Batch 8

Batch #8 — August 2026

10 advisories · 10 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Eighth batch — expanding coverage into industrial analytics, SCADA, meeting-room AV, VDI brokering, data-center power management, telephony, industrial energy management, UTM gateways, and self-hosted web applications. Headline: Seeq Server unauthenticated RCE via open self-registration plus Data Lab Jupyter missing authorization, and mySCADA PRO Runtime unauthenticated root RCE via the /s.fcgi upgrade branch. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	Seeq Server	R65.2.3	9.8	Unauth self-registration + Data Lab Jupyter missing-auth RCE	Jupyter kernel → RCE
2	mySCADA PRO Runtime	9.4.0	9.4	Unauth upgrade Cmd Injection → Root	/s.fcgi upgrade → Root RCE
3	Biamp Devio SCR-20/25	2.3.1	9.8	Unauth DTP Protocol Quote Injection → Root	DTP password sink → Root RCE
4	Leostream Broker (VULN-002)	9.1.37.0	7.0	Unauth Rogue-Agent Registration + SSRF	Server.Register → SSRF
5	Raritan EMX	emx_ecx_3.6.1	8.8	Auth Config Injection → port_mux Root	proto_listener → Root RCE
6	Leostream Broker (VULN-001)	9.1.37.0	9.1	Auth SQLi → lo_export Webshell → Root	_where SQLi → Root RCE
7	VitalPBX	4.5.2	8.8	Auth asterisk_cli → Dialplan System() Root	CLI → System() → Root RCE
8	Delta DIAEnergie IEMS	V1.11	8.8	Auth CommandTag SQLi → VBScript RCE	tid SQLi → VBScript RCE
9	CacheGuard	UF-2.5.2	8.8	Auth Config-Import Eval Injection RCE	conf inject eval → RCE
10	Maian Gallery	2.1	7.2	Auth Admin Unrestricted Upload → Root	upload_thumbnail → RCE

Highlights

• 4 critical (CVSS ≥ 9.0) · 4 unauthenticated · 6 authenticated (deep-chain)
• Headline: Seeq Server — factory-default open self-registration (CWE-306) plus Data Lab Jupyter missing administrator authorization (CWE-862) → arbitrary Python execution as the datalab user (uid 9500); mySCADA PRO Runtime — unauthenticated /s.fcgi upgrade-branch command injection executing as root in the default container.
• Other unauth entries: Biamp Devio DTP protocol single-quote breakout to root; Leostream Server.Register rogue-agent registration + outbound TLS SSRF.
• Authenticated deep-chain entries: Raritan EMX config injection into the root port_mux daemon; Leostream SQLi → lo_export webshell → sudo root; VitalPBX Asterisk CLI → dialplan System() root; Delta DIAEnergie IEMS SQLi → VBScript execution; CacheGuard config-import eval injection; Maian Gallery admin unrestricted upload → PHP webshell.
• Attack classes: missing authentication, missing authorization, command injection, SQL injection, configuration/eval injection, unrestricted upload, server-side request forgery, privilege escalation.

Totals

10 advisories · 10 vendors · 4 unauthenticated · 6 authenticated (deep-chain) · 7 system-level (root/SYSTEM) · all with reproducible PoC.

Cumulative across 8 batches: 78 advisories.

Batch #7 - August 2026 (10 advisories · 5 critical · 5 unauth)

Batch #7 — August 2026

10 advisories · 10 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Seventh batch — expanding coverage into enterprise integration, distributed caching, telephony, configuration management, critical-communication infrastructure, project management, document scanning, ERP, reporting, and document management. Headline: Software AG webMethods MSR default-credential RCE via XSLT Xalan Java-extension abuse. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	Software AG webMethods MSR	10.x	9.8	Default-creds XSLT Xalan Java-extension RCE	XSLT Xalan ext → RCE
2	NCache Enterprise	5.3.6	9.8	Unauth Assembly.LoadFrom RCE via Web Manager	Assembly.LoadFrom → RCE
3	Brekeke PBX	3.19.1.8	9.8	Unauth XmlTransBean Util.exec RCE	XmlTransBean → RCE
4	CFEngine Enterprise Nova Hub	3.27.1	8.8	Auth VCS Settings Cmd Injection → Root	gitServer → Root RCE
5	RTS Intercom VLink Virtual Matrix	6.60	8.8	Auth OpenSSL Arg Injection → SYSTEM	openssl -engine → SYSTEM RCE
6	Inflectra SpiraTeam	9.3.0.0	8.8	Auth SQLi → xp_cmdshell RCE	yAxisKey SQLi → RCE
7	Scan2x ScanWebClient	2.3.3.0	9.8	Unauth File Upload → Webshell RCE	FileUploadHandler → RCE
8	Microsip ASD	2026 Eval	9.8	Unauth UNC Binary-Planting RCE	gbak.exe planting → RCE
9	myDBR	7.5.4	8.8	Auth File-Editor PHP Code Injection	fileedit_v → RCE
10	LogicalDOC Enterprise	9.3	8.8	Auth Automation Sandbox-Bypass RCE	Velocity sandbox bypass → RCE

Highlights

• 5 critical (CVSS ≥ 9.0) · 5 unauthenticated · 5 authenticated (deep-chain)
• Headline: Software AG webMethods MSR — factory Administrator:manage credential + XSLT Xalan Java-extension abuse → arbitrary OS command execution as sagadmin; the IS fetches the attacker's stylesheet server-side (SSRF), so no local file write is needed.
• Other unauth entries: NCache Enterprise Web Manager Assembly.LoadFrom of an uploaded DLL; Brekeke PBX reflective Util.exec; Scan2x upload → ASPX webshell; Microsip ASD UNC binary planting as LocalSystem.
• Authenticated deep-chain entries: CFEngine Nova Hub VCS settings injection → root; RTS Intercom VLink OpenSSL argument injection → SYSTEM; SpiraTeam SQLi → xp_cmdshell; myDBR file-editor PHP injection; LogicalDOC Automation sandbox bypass.
• Attack classes: missing authentication, XSLT extension abuse, reflection abuse, command injection, SQL injection, unsafe deserialization/loading, unrestricted upload, binary planting, sandbox bypass.

Totals

10 advisories · 10 vendors · 5 unauthenticated · 5 authenticated (deep-chain) · 4 system-level (root/SYSTEM/LocalSystem) · all with reproducible PoC.

Cumulative across 7 batches: 68 advisories.

Batch #6 - August 2026 (7 advisories · 4 critical · 4 unauth)

Batch #6 — August 2026

7 advisories · 7 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Sixth batch — expanding coverage into data-science notebooks, document generation, fax servers, task automation, ITSM, IT monitoring, and video surveillance. Headline: JetBrains Datalore On-Premises unauthenticated RCE via an interactive-report access-mapping flaw. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	JetBrains Datalore On-Premises	2026.2.3	9.8	Unauth RCE via InteractiveReport access-mapping flaw	InteractiveReport READ→EXECUTE → Unauth RCE
2	Docmosis Tornado	2.11.3	9.8	Unauth Arbitrary File Write → cron (Root)	storeTo=file: → Root RCE
3	ActFax	10.70	9.8	Unauth LPD Ghostscript %pipe% (SYSTEM)	LPD %pipe% → SYSTEM RCE
4	RoboTask	11.0.5.1229	9.8	Unauth REST API Task Execution	REST API Unauth → Task RCE
5	Countersoft Gemini	7.3.0	8.8	Auth SQLi → xp_cmdshell (SYSTEM-able)	SQLi → xp_cmdshell RCE
6	Veeam ONE Reporter	13.1	8.8	Auth Command Injection → Local Admin	CommandExecutor → Local Admin RCE
7	Wavestore VMS	6.48.809	8.8	Auth Cmd Injection → Root	venusd /simple/export → Root RCE

Highlights

• 4 critical (CVSS ≥ 9.0) · 4 unauthenticated · 3 authenticated (deep-chain)
• Headline: JetBrains Datalore On-Premises — anonymous attacker reaches an EXECUTE-gated RPC through a public interactive report (shipped ALLOW_ANONYMOUS_RPC_ACCESS=true + READ→EXECUTE mapping flaw), executes arbitrary code in the agent container via unsanitized pip install.
• Other unauth entries: Docmosis Tornado arbitrary file write → root cron RCE; ActFax LPD Ghostscript %pipe% SYSTEM RCE; RoboTask REST API unauthenticated task execution.
• Authenticated deep-chain entries: Countersoft Gemini SQLi → xp_cmdshell; Veeam ONE Reporter CommandExecutor → local admin; Wavestore VMS /simple/export command injection → root.
• Attack classes: access-control mapping, arbitrary file write, Ghostscript %pipe%, missing authentication, SQL injection, command injection, unsanitized command execution.

Totals

7 advisories · 7 vendors · 4 unauthenticated · 3 authenticated (deep-chain) · 6 root/SYSTEM · all with reproducible PoC.

Cumulative across 6 batches: 58 advisories.

Batch #5 - August 2026 (8 advisories · 6 critical · 5 unauth)

Batch #5 — August 2026

8 advisories · 8 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Fifth batch — expanding coverage into IoT/MQTT, in-memory data grids, mail servers, hosting control panels, load balancing, physical communication infrastructure, contact centers, and low-code BPM. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	HiveMQ Platform	4.54.0	9.8	Default creds + Zip-Slip (Root)	Data Hub Zip-Slip → Root RCE
2	GigaSpaces XAP	16.1.1	9.8	Unauth Path Traversal → Webshell (Root)	Unauth Path Traversal → Root RCE
3	IceWarp Server	14.3.0	9.0	Auth Config + Unauth Trigger → UNC DLL (SYSTEM)	Static Route UNC DLL → SYSTEM RCE
4	KeyHelp	26.0	7.2	Auth Apache Directive Pipe (Root)	Custom Directive ErrorLog Pipe → Root RCE
5	Loadbalancer.org ADC	8.13.8	8.8	Auth Cmd Injection → sudo (Root)	Deployment Template Cmd Injection → Root RCE
6	Biamp Vocia MS-1	1.2.27	9.8	Hardcoded Creds + Supervisor Exec (Root)	FTPS Hardcoded Creds → Root RCE
7	Voicent Call Center	10.10.1	9.8	Unauth Auth Bypass + Webshell (Root)	SaveFileServlet Unauth → Root RCE
8	Joget Workflow Enterprise	9.1.0.1	9.8	Unauth jrxml Expression Injection (Root)	JasperReports Expression Injection → Root RCE

Highlights

• 6 critical (CVSS ≥ 9.0) · 5 unauthenticated
• Notable: HiveMQ Platform default-credential Zip-Slip to root RCE (IoT/MQTT infrastructure), Biamp Vocia MS-1 hardcoded FTPS credentials to root RCE (public-address/intercom infrastructure), and GigaSpaces XAP unauth path traversal to root RCE (in-memory data grid)
• Attack classes: zip-slip, path traversal, UNC DLL loading, command injection, expression injection, hardcoded credentials, authentication bypass, arbitrary file write

Batch #4 - August 2026 (8 advisories · 5 critical · 5 unauth)

Batch #4 — August 2026

8 advisories · 8 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Fourth batch — expanding coverage into OT/energy, mail servers, IT-asset management, flow analytics, physical access control, instant messaging, broadcast, and CI/CD deployment. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	GE PulseNET Enterprise	6.0.3	9.8	Default creds + Path Traversal (Root)	ResourceFile Path Traversal → RCE
2	Kerio Connect	10.0.9 Patch 2	8.8	Auth Cmd Injection (Root)	Server.startEncryption Cmd Injection → RCE
3	Lansweeper	12.2.1.0	8.8	Auth 2nd-Order SQLi → xp_cmdshell	LicenseActions SQLi → RCE
4	Plixer Scrutinizer	19.7.0	8.8	Auth SQLi → pg_cron RCE	ORDER BY SQLi → RCE
5	Telaeris XPressEntry	3.7.7454	9.8	Unauth SQLi → xp_cmdshell	Unauth SQLi → RCE
6	Output Messenger Server	2.0.x	9.8	Unauth Zip-Slip (SYSTEM)	Zip-Slip Plugin Plant → RCE
7	Cinegy Cinegize	2026-02-05	9.8	Unauth Deserialization (SYSTEM)	BinaryFormatter → RCE
8	MidVision RapidDeploy	5.2.2	9.8	Unauth File Write (Root)	Remote Agent Arbitrary File Write → RCE

Highlights

• 5 critical (CVSS ≥ 9.0) · 5 unauthenticated
• Notable: GE PulseNET Enterprise path traversal to root RCE (power/utility infrastructure), Telaeris XPressEntry unauth SQLi → xp_cmdshell (physical access control), and Cinegy Cinegize unauth BinaryFormatter deserialization (broadcast)
• Attack classes: path traversal, command injection, SQL injection (2nd-order + ORDER BY), zip-slip, deserialization, arbitrary file write
• Coverage: OT/energy, mail, IT-asset management, flow analytics, physical security, IM, broadcast, and CI/CD

Running total

43 advisories · 34 vendors · 34 critical · 33 unauthenticated · all with reproducible PoC.

Next drop: weekly — expanding into ICS / SCADA, energy, and aerospace.

⭐ Star to bookmark · 👁 Watch for the next batch · 🌐 https://0day-rubbish.com/blog

Batch #3 - August 2026 (8 advisories · 8 critical · 8 unauth)

Batch #3 — August 2026

8 advisories · 8 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Third batch — expanding coverage into data platforms, SCADA, BI/reporting, and IoT/embedded systems. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	Confluent Platform	7.9.1-ce	9.8	Unauth RCE (Root)	ksqlDB CREATE SINK CONNECTOR → RCE
2	Ontotext GraphDB	11.4.3	9.8	Unauth RCE (Root)	.pie Ruleset Prefix Injection → RCE
3	ObjectDB	2.9.5	9.8	Unauth RCE (Root)	JDOQL Filter Injection → RCE
4	Wyn Enterprise	9.1.00145.0	9.8	Unauth RCE (Root)	Token Forgery + Zip-Slip + Provider Load → RCE
5	MAPS SCADA	4.0.5.5	9.8	Unauth RCE (SYSTEM)	BinaryFormatter Deserialization → RCE
6	DataStax Enterprise	6.8.49	9.8	Unauth RCE	Gremlin-Groovy Sandbox Bypass → RCE
7	nanoDLP	stable #10729	9.8	Unauth RCE (Root)	G-code Injection → RCE
8	iMonnit Express	4.0.5.5	9.8	Unauth RCE (SYSTEM)	Auth Bypass + Path Traversal + Plugin Load → RCE

Highlights

• 8 critical (CVSS ≥ 9.0) · 8 unauthenticated
• Notable: Confluent ksqlDB → cron root RCE, DataStax Gremlin-Groovy sandbox bypass, and an OT/SCADA SYSTEM RCE (MAPS SCADA)
• Attack classes: code injection, JDOQL injection, deserialization, sandbox bypass, G-code injection, plugin dynamic loading

Running total

35 advisories · 26 vendors · 29 critical · 28 unauthenticated · all with reproducible PoC.

Next drop: weekly → expanding into ICS / SCADA, energy, and aerospace.

⭐ Star to bookmark · 👁 Watch for the next batch · 🌐 https://0day-rubbish.com/blog

Batch #2 - August 2026 (15 advisories · 12 critical · 12 unauth)

Batch #2 — August 2026

15 advisories · 10 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

Second batch — expanding coverage into ICS/SCADA, backup, source-control management, and media systems. Full writeups on https://0day-rubbish.com/blog; PoC code under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
13	Apache Struts 2	6.11.0	9.8	Unauth RCE (Root)	RestfulActionMapper OGNL Injection → RCE
14	AOMEI Cyber Backup	2.3.0	9.8	Unauth RCE (Root)	Thrift NAS Mount Injection → RCE
15	Xeams	10.3 (build 6449)	9.8	Unauth RCE (Root)	SMTP X-SM_SAVE_BODY File Write → RCE
16	Xeams	10.3 (build 6449)	9.8	Unauth RCE (Root)	SQLRunner Derby Hardcoded Creds → JSP Webshell
17	atvise SCADA	3.13.0	9.8	Unauth RCE (Root)	OPC UA Auth Bypass + V8 Injection → RCE
18	CIRCUTOR PowerStudio	24.11.6.0	9.8	Unauth RCE (SYSTEM)	JWT alg=none + shellExecute → RCE
19	CatDV Server	10.7.8	9.8	Unauth RCE (Root)	RMI ClientID Minting → aaftoolPath RCE
20	CatDV Server	10.7.8	9.8	Default Credentials	Factory-Default Empty Admin Password
21	Vicon Valerus	25.200.46.0	9.8	Unauth RCE (SYSTEM)	OWIN Web API Command Injection → RCE
22	Stimulsoft Server	2026.3.1	9.8	Unauth RCE (SYSTEM)	Signup + Report-Script Compilation → RCE
23	Plastic SCM (Unity)	11.0.16.10303	9.8	Unauth RCE	Name-Only ACL 8087 Trigger → RCE
24	vMix	29.0.0.48	9.8	Unauth RCE (Admin)	VBScript Blocklist Bypass → RCE
25	atvise SCADA	3.13.0	8.8	Default-Cred RCE (Root)	WebMI Default Credential + V8 Injection → RCE
26	CIRCUTOR PowerStudio	24.11.6.0	8.6	Auth Bypass	JWT alg=none Identity Forgery
27	CatDV Server	10.7.8	7.6	Auth RCE (Root)	aaftoolPath Property Injection → RCE

Highlights

• 12 critical (CVSS ≥ 9.0) · 12 unauthenticated (incl. default-credential)
• Notable: Apache Struts 2 (9.8, OGNL), two ICS/SCADA RCEs (atvise, CIRCUTOR), and a Unity Plastic SCM unauth RCE
• Attack classes: OGNL injection, Thrift injection, JWT alg=none forgery, V8 injection, VBScript blocklist bypass

Running total

27 advisories · 18 vendors · 21 critical · 20 unauthenticated · all with reproducible PoC.

Next drop: late August 2026 → expanding into ICS / SCADA, energy, and aerospace.

⭐ Star to bookmark · 👁 Watch for the next batch · 🌐 https://0day-rubbish.com/blog

Batch #1 - July 2026 (12 advisories · 9 critical · 8 unauth)

Batch #1 — July 2026

12 advisories · 9 vendors · every advisory ships a full root-cause analysis + a working, reproducible PoC.

First disclosure batch of the AI-driven 0-day series. Full writeups and exploit scripts are published on https://0day-rubbish.com/blog; reproducible PoC code lives in this repo under product/<vendor>/<version>/<type>/exploit/.

#	Product	Affected Version	CVSS	Class	Advisory & PoC
1	InterSystems IRIS	2026.1.0.234.1	9.8	Unauth RCE	FolderManager Property Injection → RCE
2	AdRem NetCrunch	16.0.0.8397 RC	9.8	Unauth RCE (SYSTEM)	Cross-Session Hijack → RCE
3	Altus BluePlant	9.1.40	9.8	Unauth RCE	Hardcoded Credentials → RCE
4	Brekeke SIP Server	v3.19.1.8p1	9.8	Unauth RCE	Nashorn JS Engine → RCE
5	Brekeke SIP Server	v3.19.1.8p1	9.8	Unauth RCE (Zip Slip)	Zip Slip Webshell → RCE
6	DataSunrise Suite	11.2.17.12820	9.8	Unauth RCE	Email Verification Brute Force → RCE
7	Cisco CUCM	14.0	9.8	RCE Chain	Multi-stage RCE Chain
8	SonicWall SMA 1000	12.4.2	9.8	Pre-Auth RCE	Struts 1 Property Injection → Deserialization RCE
9	Brekeke SIP Server	v3.19.1.8p1	9.1	Auth Bypass	Auth Fail-Open → 23 Unauth Beans
10	Acumatica ERP	2026 R1	8.8	Auth RCE	Customization Publish Webshell → RCE
11	AdRem NetCrunch	16.0.0.8397 RC	8.8	Auth RCE (SYSTEM)	Startup Script → RCE
12	Altus iX Developer	2.53.65422	7.3	Local/UI RCE	XAML Deserialization → RCE

Highlights

• 9 critical (CVSS ≥ 9.0) · 8 unauthenticated
• Attack classes: unauth RCE chains, session hijack, hardcoded credentials, deserialization, Zip Slip webshell, auth fail-open
• Vendors span enterprise IT (Cisco, InterSystems, SonicWall), telecom (Brekeke), ERP (Acumatica), and ICS (Altus)

To all vendors: we hope you complete fixes before these are weaponized.

⭐ Star to bookmark · 👁 Watch (custom → Releases + Discussions) for the next drop · 🌐 https://0day-rubbish.com/blog