Full Disclosure

A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

URL: https://seclists.org/#fulldisclosure

Updated: 10 hours 50 min ago

APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5

17 May, 2026 - 16:16

Posted by Apple Product Security via Fulldisclosure on May 17

APPLE-SA-05-11-2026-1 iOS 26.5 and iPadOS 26.5

iOS 26.5 and iPadOS 26.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/en-us/127110.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Accelerate
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro...

Full disclosure: Impersonation attacks on Edupage portal

17 May, 2026 - 16:14

Posted by Juraj Kosik on May 17

VULNERABILITY
Non-sanitised submission of malicious SVG files on the Edupage portal in
combination with CSRF vulnerability allows triggering various actions on
behalf of other users, e.g. identity spoofing, sending fake messages,
giving fake approvals, etc.

Full disclosure report: https://jkosik.github.io/posts/edupage/
Reference: https://www.edupage.org/

VENDOR:
Applied Software Consultants

PRODUCT:
Edupage - https://www.edupage.org/
Web...

Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes

17 May, 2026 - 16:14

Posted by Juraj Kosik on May 17

VULNERABILITY
Both authenticated and publicly accessible anonymous guest accounts on
Edupage portal allow an attacker to capture the complete list of user IDs,
names (students, parents, and teachers), and the associated banking details
(IBAN codes)

Full disclosure report: https://jkosik.github.io/posts/edupage/
Reference: https://www.edupage.org/

VENDOR:
Applied Software Consultants

PRODUCT:
Edupage - https://www.edupage.org/
Web application...

Dovecot Security Advisory OXDC-2026-0002

17 May, 2026 - 16:11

Posted by Aki Tuomi on May 17

Hi!

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory is also published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0002.html

---

Classification: TLP:GREEN

Internal reference: DOV-8967
Type: CWE-235 (Improper Handling of Extra Parameters)
Component: core
Report confidence: Confirmed
Solution...

ESP-RFID-Tool v2 PRO — Full Public Disclosure

29 April, 2026 - 12:46

Posted by Milan Berger via Fulldisclosure on Apr 29

# Security Advisory: ESP-RFID-Tool v2 PRO

**Product:** ESP-RFID-Tool v2 PRO
**Vendor:** Raik Schneider (Einstein2150), foto-video-it.de
**Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2
**Affected Version:** v2.2.1 (latest as of 2026-04-28)
**Severity:** CRITICAL
**Disclosure Type:** Full Public Disclosure
**Disclosure Date:** 2026-04-28
**Researcher:** Milan 't4c' Berger

---

## Disclosure Timeline

| Date | Event |...