - Link: https://0day-rubbish.com/blog/acumatica-customization-webshell-rce\n\n9. AdRem NetCrunch - Startup Script RCE\n   - Product: AdRem NetCrunch\n   - Version: 16.0.0.8397 RC; versions exposing the\n     INcStartupScript.SetScriptOptions / INetCrunchServer.RestartNCServer RPC\n   - CVSS: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n   - Class: Authenticated remote code execution (SYSTEM)\n   - Link: https://0day-rubbish.com/blog/adrem-netcrunch-startup-script-rce\n\n10. Altus iX Developer - XAML Deserialization RCE\n    - Product: Altus iX Developer (SCADA HMI engineering IDE)\n    - Version: 2.53.65422; versions sharing the ScreenXamlSerializer /\n      XamlReader.Load path\n    - CVSS: 7.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n    - Class: Local / user-interaction remote code execution via malicious\n      screen file\n    - Link: https://0day-rubbish.com/blog/altus-ix-developer-xaml-rce\n\nObservations on the project\u0027s disclosure posture\n\nThe project presents its work as defensive security research and, according\nto its own pages, operates a risk-driven disclosure model: it publishes full\nroot-cause details, exploit code and reproduction steps so that vendors can\nverify and patch and defenders can detect and mitigate. Each advisory page\nincludes a self-contained exploit script (Python or shell, pure standard\nlibrary where possible) against a default or evaluation deployment of the\naffected product; the unauthenticated entries require no credentials beyond\nproduct defaults. The project attributes discovery to its automated AI\nresearch process. I am noting this only to characterise what the project\nsays about itself; I make no claim about its disclosure ethics.\n\nReference\n\n    https://0day-rubbish.com/blog\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/29"
        },
        {
          "url": "https://0day-rubbish.com/blog"
        },
        {
          "url": "https://0day-rubbish.com/blog/acumatica-customization-webshell-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/adrem-netcrunch-session-hijack-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/adrem-netcrunch-startup-script-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/altus-blueplant-hardcoded-creds-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/altus-ix-developer-xaml-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-auth-failopen"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-nashorn-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/brekeke-sip-server-zipslip-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/datasunrise-email-bruteforce-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/intersystems-iris-foldermanager-rce"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/29"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "A project is publishing full analyses of AI-discovered 0-days - first batch of 10 with reproducible exploits",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0132",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/29",
            "automated": true,
            "contentSha256": "2a689626266cca1096e02bb03c064160976b85cb4dccd4192c36451b1ea5ea1f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/29",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-21T09:13:14Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0132"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 401 - 410 publications in total 445