Full Disclosure Mailing List

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

List Archives

Latest Posts

SEC Consult SA-20260608-0 :: Privilege Escalation via Binary Planting in Genetec-provided RabbitMQ in multiple Genetec products SEC Consult Vulnerability Lab via Fulldisclosure (Jun 08)
SEC Consult Vulnerability Lab Security Advisory < 20260608-0 >
=======================================================================
title: Privilege Escalation via Binary Planting
            product: Genetec-provided RabbitMQ in multiple Genetec products
vulnerable version: Multiple products, see below.
      fixed version: Multiple products, see below.
CVE number: CVE-2026-25112
           ...

[SYSS-2026-004] SAP NetWeaver SAML XML Signature Wrapping Moritz Bechler via Fulldisclosure (Jun 08)
Advisory ID: SYSS-2026-004
Product: SAP NetWeaver ABAP / SAP_BASIS
Manufacturer: SAP SE
Affected Version(s): SAP_BASIS 700 - 918
Tested Version(s): 7.93 Patch 300
Vulnerability Type: CWE-347: Improper Verification of Cryptographic Signature
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2025-11-06
Solution Date: 2026-02-10...

[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities Matteo Beccati (Jun 04)
========================================================================
Revive Adserver Security Advisory REVIVE-SA-2026-002
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2026-002
------------------------------------------------------------------------
Date: 2026-06-03
Risk Level: Medium to High
Applications affected: Revive Adserver
Versions...

CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series Thomas Weber | CyberDanube via Fulldisclosure (May 31)
CyberDanube Security Research 20260528-0
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| Mennekes Amtron Series and Smart-T PnC
vulnerable version| 5.22.3
fixed version| 5.33.11-21500
CVE number| CVE-2026-8979, CVE-2026-8980
impact| High
homepage| https://www.mennekes.at/
found|...

bmcweb (OpenBMC web server): four vulnerabilities — two unfixed, GHSA without a CVE binreaper via Fulldisclosure (May 31)
Hi all,

Posting a brief summary of a four-finding disclosure on bmcweb (the OpenBMC HTTP/Redfish web server), which ships in
BMC firmware on most modern enterprise servers — Intel, IBM, HPE, NVIDIA, and various ODMs.

Full timeline and analysis on the blog:

https://binreaper.pages.dev/posts/2026-05-27-bmcweb-disclosure/

## Why bmcweb matters

A Baseboard Management Controller boots before the host CPU, has full control over the server...

Re: Dovecot Security Advisory OXDC-2026-0002 Noel Butler via Fulldisclosure (May 25)
So when is the fix for dovecot 2.3 source code due to be released?

Since by your wording by not including the first detected versions, it
must be assumed 2.3 is affected, and as no EOL has been published or
announced for 2.3.x, and as 2.3 is the still the most popular used
version by far, should be prudent one is released, given a few more
serious fixes have been made in recent times.

SSRF in Anthropic mcp-server-fetch and Microsoft playwright-mcp — publicly disclosed via GitHub issues outreach (May 25)
-----BEGIN SECURITY ADVISORY-----

Title: Server-Side Request Forgery (SSRF) in Anthropic mcp-server-fetch and Microsoft playwright-mcp
Author: Syed Anas Mohiuddin <anasmohiuddinsyed () gmail com>
Date: May 25, 2026
CVSS: 7.5 (HIGH) — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References: Already public via GitHub issues (see below)

== AFFECTED PRODUCTS ==

1. Anthropic mcp-server-fetch (modelcontextprotocol/servers)
All versions as of May...

[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak m.nageh (May 25)
-----BEGIN SECURITY ADVISORY-----

Advisory ID: MONX-2021-001
CVE ID: CVE-2021-21735
Title: ZTE ZXHN H168N V3.5 - Unauthenticated Wizard Credential
Disclosure to Full Admin Compromise
Affected: ZTE ZXHN H168N V3.5
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail com
Public URL:...

[SECURITY ADVISORY] CVE-2026-34474 - ZTE H298A/H108N Unauthenticated Admin Credential Exposure m.nageh (May 25)
-----BEGIN SECURITY ADVISORY-----

Advisory ID: MONX-2026-003
CVE ID: CVE-2026-34474
Title: ZTE ZXHN H298A / H108N - Unauthenticated Admin Password &
WLAN Credential Exposure
Affected: ZTE ZXHN H298A 1.1, ZTE ZXHN H108N 2.6 (EOL; no patch
planned)
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail com
Public URL:...

[SECURITY ADVISORY] CVE-2026-34472 - ZTE ZXHN H188A V6 Authentication Bypass via Pre-Login Wizard m.nageh (May 25)
-----BEGIN SECURITY ADVISORY-----

Advisory ID: MONX-2026-002
CVE ID: CVE-2026-34472
Title: ZTE ZXHN H188A V6 - Authentication Bypass via Pre-Login
Wizard Credential Leakage
Affected: ZTE ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail com
Public URL:...

[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices) m.nageh (May 25)
-----BEGIN SECURITY ADVISORY-----

Advisory ID: MONX-2026-001
CVE ID: CVE-2026-34473
Title: Unauthenticated Denial of Service via Oversized POST Body
in ZTE Router CGILua Parser
Affected: 17+ ZTE ZXHN router models (~140,000 publicly exposed
devices)
CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Date: 2026-05-20
Author: Mina Nageh Salalma (Monx Research)
Contact: minanageh379 () gmail...

Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect Adamczyk Blazej (May 25)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

General...

APPLE-SA-05-13-2026-1 Safari 26.5 Apple Product Security via Fulldisclosure (May 17)
APPLE-SA-05-13-2026-1 Safari 26.5

Safari 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127121.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may prevent Content...

APPLE-SA-05-11-2026-11 visionOS 26.5 Apple Product Security via Fulldisclosure (May 17)
APPLE-SA-05-11-2026-11 visionOS 26.5

visionOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127120.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate
Available for: Apple Vision Pro (all models)
Impact: An app may be able to cause a denial-of-service
Description:...

APPLE-SA-05-11-2026-10 watchOS 26.5 Apple Product Security via Fulldisclosure (May 17)
APPLE-SA-05-11-2026-10 watchOS 26.5

watchOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127119.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate
Available for: Apple Watch Series 6 and later
Impact: An app may be able to cause a denial-of-service
Description:...

More Lists

Dozens of other network security lists are archived at SecLists.Org.