// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
[0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure)
NETGEAR RAX120 firmware V1.2.5.18 contains an authenticated SOAP InstallApp command injection flaw allowing root execution via the web-stack.
-
[0day-rubbish] Raritan PX3 PDU G4 firmware 4.3.14 command injection in the ping and traceroute diagnostics through an inverted hostname-validation return check (8.8)
Raritan PX3 PDU G4 firmware 4.3.14 has a command injection flaw via ping and traceroute diagnostics, allowing low-privilege authenticated sessions to execute OS commands.
-
[0day-rubbish] NUUO Crystal Server 3.19.0.85 unauthenticated upload.php PHP web-root write with fastcgi execution into server-side code execution as the web service account (9.8 Critical)
NUUO Crystal Server 3.19.0.85 has an unauthenticated upload.php flaw allowing web-root write and fastcgi execution, leading to server-side code execution as the web service account.
-
[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 scenario ping condition command injection through the auto-executing ping thread (7.2)
Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 has a command injection flaw allowing an authenticated administrator to execute arbitrary commands via the scenario ping condition.
-
[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 IPsec tunnel address command injection through the route-management shell commands (7.2)
Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 has an authenticated command injection flaw in the route-management shell allowing arbitrary command execution via a stored VPN address field.
-
[0day-rubbish] Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 command injection in the Executer program activation path (7.2)
Moxa MAR-2000 firmware FWR_MAR2000_V1.0_Build_15010909 contains a command injection flaw allowing an authenticated administrator to execute arbitrary commands as the product model process.
-
Maximised JSON Array Attacks -- "Let the Commas Hit the Floor" Proof of Concept
Daniel Owens released Commas of D00m, a proof of concept demonstrating unconstrained resource consumption in many JSON parsers, affecting the Apache Struts2 JSON Plugin S2-072 and prior code.
-
Continued Apache Struts2 JSON Plugin Insecure Deserialisation
Apache Struts2 JSON Plugin has a continued insecure deserialisation flaw related to JSON deserialisers, demonstrated by a proof of concept script.
# 27 Oct
-
APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2
Apple released macOS Tahoe 26.7.2 addressing security issues detailed in APPLE-SA-10-26-2026-5, with more information available on Apple's support website.
-
APPLE-SA-10-26-2026-10 Safari 27.2
Apple released Safari 27.2 addressing security issues as detailed in APPLE-SA-10-26-2026-10, with further security content available on Apple's support website.
-
APPLE-SA-10-26-2026-9 visionOS 27.2
Apple released visionOS 27.2 addressing security issues detailed in APPLE-SA-10-26-2026-9, with further security content available on Apple's support website.
-
APPLE-SA-10-26-2026-8 watchOS 27.2
Apple Product Security released watchOS 27.2 addressing security issues detailed in APPLE-SA-10-26-2026-8, with further information available on Apple's support pages.
-
APPLE-SA-10-26-2026-7 tvOS 27.2
Apple released tvOS 27.2 addressing security issues detailed in APPLE-SA-10-26-2026-7, with further security content available on Apple's support website.
-
APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2
Apple released macOS Sequoia 15.8.2 addressing security issues detailed in APPLE-SA-10-26-2026-6, with further security content available on Apple's support website.
-
APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2
Apple released macOS Golden Gate 27.2 addressing security issues as detailed in the APPLE-SA-10-26-2026-4 advisory on October 27.
-
APPLE-SA-10-26-2026-3 iOS 18.7.11 and iPadOS 18.7.11
Apple released iOS 18.7.11 and iPadOS 18.7.11 addressing security issues detailed in APPLE-SA-10-26-2026-3 via Fulldisclosure.
-
APPLE-SA-10-26-2026-2 iOS 26.7.2 and iPadOS 26.7.2
Apple released iOS 26.7.2 and iPadOS 26.7.2 addressing security issues as detailed in the APPLE-SA-10-26-2026-2 advisory.
-
APPLE-SA-10-26-2026-1 iOS 27.2 and iPadOS 27.2
Apple released iOS 27.2 and iPadOS 27.2 addressing security issues detailed in APPLE-SA-10-26-2026-1 via Fulldisclosure.
-
CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1 are affected by CVE-2026-109618, a pointer underflow enabling unauthenticated remote code execution.
-
SEC Consult SA-20261023-0 :: Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem
SEC Consult Vulnerability Lab disclosed multiple Cross-Site Scripting vulnerabilities (CVE-2026-4950, CVE-2026-4951, CVE-2026-4952) in VertiGIS WebOrderSystem version 7.0.8.6.
-
APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2
Apple macOS Tahoe 26.7.2 addresses security issues, where processing a maliciously crafted image may lead to unexpected application behavior via the Accelerate Framework.
-
SCHUTZWERK-SA-2025-002: Privilege escalation in Lobster_pro through request replaying
Lobster_pro version 4.12.12-LTS and prior versions before 25.1.3 have a privilege escalation flaw allowing attackers to interact with administrative endpoints via request replaying.