Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

Re: [FD] : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885) Joseph Goydish II via Fulldisclosure (Nov 07)
Hey Patrick, I understand the doubt.

However… what’s not slop is reproducible logs I provided a video of and the testable, working exploit I provided.

Neither is the upstream patches that can be tracked from the disclosure dates to the cve’s listed in the report.

The exploit was caught in the wild, reversed engineered via log analysis and the logs provided are simply observed
behavior. Please feel free to independently test the...

Re: : "Glass Cage" – Zero-Click iMessage → Persistent iOS Compromise + Bricking (CVE-2025-24085 / 24201, CNVD-2025-07885) Jan Schermer (Nov 07)
I looked at few repos and posts of "Joseph Goydish".
It all seems to be thinly veiled AI slop and BS.
Cited vulns are not attributed to him really and those chains don’t make a lot of sense. Screen recordings look
suspicious, some versions reference High Sierra for some reason (but I can’t find those bits now).

I invite anyone to look at his GH repos and scroll through commit history.
Does this make any sense?...

runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 Aleksa Sarai via Fulldisclosure (Nov 07)
| NOTE: This advisory was sent to <security-announce () opencontainers org>
| on 2025-10-16. If you ship any Open Container Initiative software, we
| highly recommend that you subscribe to our security-announce list in
| order to receive more timely disclosures of future security issues.
| The procedure for subscribing to security-announce is outlined here:
| <...

OXAS-ADV-2025-0002: OX App Suite Security Advisory Martin Heiland via Fulldisclosure (Nov 07)
Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at
https://documentation.open-xchange.com/appsuite/security/advisories/html/2025/oxas-adv-2025-0002.html.

Yours sincerely,
Martin Heiland, Open-Xchange...

APPLE-SA-11-05-2025-1 iOS 18.7.2 and iPadOS 18.7.2 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-05-2025-1 iOS 18.7.2 and iPadOS 18.7.2

iOS 18.7.2 and iPadOS 18.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125633.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch
3rd generation...

APPLE-SA-11-03-2025-9 Xcode 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-9 Xcode 26.1

Xcode 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125641.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

GNU
Available for: macOS Sequoia 15.6 and later
Impact: Processing a maliciously crafted file may lead to heap
corruption
Description: An...

APPLE-SA-11-03-2025-8 Safari 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-8 Safari 26.1

Safari 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125640.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Safari
Available for: macOS Sonoma and macOS Sequoia
Impact: Visiting a malicious website may lead to address bar spoofing
Description:...

APPLE-SA-11-03-2025-7 visionOS 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-7 visionOS 26.1

visionOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125638.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Account
Available for: Apple Vision Pro (all models)
Impact: A malicious app may be able to take a screenshot of sensitive...

APPLE-SA-11-03-2025-6 watchOS 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-6 watchOS 26.1

watchOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125639.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Account
Available for: Apple Watch Series 6 and later
Impact: A malicious app may be able to take a screenshot of sensitive...

APPLE-SA-11-03-2025-5 tvOS 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-5 tvOS 26.1

tvOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125637.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: Apple TV 4K (2nd generation and later)
Impact: An app may be able to cause unexpected system termination...

APPLE-SA-11-03-2025-4 macOS Sonoma 14.8.2 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-4 macOS Sonoma 14.8.2

macOS Sonoma 14.8.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125636.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Sonoma
Impact: An app may be able to access user-sensitive data
Description: A...

APPLE-SA-11-03-2025-3 macOS Sequoia 15.7.2 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-3 macOS Sequoia 15.7.2

macOS Sequoia 15.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125635.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Sequoia
Impact: An app may be able to access user-sensitive data
Description: A...

APPLE-SA-11-03-2025-2 macOS Tahoe 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-2 macOS Tahoe 26.1

macOS Tahoe 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125634.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Admin Framework
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: The issue was...

APPLE-SA-11-03-2025-1 iOS 26.1 and iPadOS 26.1 Apple Product Security via Fulldisclosure (Nov 07)
APPLE-SA-11-03-2025-1 iOS 26.1 and iPadOS 26.1

iOS 26.1 and iPadOS 26.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/125632.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro...

Re: [oss-security] runc container breakouts via procfs writes: CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881 akendo () akendo eu (Nov 07)
Thank you for sharing this. I wondered how big the impact of this vulnerability is when you have only the ability to
access runs via the Kubernetes API? Would you argue that the vulnerability becomes harder (or impossible?) to exploit
when you can only interact with the service via another API?

In my current understanding of the vulnerabilities, it seems like you need to be able to interact with runs directly.

Furthermore, the ability to...

More Lists

Dozens of other network security lists are archived at SecLists.Org.