Latest news

Advertisement
  1. Vulnerabilities via Full Disclosure

    [0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics Syncrify 6.2 build 1178, the…

  2. Vulnerabilities via Full Disclosure

    [0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in South River Technologies Titan MFT Server…

  3. Vulnerabilities via Full Disclosure

    [0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear Collaborator Server 15.1.15101, the…

  4. Vulnerabilities via Full Disclosure

    [0day-rubbish] PacsOne Server 7.3.9 authenticated DICOMweb STOW-RS SOP Instance UID path traversal to www-data code execution on a PACS host (7.2)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in PacsOne Server 7.3.9, Premium Edition, Linux…

  5. Vulnerabilities via Full Disclosure

    [0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2.1, the self-hosted PHP shopping-cart…

  6. Vulnerabilities via Full Disclosure

    [0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Guardian 2.1, the self-hosted licensing…

  7. Vulnerabilities via Full Disclosure

    [0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo Portal 26.2.8 together with Dataedo Agent…

  8. Vulnerabilities via Full Disclosure

    [0day-rubbish] CloudPanel 2.5.4-3 site-settings rootDirectory nginx virtual-host injection to host root code execution (8.8)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel Community Edition 2.5.4-3+clp-bookworm…

  9. Advertisement
  10. Vulnerabilities via Full Disclosure

    [0day-rubbish] Auerswald COMmander 6000 / 6000R 8.6D unauthenticated provisioning import zip-slip to root binary hijack and root code execution (9.8)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald COMmander 6000 and COMmander 6000R…

  11. Vulnerabilities via Full Disclosure

    [0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)

    Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in Abyss Web Server X1 2.16.22.0, the free…

  12. Vulnerabilities via Full Disclosure

    1-click MMI/USSD execution in Android via CALL_PHONE and browser-reachable dialer deeplinks (ACR Phone / com.nll.cb)

    Posted by Karan Saini on Oct 15 Android's CALL_PHONE permission, shown to users as "make and manage phone calls", also authorises execution of carrier MMI/USSD codes…

  13. Vulnerabilities via Help Net Security

    Qualys introduces TruConfidence to orchestrate cyber risk remediation

    Qualys has announced TruRisk Eliminate 2.0 with TruConfidence, a new remediation intelligence and orchestration engine that powers Qualys’ vision for Autonomous RemOps…

  14. Vulnerabilities via The Hacker News

    Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

    Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to…

  15. Vulnerabilities via Dark Reading

    EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

    Hundreds of stores lost millions of dollars because they hired third parties to manage the outdated OT firmware running their cooling systems.

  16. Vulnerabilities via SecurityWeek

    Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

    The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.

  17. Vulnerabilities via The Hacker News

    AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

    Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig…

  18. Vulnerabilities via oss-security

    Re: Incomplete fix for Emacs CVE-2026-79992

    Posted by Salvatore Bonaccorso on Oct 14 Hi, FWIW, this is already https://www.cve.org/CVERecord?id=CVE-2026-108976 . Regards, Salvatore

  19. Vulnerabilities via SecurityWeek

    Cisco Warns of Exploited Secure Email Gateway Vulnerability

    Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.

  20. Breaches via HIPAA Journal

    Healthcare Data Breach Statistics – Updated for 2026

    The HIPAA Journal has compiled healthcare data breach statistics from October 2009, when the Department of Health and Human Services (HHS) Office for Civil Rights (OCR)…

  21. Ransomware via Hornetsecurity

    Tech Support Scam: Fake Orders and Bank Alerts Prompt Victims to Call

    A tech support scam impersonates a legitimate support service to persuade someone to call, make a payment, disclose sensitive information, or authorize access to their…