Risk Discovery

CISA Advisories

US-CERT

FullDisclosure

[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)

[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)

[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)

[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)

[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)

[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)

[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)

[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)

CVE-2026-52307: Stored XSS in 1CMS v5.6

US CERT Weekly

Open Source Security

Retrospective by 'gpg.fail' authors

Re: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

Fwd: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations

Re: AI slops from Eve

Re: AI slops from Eve

[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Local Privilege Escalation (LPE) in FolkPatch due to Hardcoded Default SuperKey

Re: pcre2 version 10.48 released with security fixes

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

© 2026 RiskDiscovery | Sponsored by: Deception Logic