Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2

macOS Tahoe 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149522.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to unexpected
app...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-10 Safari 27.2

Safari 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149527.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

LinkPresentation
Available for: macOS Sequoia and macOS Tahoe
Impact: Processing a maliciously crafted image may result in memory...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-9 visionOS 27.2

visionOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149526.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: Apple Vision Pro (all models)
Impact: Processing a maliciously crafted image may lead to...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-8 watchOS 27.2

watchOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149525.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accounts
Available for: Apple Watch Series 9 and later
Impact: A malicious application may be able to bypass Privacy
preferences...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-7 tvOS 27.2

tvOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149524.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accounts
Available for: Apple TV 4K 2nd generation and later
Impact: A malicious application may be able to bypass Privacy
preferences...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2

macOS Sequoia 15.8.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149523.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate
Available for: macOS Sequoia
Impact: An app may be able to cause a denial-of-service
Description: An...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2

macOS Golden Gate 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149521.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Golden Gate
Impact: Processing a maliciously crafted image may lead to...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11

iOS 18.7.11 and iPadOS 18.7.11 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149225.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Audio
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th
generationAir 4th generation...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2

iOS 26.7.2 and iPadOS 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149227.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later,...

Posted by Apple Product Security via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-1 iOS 27.2 and iPadOS 27.2

iOS 27.2 and iPadOS 27.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149230.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: iPhone 11 and later, iPad Pro 12.9-inch 4th generation
and later, iPad Pro...

Posted by jose on Oct 27

CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables
unauthenticated remote code execution.

Affected: ALL PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1
(default configuration). Same vulnerability class as CVE-2019-11043
(PHP-FPM, CVSS 9.8, patched 2019) — the CGI SAPI never received the
equivalent fix.

Fix: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (scheduled Oct 21, 2026 14:00 UTC)
PHP 8.1 and earlier (EOL) receive NO fix....

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Oct 27

SEC Consult Vulnerability Lab Security Advisory < 20261023-0 >
=======================================================================
title: Multiple Cross-Site Scripting Vulnerabilities
           product: VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
vulnerable version: <=7.0.8.6
     fixed version: unknown
CVE number: CVE-2026-4950, CVE-2026-4951, CVE-2026-4952
           ...

Posted by KC Chambers via Fulldisclosure on Oct 27

APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2

macOS Tahoe 26.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149522.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate Framework
Available for: macOS Tahoe
Impact: Processing a maliciously crafted image may lead to unexpected
app...

Posted by David Brown via Fulldisclosure on Oct 27

Privilege escalation via request replaying in Lobster_pro
=========================================================

Due to improper permission checks in Lobster_pro, attackers are able to
interact with
endpoints that should require administrative privileges. This issue
affects Lobster_pro
version 4.12.12-LTS and potentially other versions prior to 25.1.3.

Metadata
========

- Affected product: Lobster_pro
- Affected version: 4.12.12-LTS and...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in TRENDnet
TV-IP302PI firmware 1.02.38, the closed-source IP surveillance camera from
TRENDnet (United States). The camera's application daemon is shipped at
/hunt/hunt_server: an ARM 32-bit EABI5 version 5TE soft-float binary,
dynamically linked against /lib/ld-linux.so.3, 4.5 MB and stripped. Its own
string pool carries hunt_camera, HuntAudioConverter, HuntDataDirect and...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Royal
Render 9.1.26b, the closed-source render-farm job manager for VFX and
animation studios from Binary Alchemy (proprietor Holger Schoenberger) of
Ludwigsburg, Germany. Royal Render
is a different product from the Royal Server gateway sold by Royal Apps GmbH
of Austria; the two are unrelated companies sharing one word in their names,
and this disclosure concerns the German...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in the
ProSoft RLX-IFH24E, version v2.2.44, the industrial wireless radio from
ProSoft Technology, Inc. (United States). The appliance is a closed-source
embedded device and an OEM build of the MicroHard Systems IPx21 platform on
the MHX-910 board design: an Intel IXP425 XScale processor, ARM
big-endian, Linux 2.4.24-uc0, with static management pages under /usr/web
and 57 ARM...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Parasoft
Continuous Testing Platform 10.7.5-SNAPSHOT, the closed-source commercial
continuous-testing, service-virtualisation and environment-management product
from Parasoft, a United States software-testing vendor headquartered in
Monrovia, California. The affected component is the em web application inside
the vendor's own container image, running on Tomcat 10.1.57 with...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in Exasol
Database 7.1.30, the in-memory MPP analytical database from Exasol AG
(Germany), examined in its docker-db single-container deployment form. The SQL
engine is a proprietary C implementation named EXASolution, the server process
is exacts, clients speak a proprietary binary SQL protocol on port 8563 rather
than HTTP, TLS terminates on that port with a self-signed...

Posted by disclosure via Fulldisclosure on Oct 20

0day Rubbish Research Team is publicly disclosing a vulnerability in the
Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO
wireless router from Edimax Technology Co., Ltd. (Taiwan). A single
authenticated POST that looks like an ordinary WAN settings submission reaches
system() with a request-controlled username interpolated unquoted into a shell
command line, behind a sanitiser that inspects exactly one character,...