Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext / \nGraphwise). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nOntotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter \nchain. As a result, /rest/repositories/ruleset/upload and /repositories/* are anonymously reachable. A .pie ruleset \nupload is compiled at runtime by the system javac and loaded into the server process. RuleCompilerBase.compilePrefices \ninlines the namespace prefix verbatim into the generated Java source with only .trim() and no validation. An attacker \ninjects Java code in the prefix; creating a graphdb:Sail repository triggers infer.initialize(), which executes the \ninjected Runtime.exec as the GraphDB process user (root). No authentication and no license are required. Dynamically \nverified with uid=0(root).\n\nImpact: Full host compromise as root (the GraphDB process user); the attacker can read any file, execute arbitrary \ncommands, and take full control of the GraphDB host and its repositories.\n\nAdvisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/53"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/53"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0116",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53",
            "automated": true,
            "contentSha256": "d1819df0ca4a56f1374c818730f46e330e087eab2119aa5cb776a0327e2b620d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/53",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0116"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax Enterprise (DSE) 6.8.49 (DataStax). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nDataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The default configuration has the \ngremlin_server authentication section commented out, which means TinkerPop\u0027s default allowAll authenticator - no \nauthentication. The gremlin-groovy sandbox is enabled by default, but the sandbox only wraps the top-level submitted \nscript; groovy.lang.Script.evaluate(String) creates a fresh GroovyShell with a default CompilerConfiguration that does \nnot include the SandboxTransformer, so a nested string is compiled and executed sandbox-free. An attacker submits \nthis.evaluate(\"\u003cnested script\u003e\"); the nested script runs [\"/bin/sh\",\"-c\",\"\u003ccmd\u003e\"].execute().text, executing arbitrary \nsystem commands as the dse user. Dynamically verified.\n\nImpact: Full read of the host filesystem and configuration as the dse user, arbitrary OS command execution, and full \ncontrol of the DSE host and database services.\n\nAdvisory: https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/52"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/52"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0115",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52",
            "automated": true,
            "contentSha256": "5ec0b7b6a449fe6c6ef6f431db1ba851139eebc509d63d4ab9842a6b8701f2b6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/52",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:02:47Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0115"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Icewarp Server",
          "vendor": "Icewarp",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] IceWarp Server 14.3.0 Authenticated config write + unauthenticated trigger (UNC DLL loading) \n(9.0)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in IceWarp Server 14.3.0.\n\nType: Authenticated config write + unauthenticated trigger (UNC DLL loading) (CWE-426)\nCVSS: 9.0 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)\nImpact: Remote SYSTEM code execution on the mail server once a server administrator writes the malicious filter \nconfiguration. The attacker gains full control of the mail host, including mail stores and credentials.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/icewarp-unc-dll-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/46"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/46"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/icewarp-unc-dll-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/46"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] IceWarp Server 14.3.0 Authenticated config write + unauthenticated trigger (UNC DLL loading) (9.0)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0067",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/46",
            "automated": true,
            "contentSha256": "199c950a5c688e031df27b7031e0215186bc26e13007753ad11477092617702a",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/46",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:25:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:50:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0067"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Platform",
          "vendor": "Hivemq",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] HiveMQ Platform 4.54.0 Pre-authentication RCE (default credentials + Zip-Slip) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in HiveMQ Platform 4.54.0.\n\nType: Pre-authentication RCE (default credentials + Zip-Slip) (CWE-22)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Full host compromise as root on root-run deployments; at minimum arbitrary file write as the HiveMQ user on \nhardened deployments. An attacker can disrupt IoT messaging infrastructure and execute arbitrary commands on the host.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/hivemq-zipslip-cron-root-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/43"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/43"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/hivemq-zipslip-cron-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/43"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] HiveMQ Platform 4.54.0 Pre-authentication RCE (default credentials + Zip-Slip) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0065",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/43",
            "automated": true,
            "contentSha256": "043834b124a5adec7a831c8ce59049e29a385ee308bc0536e84d4ef9524c7596",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/43",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:24:46Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:50:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0065"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2\n\nmacOS Tahoe 26.6.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148281.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Tahoe\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nmacOS Tahoe 26.6.2 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg+oACgkQ4Ifiq8DH\n7PWG8RAAj5K07fb3nf4q9cM3iv9IMLsix0MY6YmhhmzMyuNt1RCOrYRYlKbupgI4\n0ANdkreGcpUwdDLUmJGG4NZY172uOolWCa46PvI5XD6Obikp4REYndtn7ohOYRx1\n1haRwYVAWi6oe5PVQB6WUUA7jI2cIEba3ZIoK0eSjVtuurZEslq6nBIImyFuDesU\n/u7LaSnfkazIALDREjhUF/6Ii1xm3qZr5P4h6k9uK4+wcMoBOQHUXdJymT/jNa+d\n8A384E2Mc/y93ya6DQDCoZzshhiWzA9B0jd+pEefKrSZBpVhzVniAlXAS1nqQN+n\nbZjSjT6NTAQ5QsttEu5Ki8VXy1MnknUHE0WgG94qQCqHndIo1XEScBmdk8VPffht\noE5v8zQ5rJkLFu4zriTtWx4JmgI6TukwgvQOLA8AtfW19VJbamqDKkQHMrtF6hNG\nDtgFA9+ooFwZEwlyieW46HrvQqZ596IVDgdaTOoVJa12osQpSfGp46qYtej4waWU\nKqr3LSva5E/kw9jpLrIua0Tfjd0yluqXS7IziACFo1T836WFyl09eg+rhCutXHB/\nQgcAuDG+hVl59tclNWBVQDHoLsENfpK9ujExnS1h8d3fLhAScxRM+2j/nNByNsat\nUfzl4d8RejGkpvrjp/+IVL5iyDg0XuDLZ45X3aa6jbN+HbwropA=\n=n5Vc\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/44"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148281"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/44"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-43794",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43795",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64715",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64778",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64779",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64780",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64781",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64782",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64784",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64788",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65330",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65331",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65332",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65333",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65334",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65335",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65336",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65337",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65338",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65339",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65340",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65341",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65343",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65346",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65347",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65349",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65351",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0286",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44",
            "automated": true,
            "contentSha256": "e3a4df71fa6333a412bb8c1d65c5707dbaebe35105df29945390db6bcf38320d",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/44",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:02:19Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0286"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:45Z",
    "dateUpdated": "2026-09-11T11:50:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0286"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Tahoe",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2\n\nmacOS Tahoe 26.6.2 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/148281.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAudio\nAvailable for: macOS Tahoe\nImpact: An app may be able to leak sensitive user information\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-65339: Meta Red Team X - Nik Tsytsarkin\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to a denial-of-service\nDescription: The issue was addressed with improved checks.\nCVE-2026-65347: Geonha Lee (@leegn4a)\n\nImageIO\nAvailable for: macOS Tahoe\nImpact: Processing an image may lead to arbitrary code execution\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65346: Meta Red Team X - Nik Tsytsarkin\n\nIOGPUFamily\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-64788: f00l (@PPPF00L) and 3ndy1(@_3ndy1) and Minghao\nLin@Y1nkoc and \u4e91\u6563\u82b1\u6298, Arjanit Isufi\n\nKernel\nAvailable for: macOS Tahoe\nImpact: A remote attacker may be able to cause unexpected system\ntermination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65343: Drinor Selmanaj (Sentry), Surya Narayan Kushwaha\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\nread kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation.\nCVE-2026-65349: an anonymous researcher\n\nKernel\nAvailable for: macOS Tahoe\nImpact: An app may be able to cause unexpected system termination or\ncorrupt kernel memory\nDescription: The issue was addressed with improved memory handling.\nCVE-2026-65330: Bhaswanth Chigurupati, Billy Jheng Bing Jhong and Pan\nZhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: An out-of-bounds access issue was addressed with improved\nbounds checking.\nWebKit Bugzilla: 317632\nCVE-2026-64784: Janggoon Lee of Out of Bounds, OpenAI Codex Security -\nAmy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 313452\nCVE-2026-43795: wwwlk\nWebKit Bugzilla: 318348\nCVE-2026-65338: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: The issue was addressed with improved memory handling.\nWebKit Bugzilla: 318405\nCVE-2026-65341: Henock Habte\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321480\nCVE-2026-64782: Seonwook Kim, Shubham Chaskar, lattice, Josef Korbel\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved input validation.\nWebKit Bugzilla: 321484\nCVE-2026-64781: Thomas Guillem\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: This issue was addressed through improved state management.\nWebKit Bugzilla: 321517\nCVE-2026-65351: Niels Hofmans\nWebKit Bugzilla: 316996\nCVE-2026-65340: Claudio Bozzato and Francesco Benvenuto of Cisco Talos,\nJosef Korbel (Citadelo)\nWebKit Bugzilla: 317142\nCVE-2026-65337: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317349\nCVE-2026-65336: Josef Korbel\nWebKit Bugzilla: 316723\nCVE-2026-65335: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317603\nCVE-2026-65333: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317450\nCVE-2026-65332: OpenAI Codex Security - Amy Burnett\nWebKit Bugzilla: 317611\nCVE-2026-65331: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process crash\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 316347\nCVE-2026-64715: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 316918\nCVE-2026-64780: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved state\nmanagement.\nWebKit Bugzilla: 316791\nCVE-2026-65334: OpenAI Codex Security - Amy Burnett\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to memory\ncorruption\nDescription: A memory corruption issue was addressed with improved\nmemory handling.\nWebKit Bugzilla: 317317\nCVE-2026-43794: Dung Do (@_piers2) of Calif.io\n\nWebKit\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected process termination\nDescription: A use-after-free issue was addressed with improved memory\nmanagement.\nWebKit Bugzilla: 313703\nCVE-2026-64787: \u6749\u5c71 \u58ee\u592a, Shubham Chaskar\n\nWebKit History\nAvailable for: macOS Tahoe\nImpact: Visiting a maliciously crafted website may leak sensitive data\nDescription: The issue was addressed with improved checks.\nWebKit Bugzilla: 315528\nCVE-2026-64778: Mohit Negi\n\nWebKit Storage\nAvailable for: macOS Tahoe\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption vulnerability was addressed with\nimproved locking.\nWebKit Bugzilla: 321485\nCVE-2026-64779: Shubham Chaskar, Tommy DeVoss from Braze Security Team\n(@thedawgyg)\n\nAdditional recognition\n\nCompression\nWe would like to acknowledge Tommy DeVoss from Braze Security Team\n(@thedawgyg) for their assistance.\n\nlibcryptex\nWe would like to acknowledge Ashish Kunwar for their assistance.\n\nWebKit\nWe would like to acknowledge Henock Habte for their assistance.\n\nmacOS Tahoe 26.6.2 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqDg+oACgkQ4Ifiq8DH\n7PWG8RAAj5K07fb3nf4q9cM3iv9IMLsix0MY6YmhhmzMyuNt1RCOrYRYlKbupgI4\n0ANdkreGcpUwdDLUmJGG4NZY172uOolWCa46PvI5XD6Obikp4REYndtn7ohOYRx1\n1haRwYVAWi6oe5PVQB6WUUA7jI2cIEba3ZIoK0eSjVtuurZEslq6nBIImyFuDesU\n/u7LaSnfkazIALDREjhUF/6Ii1xm3qZr5P4h6k9uK4+wcMoBOQHUXdJymT/jNa+d\n8A384E2Mc/y93ya6DQDCoZzshhiWzA9B0jd+pEefKrSZBpVhzVniAlXAS1nqQN+n\nbZjSjT6NTAQ5QsttEu5Ki8VXy1MnknUHE0WgG94qQCqHndIo1XEScBmdk8VPffht\noE5v8zQ5rJkLFu4zriTtWx4JmgI6TukwgvQOLA8AtfW19VJbamqDKkQHMrtF6hNG\nDtgFA9+ooFwZEwlyieW46HrvQqZ596IVDgdaTOoVJa12osQpSfGp46qYtej4waWU\nKqr3LSva5E/kw9jpLrIua0Tfjd0yluqXS7IziACFo1T836WFyl09eg+rhCutXHB/\nQgcAuDG+hVl59tclNWBVQDHoLsENfpK9ujExnS1h8d3fLhAScxRM+2j/nNByNsat\nUfzl4d8RejGkpvrjp/+IVL5iyDg0XuDLZ45X3aa6jbN+HbwropA=\n=n5Vc\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/44"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/148281"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/44"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-17-2026-3 macOS Tahoe 26.6.2",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0035",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/44",
            "automated": true,
            "contentSha256": "e3a4df71fa6333a412bb8c1d65c5707dbaebe35105df29945390db6bcf38320d",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/44",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T22:02:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:50:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0035"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linux open",
          "vendor": "Openzfs",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erica Windisch"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "I am hopeful that upstream patches and remediation guidance will be\navailable soon. I have been sitting on these for a bit, and have run this\nthrough AI services hosted in Singapore and the United States, and had\nnotified CERT on 8/12/2026. In order to minimize the risk of asymmetric\nknowledge of these threats being used against defenders, I am opting for\nfull-disclosure.\n\nCheers from HOPE\n\n--Bird\n\n## Report metadata\n\n- **Product:** OpenZFS on Linux (`spl.ko` and `zfs.ko`; out-of-tree and not\n  part of the Linux kernel source tree)\n- **OpenZFS revision audited:** `9b7642df931a765509403318553f2910daf71305`\n  (development version `2.4.99-1`, commit title \"Harden recv record\nvalidation\")\n- **Linux validation kernel:** `7.2.0-rc3-00275-gaf5e34a41cd6`\n- **Validation environments:** disposable QEMU guest with generic KASAN and\n  `CONFIG_KASAN_VMALLOC=y`; a stock IncusOS appliance guest for\n  deployment-level authorization/volume-swap validation; disposable QEMU\n  appliance VMs for Proxmox VE, TrueNAS SCALE, and Unraid dynamic\nreachability\n  testing. Release-mode OpenZFS modules unless stated otherwise.\n- **Research dates:** 2026-07-17 through 2026-07-25\n- **Report updated:** 2026-07-25\n- **Reporter:** Erica Windisch\n- **Tracker umbrella:** [issue #26](\nhttps://github.com/ewindisch/linux-research-tracker/issues/26)\n\nAll kernel execution used disposable QEMU/cloud-hypervisor guests \u2014 the\nKASAN\nresearch guest or the stock IncusOS appliance guest. Host-side work was\nlimited\nto building, offline image construction, and driving those guests.\n\n### Revision notes\n\n- **2026-07-25 (validation-chain results):** OZ-3c and OZ-6 move from\n  **LIKELY** to **VALIDATED** with dynamic triggers in the KASAN guest\n  (OZ-3c: UBSAN array-index-out-of-bounds at `zfs_replay.c:115`; OZ-6: KASAN\n  null-ptr-deref in `vdev_is_concrete` and slab-out-of-bounds in\n  `spa_ld_log_sm_cb`). QNAP QZFS static analysis validates\nZ1/Z2/dnode-bonus S3\n  and gang overrun, and BLOCKS log-spacemap S4 (feature absent). The\nupstream\n  patch audit confirms every OZ finding remains **UNFIXED** at upstream\nmaster\n  HEAD `3020c18c` (2026-07-24); only OZ-7 has an open, contested PR\n(#18620).\n  Full audit:\n[`research/upstream-patch-audit.md`](../research/upstream-patch-audit.md).\n- **2026-07-25 (OZ-4 on Proxmox VE):** the Proxmox VE 8.x OZ-4 cell is\nupgraded\n  from provisional to a confirmed dynamic verdict. On `6.8.12-37-pve` /\n  OpenZFS `2.2.10-pve1`, importing the armed dnode-bonus pool (`dn_bonuslen=\n  0x400`, `zfs-77-d77-s3v2.img`) **from inside the delegated LXC container**\n  (CT100 with the OZ-1 verified `/dev/zfs` passthrough) fired the\n  `dbuf_read_bonus` overflow on `spa_tryimport \u2192 spa_load \u2192\n  spa_ld_trusted_config` and crashed the kernel (NULL-deref in `strcmp`\nduring\n  `vdev_open_children_impl`; host-side corroboration showed SLUB\n`LIST_POISON`\n  heap corruption in `dbuf_sync_list`). OZ-4 is therefore **VIABLE from the\n  delegated/privileged container** and **BLOCKED by default** (default\n  unprivileged LXC has no `/dev/zfs`). A container\u2192root shell was not\n  reproduced on the stock appliance (release kernel faults\ndeterministically;\n  no KASLR leak). Full verdict and evidence:\n  `linux-research/.fleet-coord/oz4-proxmox-verdict.md`;\n\n`linux-research/appliance-harness/proxmox-ve/runs/20260725T150254Z/evidence/`.\n- **2026-07-25 (OZ-4 on Unraid):** the Unraid 7.3.0 OZ-4 cell is upgraded\nfrom\n  provisional to a confirmed dynamic verdict. On `6.18.29-Unraid` / OpenZFS\n  `2.4.1-1`, importing the inflated-bonus pool (`dn_bonuslen=0x1000`,\n  `zfs-77-d77-s3v3.img`) from a `--privileged` Docker container fails\n  `insufficient replicas` while the structurally identical clean control\n  imports ONLINE; the kernel survives (silent heap corruption, no\npanic/Oops).\n  OZ-4 is therefore **VIABLE from `--privileged`** and **BLOCKED** by\ndefault\n  and `--device /dev/zfs` (no `/dev/zfs` / no `CAP_SYS_ADMIN`). A\ncontainer\u2192root\n  shell was not pursued (requires heap grooming + KASLR bypass). Full\nverdict\n  and evidence: `linux-research/.fleet-coord/oz4-unraid-verdict.md`;\n  `linux-research/appliance-harness/unraid/runs/20260725T150925Z/evidence/`.\n- **2026-07-25 (OZ-4 OCI delivery on IncusOS):** an OCI image\n  (`oz4-delivery:latest`) carrying the armed pool (`d77.img`) was built with\n  podman, repacked as an Incus image, and launched as a default unprivileged\n  Incus container on IncusOS `202607192224` (OpenZFS `2.4.3-1`). The\ncontainer\n  received `/dev/zfs` and the ioctls were authorized (OZ-1 reachability\n  **VIABLE**), but the host kernel could not open the file vdev at the\n  container-relative path (`/opt/d77.img`), so the OZ-4 overflow never fired\n  (**BLOCKED** for the in-container E2E fire). IncusOS\u0027s shell-less design\n  removes the host-side bind-mount escape hatch that made the fire possible\non\n  Proxmox VE. Full verdict and evidence:\n  `linux-research/.fleet-coord/oz4-oci-incusos-verdict.md`;\n  `linux-research/incusos-spike/runs/20260725-oz4-oci/evidence/`.\n- **2026-07-25 (OZ-4 OCI delivery on TrueNAS SCALE):** the same OCI image\n  (`oz4-delivery:latest`) was launched as a default unprivileged Incus\n  container on TrueNAS SCALE 25.04.2.4. The entrypoint auto-fired the import\n  ioctl, but the host kernel could not open the container-relative file vdev\n  (`/opt/d77.img`), so the OZ-4 overflow never fired (**BLOCKED**). This\n  refines the prior TrueNAS host-side **VIABLE** verdict: the overflow is\n  reachable from a host path, but not from a self-contained OCI image in a\n  default container. Full verdict and evidence:\n  `linux-research/.fleet-coord/oz4-oci-truenas-verdict.md`;\n\n`linux-research/appliance-harness/truenas-scale/runs/20260725T190000Z/evidence/`.\n- **2026-07-25 (OZ-4 on TrueNAS):** the Dynamically tested appliances table\n  gains an **OZ-4 column**. TrueNAS SCALE 25.04.2.4 (running OpenZFS\n  `2.3.0-1`) is **VIABLE** for OZ-4 from the default unprivileged container:\n  the armed dnode-bonus pool imported ONLINE with no error erevent\n(oversized\n  `dn_bonuslen` accepted, not rejected) on the production non-KASAN kernel,\n  and the same image fired `Write of size 1024 in dbuf_read_impl` via\n  `spa_tryimport` under KASAN. The kernel survives the corruption; a\n  container\u2192root shell is not demonstrated (neighbor-lottery + KASLR, as in\n  the 77b campaign). Proxmox VE and Unraid OZ-4 cells are marked\n**BLOCKED** by\n  default pending their sibling fleet validation tasks. Full verdict and\n  evidence path: `linux-research/.fleet-coord/oz4-truenas-verdict.md`.\n- **2026-07-25 (OZ-4 OCI delivery, round 2 \u2014 VALIDATED on TrueNAS SCALE and\n  Unraid):** the malicious-OCI-image vector is upgraded from **BLOCKED** to\n  **VALIDATED** on two appliances. The round-1 blocker was that the host\n  kernel\u0027s `vdev_file_open` resolves vdev paths in the host mount namespace,\n  so a container-internal `/opt/d77.img` is never opened. Round 2 defeats\nthis\n  with an **identical-path host bind mount** (the image entrypoint stages\nits\n  embedded armed pool onto a bind-mounted host path visible at the same\n  absolute path in both namespaces, then imports from that path). On\n**TrueNAS\n  SCALE 25.04.2.4** the vector fires from a **default unprivileged** Incus\n  container (no `security.privileged`, no explicit device add \u2014 only the\n  default `/dev/zfs`, an identical-path `disk` bind, and a `1777` host\nstaging\n  path): the armed import **panicked the production kernel** (GPF in\n  `__kmalloc` on the `spa_tryimport \u2192 spa_config_generate` path, crashing\ntask\n  `Comm: zpool` as the container\u0027s mapped uid in `ZFS_IOC_POOL_TRYIMPORT`),\n  while the structurally identical clean control imported ONLINE. On\n**Unraid\n  7.3.0** the image-carried payload fires via `docker run --privileged` (the\n  required and sufficient capability); the negative control showed the bind\n  mount is not even required under Unraid\u0027s `vfs` storage driver. The Unraid\n  result is **expected behavior** \u2014 a `--privileged` container holds full\nhost\n  capabilities by design \u2014 and is retained for matrix completeness only; it\nis\n  not scored as a finding. The TrueNAS round-2 fire is the significant\nresult,\n  but note its two deployment concessions: an identical-path host bind and a\n  world-writable host staging path must be granted to the container (as an\napp\n  manifest\u0027s hostPath grant would provide). The Unraid kernel survives\n(silent\n  corruption \u2192 `insufficient replicas`); the TrueNAS\n  crash is a **reliable image-delivered container\u2192host-kernel DoS** \u2014 no\nheap\n  grooming required. IncusOS remains **BLOCKED** for this vector (shell-less\n  appliance; no host bind-mount escape hatch). Full verdicts and evidence:\n  `linux-research/.fleet-coord/oz4-oci-truenas2-verdict.md`,\n  `linux-research/.fleet-coord/oz4-oci-unraid-verdict.md`;\n\n`linux-research/appliance-harness/truenas-scale/runs/20260725T193000Z/evidence/`,\n  `linux-research/appliance-harness/unraid/runs/20260725T194343Z/evidence/`.\n- **2026-07-26 (OZ-4 OCI on IncusOS, round 2 \u2014 VALIDATED with ZERO host-side\n  setup):** IncusOS flips from the fleet\u0027s only **BLOCKED** to\n**VALIDATED**,\n  and the malicious-OCI-image vector now has a no-setup fire. The round-1\n  blocker (host kernel resolves vdev paths in the host mount namespace;\n  shell-less appliance precludes an admin bind mount) is defeated **without\n  any bind**: the container\u0027s own rootfs necessarily exists on the host at\nthe\n  predictable path\n`/var/lib/incus/storage-pools/local/containers/\u003cct\u003e/rootfs/`,\n  so the image\u0027s payload at `/opt/d77.img` is host-resolvable by\nconstruction.\n  A malicious OCI image launched as a **default unprivileged** container\n  (default profile only \u2014 no `security.privileged`, no device add, no bind)\n  carries a static raw `ZFS_IOC_POOL_TRYIMPORT` PoC (hand-packed nvlist,\n  libzfs bypassed; `linux-research/incusos-spike/oz4-tryimport.c`,\nzg-poolop.c\n  lineage) pointed at that host path; the ioctl is issued by **non-root uid\n  1000**, authorized via an image-controlled file capability\n  (`cap_sys_admin+ep` on the payload binary \u2014 an attacker image property,\nnot\n  an admin concession; verified differentially: cap cleared \u2192 `EPERM`). The\n  armed import **wedges the host kernel\u0027s ZFS load path and storage stack**\n  (`incusd` unresponsive, ioctl never returns; reproduced on a fresh\nkernel),\n  while the structurally identical clean control imports in \u003c1s. Negative\n  controls (wrong path, nonexistent path, cleared cap) all fail as expected.\n  On this kernel the overflow surfaces as a **wedge/storage-DoS** rather\nthan\n  TrueNAS\u0027s instant GPF-panic (heap-layout dependent); no root shell is\n  claimed. Attacker preconditions: get the victim to launch the image as a\n  default container; knowledge of the container name; nothing else. Full\n  verdict and evidence:\n  `linux-research/.fleet-coord/oz4-oci-incusos2-verdict.md`;\n  `linux-research/incusos-spike/runs/20260726-oz4-oci2/evidence/`.\n- **2026-07-26 (OZ-4 OCI on TrueNAS SCALE, round 3 \u2014 VALIDATED with ZERO\n  host-side setup, kernel panic):** the zero-wire rootfs-path vector fires\non\n  TrueNAS SCALE 25.04.2.4 as well, upgrading round 2\u0027s concession-laden\nfire.\n  A malicious OCI image launched as a **default unprivileged** Incus\ncontainer\n  (dir storage backend, default profile only \u2014 no privileged flag, no device\n  add, no bind, no host shell) carries the armed pool at `/opt/d77.img`, a\n  static raw-ioctl PoC (`oz4ti`, zg-poolop/xpl-107-poolop lineage), and a\n  **NATIVE-encoded** config nvlist naming the host-side rootfs path\n\n(`/var/lib/incus/storage-pools/default/containers/\u003cname\u003e/rootfs/opt/d77.img`,\n  fully derivable from appliance defaults + the attacker-chosen container\n  name). The import is issued by a **non-root** nested-userns user (host\n  `UID: 2147001001`). The armed import **panicked the production kernel**\n  (GPF in `__kmalloc` on `spa_tryimport \u2192 spa_load \u2192\n  spa_ld_load_special_directories`, corrupted SLUB freelist; crashing task\n  `Comm: oz4ti`), while the structurally identical clean control imported\n  `rc="
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:49:48Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/40"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/40"
        },
        {
          "url": "https://docs.qnap.com/operating-system/quts-hero/5.1.x/en-us/about-quts-hero-CAAE5DD0.html"
        },
        {
          "url": "https://documentation.ubuntu.com/lxd/latest/howto/initialize/"
        },
        {
          "url": "https://documentation.ubuntu.com/lxd/latest/reference/storage_zfs/"
        },
        {
          "url": "https://github.com/ewindisch/linux-research-tracker/issues/26"
        },
        {
          "url": "https://kernel.org/doc/html/next/process/threat-model.html"
        },
        {
          "url": "https://linuxcontainers.org/incus/docs/main/reference/devices_unix_char/"
        },
        {
          "url": "https://man7.org/linux/man-pages/man7/udev.7.html"
        },
        {
          "url": "https://nixos.org/manual/nixos/stable/"
        },
        {
          "url": "https://nixos.org/manual/nixos/stable/options"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/Alpine%20Linux/index.html"
        },
        {
          "url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubuntu/index.html"
        },
        {
          "url": "https://openzfs.github.io/openzfs-docs/Getting%20Started/index.html"
        },
        {
          "url": "https://packages.debian.org/trixie/zfs-dkms"
        },
        {
          "url": "https://pbs.proxmox.com/docs/installation.html"
        },
        {
          "url": "https://pbs.proxmox.com/docs/sysadmin.html#zfs-on-linux"
        },
        {
          "url": "https://raw.githubusercontent.com/openzfs/zfs/master/udev/rules.d/90-zfs.rules.in"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://wiki.alpinelinux.org/wiki/ZFS"
        },
        {
          "url": "https://wiki.ubuntu.com/Kernel/Reference/ZFS"
        },
        {
          "url": "https://www.first.org/cvss/v3.1/specification-document"
        },
        {
          "url": "https://www.first.org/cvss/v4.0/specification-document"
        },
        {
          "url": "https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html#device-controller"
        },
        {
          "url": "https://www.kernel.org/doc/html/latest/process/cve.html"
        },
        {
          "url": "https://www.qnap.com/en-us/how-to/faq/article/why-should-i-avoid-using-raw-zfs-cli-commands-on-my-quts-hero-nas"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/40"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "OpenZFS Linux open zpool manipulation and escapes via unprivileged userns",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0098",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/40",
            "automated": true,
            "contentSha256": "3e93a580885da758a6b60cad4fcaddf02d82917807680d207d1ed45e0a793d55",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/40",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-16T18:31:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:49:48Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0098"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LOMOSITS.Daniel via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reference: https://seclists.org/fulldisclosure/2026/Aug/5\n\nI tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two \nfindings.\n\n---\n\nVulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE\n\nThe ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:\n\n    WebMI login(root, bogus) -\u003e 200 {\"error\":-1,\"errorstring\":\"Invalid Session or Digest\"}\n        [+] root has a strong password (bogus login rejected)\n    [Step 1] OPC UA 4840 ActivateSession(root, bogus) -- authentication bypass\n    ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(\n      SymbolicId=None, NamespaceURI=None, Locale=None,\n      LocalizedText=None, AdditionalInfo=None,\n      InnerStatusCode=None, InnerDiagnosticInfo=None))\n    from server received in response to ActivateSessionRequest\n\nThe OPC UA backend rejects the bogus password and does not yield a superuser session, contrary to the advisory\u0027s claim \nthat logonSessionUser never calls the password-verification function.\n\nNote for anyone attempting independent reproduction: the advisory\u0027s license note discloses that the research was \nconducted against a binary-patched installation (patch 5: isLicensed() forced to 1; patch 6: session-count bypass). \nWhether OPC UA authentication behaviour differs between the patched binary and an unmodified licensed installation \nremains the open question. If the 0day Rubbish Research Team can clarify whether the ActivateSession step was verified \nagainst the original unpatched binary, that would help resolve the discrepancy.\n\n---\n\nVulnerability 2 (WebMI default-credential RCE, CVSS 8.8) - REPRODUCIBLE\n\nConfirmed. login(root, \u003cany value\u003e) returns {\"username\":\"root\"} on a factory-default installation. The handleLogin \n\u0027password not set\u0027 branch behaves exactly as described. Setting a strong root password via changepassword closes the \nbypass.\n\nMit freundlichen Gr\u00fc\u00dfen\nWith kind regards\n\nIng. Daniel Lomosits MSc MBA BSc\nProduct Manager\n\nP +43 (0)2682 / 75799-2829 M +43 (0) 676 / 702 80 87 | daniel.lomosits () bachmann info\u003cmailto:daniel.lomosits () \nbachmann info\u003e | www.bachmann-visutec.com\u003chttp://www.bachmann-visutec.com/\u003e\n\n[cid:image001.png@01DD2E3D.5EAA1330]\u003chttps://atvise.com/\u003e\n\nRegistered Office:\nBachmann Visutec GmbH, Kasernenstra\u00dfe 29, 7000 Eisenstadt, Austria\nFN 274018v Commercial Register Eisenstadt | ATU 62240738\nCorporate Headquarters:\nBachmann electronic GmbH, Kreuz\u00e4ckerweg 33, 6800 Feldkirch, Austria\nFN 75348g Commercial Register Feldkirch | ATU 36410905\n\nDokumente mit rechtsverbindlichem Inhalt sind nur mit Originalunterschrift wirksam.\nDocuments with legally binding subject matter are valid only with original hand-written signature.\n\nFollow Bachmann on  Facebook\u003chttps://www.facebook.com/Bachmann.electronic/\u003e |  \nLinkedIn\u003chttps://www.linkedin.com/company/bachmann-electronic-gmbh\u003e |  Twitter\u003chttps://twitter.com/bachmann_corp\u003e |  \nXing\u003chttps://www.xing.com/companies/bachmannelectronicgmbh\u003e |  \nYouTube\u003chttps://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg\u003e\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:49:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/39"
        },
        {
          "url": "http://www.bachmann-visutec.com/"
        },
        {
          "url": "https://atvise.com/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://twitter.com/bachmann_corp"
        },
        {
          "url": "https://www.facebook.com/Bachmann.electronic/"
        },
        {
          "url": "https://www.linkedin.com/company/bachmann-electronic-gmbh"
        },
        {
          "url": "https://www.xing.com/companies/bachmannelectronicgmbh"
        },
        {
          "url": "https://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg"
        },
        {
          "url": "mailto:daniel.lomosits"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/39"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0031",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39",
            "automated": true,
            "contentSha256": "b464e33cfb97e6aeb144887f62b793310a01e8e379d3f8eb9852a05dd2a1e3d3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/39",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T11:42:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:49:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0031"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9\n\nmacOS Sequoia 15.7.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148171.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sequoia\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sequoia 15.7.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp038cACgkQ4Ifiq8DH\n7PX5Lw/9GAmAP1eJuNJBxT5p4fvJjE3OltPezGlm65h7YURbVkA8+HOhDWUsL2Ky\nMafnodYGetgUbp8+6pJAC/cUJRPwV7UvUq64PGzAZK95+k4bwOMrsbehGZggsvxU\n9fvt+hx/hDZc8hflIYEYLsgpM9/RloUUFyp3jG3/MvR7zStaE2AlPahKfKs6BtvK\nUxJTNpo35dVMoFbv/OVxjcBrUnauC9hJnf/UwLAWIYhuDB0sojIWbkIRmpYmBDST\nDqdeEV9GJeF113ryzQV+xdoUxyEQVIKDCMfejgbuxVdRn6Q72SaJPrWPf2t9G86L\ndEW8jjISA5ZQfSezIq21Rj8LmYnyo0DOAZEdQOoCQa2McGsiT8KAsJDjY2+FB3H0\n8WVW+VQUWGIGHKY3Hjal7ytvNIeWIWTd6M3nYHHkqNPnQKCSM1bbqi6Qj0NHO/vL\nHcYiwMuBIlu970SgFNMttmrdZvks8JG1KI2GD18nNHRA2DC7eXqXiGPcK5QMX3ZB\nWpovpwHa1s15Sdx1pGM8LeWC5+6Qxo0zAkozKM440O58Z2N02ETFLUENQ6s8Q4Ah\nrCqdMCNP+IP3stoqfk5sFJq75bjfMruGqC4DfBJdDLmRIg7YZ7NaR3j9WZOMQfyO\n1dIV5ILTaIow0TeBFb6n9iC3SxvGvQQArtcIQkxO+LEBwakKj5M=\n=6Ozt\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148171"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/37"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65400",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0300",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37",
            "automated": true,
            "contentSha256": "26acdac926213e8f1719d54af58285bc35919794c339c3c79e698b1907bf4547",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/37",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:26Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0300"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-11T11:48:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0300"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9\n\nmacOS Sequoia 15.7.9 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/en-us/148171.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nScreen Sharing\nAvailable for: macOS Sequoia\nImpact: An attacker on the network may be able to authenticate to Screen\nSharing without valid credentials\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-65400: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io)\n\nmacOS Sequoia 15.7.9 may be obtained from the Mac App Store or Apple\u0027s\nSoftware Downloads web site: https://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmp038cACgkQ4Ifiq8DH\n7PX5Lw/9GAmAP1eJuNJBxT5p4fvJjE3OltPezGlm65h7YURbVkA8+HOhDWUsL2Ky\nMafnodYGetgUbp8+6pJAC/cUJRPwV7UvUq64PGzAZK95+k4bwOMrsbehGZggsvxU\n9fvt+hx/hDZc8hflIYEYLsgpM9/RloUUFyp3jG3/MvR7zStaE2AlPahKfKs6BtvK\nUxJTNpo35dVMoFbv/OVxjcBrUnauC9hJnf/UwLAWIYhuDB0sojIWbkIRmpYmBDST\nDqdeEV9GJeF113ryzQV+xdoUxyEQVIKDCMfejgbuxVdRn6Q72SaJPrWPf2t9G86L\ndEW8jjISA5ZQfSezIq21Rj8LmYnyo0DOAZEdQOoCQa2McGsiT8KAsJDjY2+FB3H0\n8WVW+VQUWGIGHKY3Hjal7ytvNIeWIWTd6M3nYHHkqNPnQKCSM1bbqi6Qj0NHO/vL\nHcYiwMuBIlu970SgFNMttmrdZvks8JG1KI2GD18nNHRA2DC7eXqXiGPcK5QMX3ZB\nWpovpwHa1s15Sdx1pGM8LeWC5+6Qxo0zAkozKM440O58Z2N02ETFLUENQ6s8Q4Ah\nrCqdMCNP+IP3stoqfk5sFJq75bjfMruGqC4DfBJdDLmRIg7YZ7NaR3j9WZOMQfyO\n1dIV5ILTaIow0TeBFb6n9iC3SxvGvQQArtcIQkxO+LEBwakKj5M=\n=6Ozt\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:48:28Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/37"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://support.apple.com/en-us/148171"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/37"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-08-06-2026-2 macOS Sequoia 15.7.9",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0100",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/37",
            "automated": true,
            "contentSha256": "26acdac926213e8f1719d54af58285bc35919794c339c3c79e698b1907bf4547",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/37",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-06T21:40:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:48:28Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0100"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}