exploit-garbage/0day-rubbishRedefining vulnerability disclosure in the AI era. We mass-produce exploitable 0days and disclose them directly, using event-driven pressure to elevate vendor security standards and advance the field.
🌐 Official Website: https://0day-rubbish.com/blog
Traditional vulnerability disclosure is broken. It's slow, bureaucratic, and ineffective. In the AI era, we can mass-produce 0days at scale—making individual vulnerabilities less valuable but more impactful when disclosed directly.
We believe event-driven security hardening is the most effective approach: only when vendors face real, exploitable threats do they prioritize fixes.
Our automated AI systems continuously scan for vulnerabilities across real-world software, identifying potential 0-days through pattern analysis, fuzzing, and intelligent code review.
Each finding undergoes manual validation. We develop working proof-of-concept exploits to confirm exploitability and assess real-world impact.
Roughly every two weeks we disclose a new batch of verified, exploitable 0-day vulnerabilities we've discovered and validated:
No delays. No bureaucracy. Just facts.
To all vendors: We hope you can complete fixes before hackers exploit these vulnerabilities.
We partner with:
Our automated vulnerability discovery leverages cutting-edge large language models from leading AI providers:
An AI-driven research process (multi-LLM ensemble: Claude, OpenAI, DeepSeek, GLM, Kimi) discovers 0-days in real-world enterprise software. Every advisory below ships a full root-cause analysis plus a working, reproducible exploit script — no detection-only writeups, no withheld details.
| # | Product | Affected Version | CVSS | Class | Advisory & PoC |
|---|---|---|---|---|---|
| 1 | NoMachine Terminal Server (VULN-001) | 10.0.57 | 9.8 | Pre-auth heap corruption (CWE-787→416), RCE-capable | parsePOST heap → corruption |
| 2 | NoMachine Terminal Server (VULN-002) | 10.0.57 | 9.8 | Pre-auth stack overflow, return-address control | parsePOST sprintf → RIP control |
| 3 | StreamSets DataCollector | 6.4.1 | 9.8 | Default creds + Shell Executor → Root | ShellDExecutor → Root RCE |
| 4 | Akana API Platform | 8.4.29 | 9.8 | Unauth path-normalization bypass → ScriptEngine RCE | admin/../ext → engine.eval RCE |
| 5 | Puppet Enterprise | 2025.10.0 | 8.8 | Auth keytool shell injection → Root (CVE-2025-5459 bypass) | java_keystore_passwd → Root RCE |
| 6 | Minuteman UPS NMC | 1.60.3 | 9.8 | Unauth system_param.csp Cmd Injection → Root | WAN config → Root RCE |
| 7 | Lantronix EDS3000PR (VULN-001) | 3.2.0.0R2 | 8.8 | Auth FsUnmount Cmd Injection → Root | FsUnmount path → Root RCE |
| 8 | Lantronix EDS3000PR (VULN-002) | 3.2.0.0R2 | 8.8 | Auth SSL -passin pass:%s Cmd Injection → Root | keytool pass → Root RCE |
Totals: 12 advisories · 10 vendors · 4 unauthenticated · 8 authenticated (deep-chain) · 10 system-level (root/SYSTEM) · all with reproducible PoC.
Earlier batches: Batch #1 · Batch #2 · Batch #3 · Batch #4 · Batch #5 · Batch #6 · Batch #7 · Batch #8
This is a continuous disclosure series. Thanks to continuous optimization, the AI-driven discovery pipeline now produces new 0-day findings at a stable daily rate, and we disclose verified batches on a weekly cadence.
If you want to catch the next drop the moment it lands:
⭐ Star to bookmark · 👁 Watch (custom → Releases + Discussions) for new batches · 🌐 Follow the blog for per-advisory updates.
All disclosed vulnerabilities follow a standardized directory structure:
product/
└── <vendor>/
└── <version>/
└── <vulnerability_type>/
├── exploit/ # Exploit scripts and PoC code
├── analysis.md # Detailed vulnerability analysis
└── summary.md # Brief vulnerability overview
apache, cisco, sonicwall)6.11.0, 12.4.2)unauth-rce, auth-bypass, deserialization-rce)product/
└── sonicwall/
└── sma-12.4/
└── preauth-deserialization-rce/
├── exploit/
│ └── poc.py
├── analysis.md
└── summary.md
Join us in redefining vulnerability disclosure for the AI era.
| 9 | GeoVision GV-TBL4700 | V1.06 | 8.8 | Auth SNMPv3 net-snmp-config Cmd Injection → Root | szAuthKey → Root RCE |
| 10 | DrayTek Vigor 2960 | v1.5.1.6 | 8.8 | Auth uploadlangs Cmd Injection → Root | cgiEscape gap → Root RCE |
| 11 | Codoforum | 5.4.1 | 7.2 | Auth cat_img polyglot upload → www-data | polyglot upload → RCE |
| 12 | ZesleCP | 3.1.21 | 8.8 | Auth arbitrary file write → cron → Root | save-file → cron Root RCE |