Loading story…
A self-styled group calling itself 0day Rubbish has publicly released a new batch of enterprise software zero-days on GitHub without coordinated disclosure, publishing working proof-of-concept exploits for vulnerabilities it says can lead to root or SYSTEM remote code execution. The latest batch reportedly includes eight advisories affecting HiveMQ Platform, GigaSpaces XAP, IceWarp Server, KeyHelp, Loadbalancer.org ADC, Biamp Vocia MS-1, Voicent Call Center, and Joget Workflow Enterprise, with most described as critical; the group says five issues are unauthenticated and three require authenticated exploit chains.
The GitHub project presents the campaign as an AI-driven vulnerability production pipeline, claiming it uses multiple LLMs for discovery, followed by fuzzing, code review, manual validation, and exploit development before direct public release. According to the published material, the group has disclosed 51 vulnerabilities across five batches and frames the effort as pressure on vendors to improve security, while warning that future disclosures could expand into ICS/SCADA, energy, and aerospace targets.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
0day Rubbish publicly disclosed an authenticated remote code execution and privilege escalation flaw in ONE Reporter 13.1 via the Full Disclosure mailing list. The advisory said a low-privilege authenticated user could exploit CommandExecutor command injection to execute arbitrary commands as a local-admin service account; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed an unauthenticated remote code execution flaw in JetBrains Datalore On-Premises 2026.2.3 via the Full Disclosure mailing list. The advisory described an InteractiveReport access-mapping flaw allowing anonymous attackers to execute arbitrary code in the notebook agent container, and said the vendor had been notified while a CVE remained pending.
0day Rubbish publicly disclosed a critical vulnerability in RoboTask 11.0.5.1229 via the Full Disclosure mailing list. The advisory said unauthenticated attackers could enumerate and trigger pre-existing tasks through the REST API with Administrator privileges; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed an authenticated command injection vulnerability in VMS 6.48.809 via the Full Disclosure mailing list. The advisory said a low-privileged authenticated attacker could execute arbitrary commands as root over the network without user interaction, and noted the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed an unauthenticated arbitrary file write vulnerability in Tornado 2.11.3 via the Full Disclosure mailing list. The advisory said attackers could abuse storeTo=file: to write to cron and achieve root remote code execution; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed an unauthenticated remote code execution flaw in ActiveFax Server 10.70 via the Full Disclosure mailing list. The advisory said attackers could send a malicious LPD print job exploiting Ghostscript %pipe% command injection to execute arbitrary commands as SYSTEM; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed an authenticated remote code execution flaw in Plixer Scrutinizer 19.7.0 via the Full Disclosure mailing list. The advisory said a SQL injection in the adminEditLang handler could be abused by an authenticated administrator to use pg_cron and a PostgreSQL SUPERUSER role to execute arbitrary commands as the postgres user; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed a pre-authentication remote code execution flaw in Srimax Software's Output Messenger Server 2.0.x (from 2.0.63) via the Full Disclosure mailing list. The advisory said unauthenticated attackers could exploit improper XMPP authentication and a Zip-Slip plugin planting issue to achieve LocalSystem code execution after service restart; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed a pre-authentication remote code execution flaw in MidVision RapidDeploy 5.2.2 via the Full Disclosure mailing list. The advisory said a default remote-agent template exposed JBoss Remoting without authentication, enabling arbitrary file writes that could be leveraged for root-level code execution; the vendor had been notified and a CVE was still pending.
0day Rubbish publicly disclosed a pre-authentication remote code execution flaw in Workflow Enterprise 9.1.0.1 via the Full Disclosure mailing list. The advisory described an expression injection issue enabling unauthenticated root-level code execution, said the vendor had been notified, and noted that a CVE was still pending.
0day Rubbish publicly disclosed a pre-authentication remote code execution flaw in Call Center Suite 10.10.1 via the Full Disclosure mailing list. The advisory described an authentication bypass plus webroot write issue enabling unauthenticated root-level code execution, said the vendor had been notified, and noted that a CVE was still pending.
A GitHub repository under the name "0day Rubbish" was published presenting the group's manifesto and approach of publicly disclosing enterprise software zero-days without vendor coordination.
In describing its activities, the group claimed a cumulative total of 51 vulnerabilities disclosed across five batches. The same material says the vulnerabilities were produced through an automated multi-LLM discovery pipeline followed by fuzzing, code review, manual validation, and exploit development.
The group publicly disclosed a fifth batch of eight advisories affecting HiveMQ Platform, GigaSpaces XAP, IceWarp Server, KeyHelp, Loadbalancer.org ADC, Biamp Vocia MS-1, Voicent Call Center, and Joget Workflow Enterprise. The post says the batch includes five unauthenticated issues and three authenticated deep-chain issues, all with reproducible proof-of-concept exploits leading to root or SYSTEM compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcecyberveille.ch
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A GitHub repository called **"exploitarium"**, operated by the account **`bikini`**, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to **35 project folders and 204 tracked files**, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including **PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git,** and some **PHP** builds. Researchers identified **`CVE-2026-55200`** in **libssh2** as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in **`ssh2_transport_read()`** affecting libssh2 through **1.11.1**, with an upstream fix referenced as commit **`97acf3d`**. Because libssh2 is embedded transitively in widely used software such as **curl** and **Git**, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.
Jul 22, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026