C-MOR 6.0104 - Directory Traversal

C-MOR 6.0104 - Cross-Site Scripting (XSS)

CubeCart 6.7.4 - SQL injection

CubeCart 6.7.4 - SQL

CubeCart 6.7.4 - Stored XSS

CubeCart 6.7.4 - Cross-Site Scripting

Linksys E1200_2.0.04 - Unauthenticated OS Command Injection

Langflow 1.8.4 - Path Traversal to Remote Code Execution

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Aug 29

CyberDanube Security Research 20260611-0
-------------------------------------------------------------------------------
title| Multiple Denial of Service
product| Dahua DH-IPC-HFW Series
vulnerable version| <=V3.142.0000000.8.R.250826
fixed version| Versions build including and after 2026-03-26.
CVE number| CVE-2026-29115, CVE-2026-29116
impact| High
homepage| https://www.dahuasecurity.com/
found| 20.10.2025
by| T. Weber, S. Eisenreich-Dietz...

Posted by t.preissl via Fulldisclosure on Aug 29

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

Posted by t.preissl via Fulldisclosure on Aug 29

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

Posted by Daniel Owens via Fulldisclosure on Aug 29

On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March
2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of
concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other
JSON parsers. We are publishing, in part, because of the theft of our...

Posted by Aki Tuomi on Aug 29

Hi!

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory will also be published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html

---

Classification: TLP:GREEN

Internal reference: DOV-8476
Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor...

Posted by Evan Tang on Aug 26

https://blog.evan.lat/posts/CVE-2026-65053/

the blog talks about two vulns that are chainable together. for the sake of
brevity ill write up on the stored xss one.

in lib/Mime/Status.php, we see a pretty viable xss sink:

$out .= '<tr><td>' . $val . '</td></tr>';

xrefing this we see that most impls are sanitized with the exception of
lib/Mime/Viewer/Appledouble.php:

$data_name =...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0013
----------------------------------------------------------------------------

[-] Summary:
Eval injection in the Kenwood ITM file format driver of CHIRP, an
open-source application for programming amateur radios, allows an attacker
who can persuade a user to open a crafted radio file to execute arbitrary
Python code with the...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0012
----------------------------------------------------------------------------

[-] Summary:
kamalpanse18 EmpManageX, a Flask-based employee management application,
ships hard-coded administrative credentials in its authentication logic.
The username admin and the plaintext password admin123 are module-level
constants in app.py,...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0011
----------------------------------------------------------------------------

[-] Summary:
Nmap 7.99 and earlier contain a loop with an unreachable exit condition in
the Packet:parse_options() method of nselib/packet.lua. A remote host that
is the target of a scan can exhaust the memory of the scanning Nmap process
and terminate it by...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0010
----------------------------------------------------------------------------

[-] Summary:
Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability
in the IPC command interface exposed by the barrierd.exe service on
127.0.0.1:24801. The IPC server accepts local TCP clients and processes a
command line together...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0009
----------------------------------------------------------------------------

[-] Summary:
NitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN
file transfer receive path. The transfer service is reachable from the local
network on TCP port 40818 and processes incoming transfer metadata without
authentication in...

Posted by Ron E on Aug 26

An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.

An attacker capable of reaching the debugger interface can establish a
debugger session and...