Posted by zz lin on Jul 22

I came across a project, "0day Rubbish", that states it will continuously
disclose 0-day vulnerabilities discovered by an AI-driven research process
(a multi-LLM ensemble of Claude, OpenAI, DeepSeek and GLM). For each
vulnerability the project publishes a full technical analysis together with
a working exploit script and step-by-step reproduction instructions. The
project's content is hosted at:

https://0day-rubbish.com/blog...

Posted by shed riot on Jul 22

# Synology stale DNS allows practical interception of traffic from
vulnerable DSM clients

Vendor case: 904909
Suggested severity: High

## Customer advisory

Synology customers using the affected DSM and Relayd versions listed below
should upgrade immediately.

The relevant man-in-the-middle vulnerabilities were fixed in DSM
6.2.3-25426 Update 3. Customers should install the latest DSM version
available for their device, and in no case remain on...

Posted by shed riot on Jul 22

After receiving live analytics requests intended for `api2.amplitude.com`,
I contacted `security () amplitude com` and was invited to submit the issue
through Amplitude's private Bugcrowd programme.

In my view, Amplitude's handling of the report, including closing it as
"Not applicable" despite evidence of intercepted customer traffic, caused
by insecure configurations and documentation, constitutes a negligent
approach to...

Posted by Hayaturehman Ahmadzai on Jul 20

Hi all,

I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys /
AsusBSItf.sys kernel driver, shipped with ASUS Business Manager and
Software Manager. ASUS has assigned the CVE and published a vendor advisory
with countermeasures.

Summary: The driver exposes a device (\\.\bsitf, admin-required to open)
with an IOCTL that allocates a caller-specified amount of physically
contiguous kernel memory, maps it into the calling...

Posted by psy on Jul 20

Hi Community,

I am glad to present a new release of this tool:

- https://ufonet.03c8.net

---------

"UFONet is a free software, P2P and cryptographic -disruptive toolkit-
that allows to perform DoS and DDoS attacks; on the Layer 7 (APP/HTTP)
through the exploitation of Open Redirect vectors on third-party
websites to act as a botnet and on the Layer3 (Network) abusing the
protocol."

"It also works as an encrypted DarkNET to...

Posted by psy on Jul 20

Hi FD,

I am glad to present a new release of this tool:

- https://xsser.03c8.net

---------

"Cross Site "Scripter" (aka XSSer) is an automatic -framework- to
detect, exploit and report XSS vulnerabilities in web-based
applications. It provides several options to try to bypass certain
filters and various special techniques for code injection."

---------

XSSer has pre-installed [ > 1500 XSS ] attacking vectors and can...

Posted by NotCVE Advisories on Jul 20

----------------------------------------------------------------------------
NotCVE Registry Index — 2026-07-16
----------------------------------------------------------------------------

[-] About the NotCVE registry:

NotCVE (https://notcve.org) assigns public identifiers to real, verifiable
vulnerabilities that did not receive a CVE — typically because the affected
vendor did not acknowledge the issue. Each record preserves the technical...

Posted by NotCVE Advisories on Jul 15

----------------------------------------------------------------------------
NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440
----------------------------------------------------------------------------

[-] Summary:

On 2026-01-19 the issue described below was published as NotCVE-2026-0001
after no CVE identifier was assigned for it. On 2026-07-01 — 163 days
later — Cloudflare assigned CVE-2026-14440 to the same issue, now...

Posted by AliReza on Jul 15

# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config
# Date: 2026-07-16
# Exploit Author: Alireza Chegini
# Vendor Homepage: https://ezsystemrepairs.com
# Software Link: https://ezsystemrepairs.com (Free version available)
# Version: 1.0.0 (v2.0 exists but not tested - paid license required)
# Tested on: Windows 10 / Windows 11
# CVE: Pending
============================================================

1. Description...

Posted by Greg via Fulldisclosure on Jul 15

Skillable's SCORM lab launch endpoint validates a launch token but
enforces per-user allocation limits using a browser-supplied userId
that is not bound to the validated token. An authenticated learner
can modify this identifier to bypass configured limits, launch
concurrent lab instances, and consume another learner's allocation.
Skillable states that no fix is planned for the legacy SCORM launch
path. CVE-2026-56877 was assigned by...

Posted by Matteo Beccati on Jul 08

========================================================================
Revive Adserver Security Advisory REVIVE-SA-2026-003
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2026-003
------------------------------------------------------------------------
Date: 2026-06-25
Risk Level: Medium to High
Applications affected: Revive Adserver
Versions...

Posted by evan on Jul 06

SUMMARY: a stored XPATH injection allows any user with just ca
manager/certificate manager perms to leak any secret key/any value in
config.xml, thus achieving privilege escalation and potentially remote
code execution. this can also likely be chained via csrf and some
clever hiding. see
https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r

== VULN ==
the primary vulnerable sink is here:

$refcount =...

Posted by Jan Hüber via Fulldisclosure on Jul 06

Authentication Bypass for SafeLine SL6 and SL6+
===============================================

The SafeLine SL6 and SL6+ devices integrated into elevator emergency
intercom systems are
vulnerable to an authentication bypass. This vulnerability allows
attackers to bypass
authentication requirements and access the device's configuration
service via the
Bluetooth Low Energy (BLE) interface. Consequently, an attacker within
wireless range...

Posted by Red Nanaki via Fulldisclosure on Jul 02

Whistleblowersoftware.com: confidentiality and anonymity leakage to third
parties

## Summary

The anonymous reporting flow on `whistleblowersoftware.com` encrypts report
text end-to-end in the browser but does not extend the same guarantee to
attachments and exposes the reporter's network identity and timing to a US-based
third party. Together these weaken the confidentiality and anonymity
properties the platform is expected to provide.

##...

Posted by Red Nanaki via Fulldisclosure on Jul 02

OpenBlow Multiple Deanonymization Vulnerabilities

Summary

A production deployment was observed (HTTP archive of a full, real whistleblower
submission) to route its anonymous reporting flow through Google. The intake
CAPTCHA is Google reCAPTCHA, enforced as a mandatory, server-validated gate
on report submission, and the UI additionally pulls a web font from
fonts.gstatic.com. As a result, every prospective whistleblower's browser
makes...

Posted by Red Nanaki via Fulldisclosure on Jul 02

Whistlelink: Site-access password exposed in web server access logs via GET
query string

Severity: CRITICAL

SUMMARY

The Whistlelink reporting portal protects optionally-enabled, password-gated
whistleblowing sites with a site-access password. When a visitor unlocks such a
site, the client validates the password by issuing an HTTP GET request that
carries the password as a URL query-string parameter:

GET...

Posted by Apple Product Security via Fulldisclosure on Jul 02

APPLE-SA-06-29-2026-3 Safari 26.5.2

Safari 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127685.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Web Extensions
Available for: macOS Sonoma and macOS Sequoia
Impact: A malicious web extension may be able to cause an...

Posted by Apple Product Security via Fulldisclosure on Jul 02

APPLE-SA-06-29-2026-2 macOS Tahoe 26.5.2

macOS Tahoe 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127595.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

IOGPUFamily
Available for: macOS Tahoe
Impact: An app may be able to cause unexpected system termination...

Posted by Apple Product Security via Fulldisclosure on Jul 02

APPLE-SA-06-29-2026-1 iOS 26.5.2 and iPadOS 26.5.2

iOS 26.5.2 and iPadOS 26.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127594.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

IOGPUFamily
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later,...

Posted by Greg via Fulldisclosure on Jul 02

1. Advisory information
-----------------------
Title: Symlink following and TOCTOU in pwnlift upload handler allow arbitrary file write as root
Advisory: https://github.com/GregDurys/security-advisories
GHSA: GHSA-2v7v-rhpw-m9w4
CVE: CVE-2026-56815
Class: CWE-59 (Improper Link Resolution Before File Access),
CWE-367 (Time-of-check Time-of-use Race Condition)
CVSS: 7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Date: 2026-06-27...