Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy \nGmbH). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication)\n\nCinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that \ndeserializes .NET BinaryFormatter objects before the authorization handler runs. An unauthenticated remote attacker \nsends a TypeConfuseDelegate gadget frame; deserialization triggers Process.Start as LocalSystem. No authentication, no \nlicense gate, and a default inbound firewall rule make the service reachable in a default install. Dynamically verified.\n\nImpact: Full compromise of the broadcast and media-workflow automation host as LocalSystem. The attacker can disrupt \nbroadcast operations, execute arbitrary commands, and access media assets.\n\nAdvisory: https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/60"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/60"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (BinaryFormatter deserialization) in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0123",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60",
            "automated": true,
            "contentSha256": "8990a96469d6a144c8ca7f9fcafbbe13d8a0bec675d51d1a867783b2242c8792",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/60",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0123"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research \nis published and a proof-of-concept is available.\n\nPre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication)\n\nTelaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False, \nwhich is the default. The SaveVerifyActivity handler concatenates the sNotes parameter into an INSERT statement with no \nescaping. On a SQL Server backend with a sysadmin application account, an unauthenticated attacker uses a \nCOMMIT-breakout payload to enable xp_cmdshell and execute arbitrary commands as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the physical access-control and emergency-mustering system as LocalSystem. The attacker can \nalter badge records, forge or block entry events, and take over facility-security infrastructure.\n\nAdvisory: https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/67"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/67"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0130",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67",
            "automated": true,
            "contentSha256": "cec91faf2c741e53587ced1d8d970503d5a829e59e42ca3986170652b6ed94ee",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/67",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:06:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0130"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax Enterprise (DSE) 6.8.49 (DataStax). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nDataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The default configuration has the \ngremlin_server authentication section commented out, which means TinkerPop\u0027s default allowAll authenticator - no \nauthentication. The gremlin-groovy sandbox is enabled by default, but the sandbox only wraps the top-level submitted \nscript; groovy.lang.Script.evaluate(String) creates a fresh GroovyShell with a default CompilerConfiguration that does \nnot include the SandboxTransformer, so a nested string is compiled and executed sandbox-free. An attacker submits \nthis.evaluate(\"\u003cnested script\u003e\"); the nested script runs [\"/bin/sh\",\"-c\",\"\u003ccmd\u003e\"].execute().text, executing arbitrary \nsystem commands as the dse user. Dynamically verified.\n\nImpact: Full read of the host filesystem and configuration as the dse user, arbitrary OS command execution, and full \ncontrol of the DSE host and database services.\n\nAdvisory: https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/52"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/52"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0115",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52",
            "automated": true,
            "contentSha256": "5ec0b7b6a449fe6c6ef6f431db1ba851139eebc509d63d4ab9842a6b8701f2b6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/52",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:02:47Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0115"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)\n\nMidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and \nauth.servers commented out, making the JBoss Remoting layer network-reachable with no authentication. The invocation \nhandler accepts any connection and performs arbitrary-path file writes on the target host; writing a cron entry yields \nroot command execution. This is a shipped default-deployment template vulnerability. Dynamically verified.\n\nImpact: Full compromise of CI/CD target hosts as root. The attacker can overwrite deployed artifacts, inject trojans \ninto build and deploy pipelines, and take control of every managed server.\n\nAdvisory: https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/64"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/64"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0127",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64",
            "automated": true,
            "contentSha256": "fc0393166254f6d5713a53b47d9f607569d48138ab4898e4f9a03efadd28761f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/64",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0127"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax \nSoftware (Output Technology)). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)\n\nOutput Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection \nis treated as authenticated. Through linkserver registration and the file-transfer listener, an unauthenticated \nattacker uploads a crafted ZIP whose entries escape the plugin directory (Zip-Slip in SharpZipLib 0.85.4). On service \nrestart, the planted plugin constructor executes as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the on-premise enterprise instant-messaging server as LocalSystem. The attacker can read \ncorporate communications, execute arbitrary commands, and move laterally inside the office network.\n\nAdvisory: https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/65"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/65"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax Software (Output Technology))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0128",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65",
            "automated": true,
            "contentSha256": "1a92cd811d62d57463faa0478429c3f7161b89c57498277dd6b0195e0eb81e9d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/65",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0128"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE \nVernova). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)\n\nGE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage \nthe industrial wireless networks connecting substations and distribution automation. It ships with factory-default \nadmin/admin credentials with no forced password change, and the resource-management console builds the target file path \nby raw string concatenation with no normalization. Because Tomcat runs as root with autoDeploy enabled, an attacker can \nupload a JSP file into a new web application directory and execute arbitrary commands as root. Dynamically verified \nwith uid=0(root).\n\nImpact: Full compromise of the power-network management host as root. The attacker can read the host filesystem, \nexecute arbitrary commands, and gain control of the system a utility relies on to manage communications with its grid.\n\nAdvisory: https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/61"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/61"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0124",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61",
            "automated": true,
            "contentSha256": "9f220ea30cccbbd4ef2f593c8bfa113c8f77c77556b539fb712b77c2abe81c54",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/61",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0124"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, \nInc.). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nConfluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB \n(HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without \nauthentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB using FileStreamSinkConnector with an \nattacker-controlled file path and StringConverter, then produces arbitrary bytes to the subscribed Kafka topic through \nthe unauthenticated broker. The connector appends each message to the target file; writing a cron line to /etc/cron.d/ \nyields arbitrary command execution as root when crond runs. Dynamically verified with uid=0(root).\n\nImpact: Arbitrary command execution as root (the ksqlDB/Connect process user); the attacker can read or destroy data on \nthe host, persist access, and take full control of the Confluent deployment. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/55"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/55"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0118",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55",
            "automated": true,
            "contentSha256": "e7fed5aea4defd00047e128e708b62970bd2d623d56ed95d2584eebf55081902",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/55",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0118"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nWyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation \nis skipped (parse-only ReadToken) with a hardcoded integration client secret, producing an unauthenticated 10-year \nadmin reference token; the import endpoint allows a zip-slip arbitrary file write (a malicious DLL can be dropped into \nthe security-provider folder); and the security-provider loader scans DLLs and calls Activator.CreateInstance on the \nparameterless constructor, running as root. All three are reachable without credentials in the default configuration. \nDynamically verified with root RCE.\n\nImpact: Full host compromise as root (the dotnet container process); the attacker can read the host filesystem, execute \narbitrary commands, and take full control of the Wyn server.\n\nAdvisory: https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/59"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/59"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0122",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59",
            "automated": true,
            "contentSha256": "22d821eb4cbc90b4cd35522f655d8d9edeadafe263eeb62960f825ccd189ed0e",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/59",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:17Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0122"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\niMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with \nno global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an empty \nsecurity answer list issues a valid admin cookie), a path-traversal file write in the certificate upload endpoint \n(reachable with the forged cookie), and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the \nplugin\u0027s parameterless constructor BEFORE the IExpressPlugin check - the constructor runs as LocalSystem. Dynamically \nverified: whoami = nt authority\\system.\n\nImpact: Full read of the host filesystem and configuration as NT AUTHORITY\\SYSTEM, arbitrary OS command execution, and \nfull control of the iMonnit Express host.\n\nAdvisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/54"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/54"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0117",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54",
            "automated": true,
            "contentSha256": "62f141d0cd4f591221ed21a7ea4783e9ca3951258d868eace70668e4b363e7aa",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/54",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:13Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0117"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nnanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST \n/formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain object \nvia nanodlpContext(). The Config object is a cross-request shared live pointer; Config.ShieldUnpause is writable, and \nConfig.Save() persists it to db/machine.json without sanitization. An attacker injects [[Exec \u003ccmd\u003e]] into \nShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the print engine to execute the G-code, \nreaching os/exec with shell semantics as root. Dynamically verified with uid=0(root).\n\nImpact: Full read of the host filesystem and configuration as root, arbitrary OS command execution, and full control of \nthe print server and host. The injected G-code is persisted and re-executes on every unpause.\n\nAdvisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/57"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/57"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0120",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57",
            "automated": true,
            "contentSha256": "311e7dc120b27dccd2a21cc671849c884ae669888482809cc8e55f1638e05953",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/57",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0120"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext / \nGraphwise). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nOntotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter \nchain. As a result, /rest/repositories/ruleset/upload and /repositories/* are anonymously reachable. A .pie ruleset \nupload is compiled at runtime by the system javac and loaded into the server process. RuleCompilerBase.compilePrefices \ninlines the namespace prefix verbatim into the generated Java source with only .trim() and no validation. An attacker \ninjects Java code in the prefix; creating a graphdb:Sail repository triggers infer.initialize(), which executes the \ninjected Runtime.exec as the GraphDB process user (root). No authentication and no license are required. Dynamically \nverified with uid=0(root).\n\nImpact: Full host compromise as root (the GraphDB process user); the attacker can read any file, execute arbitrary \ncommands, and take full control of the GraphDB host and its repositories.\n\nAdvisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/53"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/53"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0116",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53",
            "automated": true,
            "contentSha256": "d1819df0ca4a56f1374c818730f46e330e087eab2119aa5cb776a0327e2b620d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/53",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0116"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nMAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the \ncaller-supplied byte array before any authentication. Serializer.BinaryDeserialization internally calls new \nBinaryFormatter().Deserialize(stream) with no SerializationBinder and no TypeFilterLevel. An attacker sends a single \nunauthenticated HTTP SOAP POST carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -\u003e \nProcess.Start), achieving arbitrary command execution as the IIS app pool identity - NT AUTHORITY\\SYSTEM in the default \ndeployment. Dynamically verified.\n\nImpact: Full compromise of the SCADA host as NT AUTHORITY\\SYSTEM; the attacker can read any file, execute arbitrary \ncommands, and take full control of the SCADA environment.\n\nAdvisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:59Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/56"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/56"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0119",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56",
            "automated": true,
            "contentSha256": "da970b16449b913dd2e753b4f0f695fcdf14739866217cd694117b71e45d2ad8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/56",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:59Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0119"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)\n\nObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability: \nJDOQL query filter evaluation allows arbitrary static-method reflective invocation. Factory default credentials \nadmin/admin grant full privileges with no forced change; the IP check accepts any source IP when the user has no ip \nattribute. A malicious JDOQL filter such as java.lang.Runtime.getRuntime().exec(cmd) != null is evaluated server-side: \nQNF.q() loads any class (no class-name allowlist), MCN.l() calls Method.invoke with setAccessible(true), reaching \nRuntime.exec - the server-side Java process runs as root, yielding uid=0(root) RCE. Dynamically verified.\n\nImpact: Full read of the host filesystem and JVM environment as root, arbitrary OS command execution, and full control \nof the ObjectDB host and database.\n\nAdvisory: https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/58"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/58"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0121",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58",
            "automated": true,
            "contentSha256": "7504b3d42652b55eb3bd0b8ba381dce0ecbca0da8a5d07703ccebe0524bf7d33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/58",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0121"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI Cyber Backup v2.3.0 (AOMEI). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nAOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four Thrift binary-protocol ports, but only \nthe 9072 Gateway enforces JWT authentication. The three internal Thrift ports (9074, 9077, 9078) bind to the container \nnetwork with no authentication handler. An attacker who can reach ports 9074 and 9078 persists an injected NAS \ncredential via AddBackupStorageNAS, then triggers DeleteBackupStorage, whose async lambda builds a CIFS mount command \nvia system() with unescaped username and password fields. A single-quote escape in the username field injects an \narbitrary shell command that executes as root (uid=0). The chain requires only network reachability to the internal \nThrift ports; no credentials and no user interaction are required.\n\nImpact: Arbitrary command execution as root (uid=0) inside the backup infrastructure container; the attacker can read \nbackup metadata and stored credentials, alter backup storage records, and disrupt or destroy backup operations.\n\nAdvisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/3"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0051",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3",
            "automated": true,
            "contentSha256": "2d677b0e8b05bc9a486a16164155baf0f0f0c8dc765a31eb2c875bb214157a44",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0051"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Plastic SCM (Unity Version Control On-Prem) \n11.0.16.10303 (Unity Technologies). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nPlastic SCM ships a self-developed binary version-control protocol on port 8087, reachable by default on 0.0.0.0. Under \nthe default NameWorkingMode, the server validates only that a client-declared username maps to a local OS account and \nnever checks a password; LocalGroupSEIDProvider.CheckPassword is an empty no-op. Combined with a default EVERYBODY ACL \nthat grants ALL_PERMISSIONS (including mktrigger) to any name-only-authenticated user, an unauthenticated attacker can \ndeclare an administrative username (leaked unauthenticated via GetRepositoryServerInfo), create a server-side trigger \nwhose Path is fully attacker-controlled, and trigger it with a repository operation. TriggerProcess.ExecuteTrigger \nfeeds the Path straight into Process.Start as the FileName with no sandbox, path allowlist, or signature check, \nyielding RCE as the plasticd service account (Linux: plasticscm uid=217; Windows: local Administrator). The only \nnon-network prerequisite is one local OS username, which the protocol itself leaks.\n\nImpact: Full compromise of the version-control server and all repositories, and arbitrary command execution as the \nplasticd service account; the attacker can read source code and repository metadata, create triggers, alter \nrepositories, and persist access.\n\nAdvisory: https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/10"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Plastic SCM (Unity Version Control On-Prem) 11.0.16.10303 (Unity Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0057",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10",
            "automated": true,
            "contentSha256": "d8eb1511379fda3c83f3f27587a57b37c7909e304d0ec7cd0c86743d790d8c32",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0057"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nA default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by \ndefault with email activation disabled, so an anonymous attacker registers and immediately receives a Supervisor \naccount. The Supervisor uploads a .mrt report template containing an embedded C# script. PUT \n/1/reporttemplates/\u003cid\u003e/run triggers the report-script engine, which compiles the script with CSharpCodeProvider in \nfull trust (no AppDomain isolation, no CAS sandbox, no class allowlist) and instantiates the report class, executing \nthe attacker-controlled constructor. The report task runs in the backend service process Stimulsoft.Server.Agent.exe as \nNT AUTHORITY\\SYSTEM. No credentials, no SMTP, no administrator action, and no non-default configuration are required.\n\nImpact: Full system takeover; the report task executes in the backend service process running as NT AUTHORITY\\SYSTEM, \ngiving arbitrary code execution with the highest Windows privilege.\n\nAdvisory: https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/9"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Stimulsoft Server 2026.3.1 (Stimulsoft)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0056",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9",
            "automated": true,
            "contentSha256": "e93aa4f24d03c1931d3cd8b6dd3af1323819c4d983936a8ff51957fff654f1c7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0056"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nvMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The \nHTTP API endpoint GET /api/?Function=ScriptStartDynamic\u0026Value=\u003cVB.NET source\u003e takes the Value parameter as VB.NET \nsource code, compiles and executes it via VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with \na 6-item substring blocklist, but the compilation template injects Imports System.Diagnostics into the generated source \nbefore the user\u0027s code, so an attacker can call Process.Start directly without writing the blocked substring. Combined \nwith the Web Controller\u0027s default blank password (which the official documentation states means no login will be \nrequired regardless of the access settings), the entire /api route is reachable without authentication, yielding \nunauthenticated RCE as the user running vMix64.exe (commonly administrator). Pre-research public CVE count for vMix: 0.\n\nImpact: Arbitrary OS command execution as the vMix64.exe run identity (commonly administrator), plus arbitrary file \nread/write via the same blocklist bypass; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/12"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0059",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12",
            "automated": true,
            "contentSha256": "1df256062c2f41c79c2944d415b239febfede190eab238ad05d63e79486a530d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0059"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon \nIndustries). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nVicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to \n/NVR/api/v1 on ports 8084/8444. The endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a \n[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes Process.Start. None of the 8 OWIN \nmiddlewares perform authentication, UpgradesController is not annotated with [Authorize], and SetupExecuteCommand \nbypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() method. The service runs as LocalSystem, \nso an unauthenticated attacker with network access to the Web API port immediately obtains nt authority\\system remote \ncode execution.\n\nImpact: Full host compromise as nt authority\\system with no credentials required; the attacker can access all recorded \nvideo, camera credentials, and VMS configuration, alter video surveillance state, and tamper with or destroy evidence.\n\nAdvisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/11"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0058",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11",
            "automated": true,
            "contentSha256": "4bca9118108632e68858fe19a14bea30d3ae2f8f7886c0c397caf138b0225f2a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0058"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Apache Struts 2 2.6.11.0 (Apache Software \nFoundation). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nApache Struts 2.6.11.0 is vulnerable to unauthenticated remote code execution under a documented REST mapper \nconfiguration combined with wildcard dynamic dispatch. RestfulActionMapper.getMapping() extracts the action name from \nthe request URI without calling cleanupActionName, the character-set gate that DefaultActionMapper adopted after \nS2-057; that fix was never synchronized to the REST mapper. When an application uses struts.mapper.class=restful with a \nwildcard action and a result containing {1} substitution, attacker-controlled OGNL metacharacters flow through the \nwildcard capture into TextParseUtil.translateVariables, bypassing AcceptedPatternsChecker. A novel \njava.beans.Expression/Statement reflection primitive then defeats the SecurityMemberAccess sandbox and reaches \nRuntime.exec. The chain was verified with uid=0(root) on a Tomcat 9 / OGNL 3.3.5 deployment. The only precondition is \nan opt-in but documented configuration subset (REST mapper plus wildcard dynamic dispatch).\n\nImpact: Arbitrary operating system command execution as the JVM process user; on a root-run deployment, full host \ncompromise. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/4"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Apache Struts 2 2.6.11.0 (Apache Software Foundation)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0052",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4",
            "automated": true,
            "contentSha256": "fee326014012576665558b465357a6f742a6c51511c5aadf16abb7a461350217",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0052"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}