Posted by Evan Tang on Aug 26

https://blog.evan.lat/posts/CVE-2026-65053/

the blog talks about two vulns that are chainable together. for the sake of
brevity ill write up on the stored xss one.

in lib/Mime/Status.php, we see a pretty viable xss sink:

$out .= '<tr><td>' . $val . '</td></tr>';

xrefing this we see that most impls are sanitized with the exception of
lib/Mime/Viewer/Appledouble.php:

$data_name =...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0013
----------------------------------------------------------------------------

[-] Summary:
Eval injection in the Kenwood ITM file format driver of CHIRP, an
open-source application for programming amateur radios, allows an attacker
who can persuade a user to open a crafted radio file to execute arbitrary
Python code with the...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0012
----------------------------------------------------------------------------

[-] Summary:
kamalpanse18 EmpManageX, a Flask-based employee management application,
ships hard-coded administrative credentials in its authentication logic.
The username admin and the plaintext password admin123 are module-level
constants in app.py,...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0011
----------------------------------------------------------------------------

[-] Summary:
Nmap 7.99 and earlier contain a loop with an unreachable exit condition in
the Packet:parse_options() method of nselib/packet.lua. A remote host that
is the target of a scan can exhaust the memory of the scanning Nmap process
and terminate it by...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0010
----------------------------------------------------------------------------

[-] Summary:
Barrier 2.4.0 for Windows contains a local privilege escalation vulnerability
in the IPC command interface exposed by the barrierd.exe service on
127.0.0.1:24801. The IPC server accepts local TCP clients and processes a
command line together...

Posted by advisories on Aug 26

----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0009
----------------------------------------------------------------------------

[-] Summary:
NitroShare Desktop 0.3.4 contains a path traversal vulnerability in its LAN
file transfer receive path. The transfer service is reachable from the local
network on TCP port 40818 and processes incoming transfer metadata without
authentication in...

Posted by Ron E on Aug 26

An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.

An attacker capable of reaching the debugger interface can establish a
debugger session and...

Posted by Ron E on Aug 26

An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.

By launching Escargot using a crafted executable path containing shell
metacharacters and...

Posted by Ron E on Aug 26

Escargot contains a remotely triggerable one-byte stack-based out-of-bounds
write in the WebSocket message handling logic used by the debugger.

When Escargot::DebuggerTcp::receive() receives a binary WebSocket payload
that completely fills the caller-provided stack buffer, the function
successfully copies the payload into the available buffer space but
subsequently appends an additional NUL byte without verifying that space
remains for the...

Posted by Ron E on Aug 26

UltraJSON contains an out-of-bounds read in its native C JSON decoder when
processing certain incomplete JSON values supplied through an explicitly
length-bounded input buffer.

The affected native entry point, JSON_DecodeObject(), accepts both a buffer
pointer and an explicit buffer length:

JSON_DecodeObject(
JSONObjectDecoder *dec,
const char *buffer,
size_t cbBuffer
)

The decoder establishes cbBuffer as the logical boundary of...

Posted by Ron E on Aug 26

The Realtek in-band ioctl bridge contains a heap-buffer overflow when
processing peer-supplied ioctl response data.

inband_ioctl() receives a response through the Realtek in-band transport
and extracts a 32-bit data_get_len value from that response. For several
wireless "get" operations, this peer-controlled value is subsequently used
directly as the length argument to memcpy().

For SIOCGIWSCAN, the destination is a caller-provided...

Posted by Ron E on Aug 26

WatsonWebserver contains an HTTP/1 request body size-limit bypass when
processing requests using Transfer-Encoding: chunked.

The framework's configured Settings.IO.MaxRequestBodySize limit is enforced
when a request declares its body size using Content-Length. However,
requests using chunked transfer encoding are processed through a separate
body-reading path that accumulates decoded chunks into a MemoryStream
without enforcing the same...

Posted by Ron E on Aug 26

Chronicle Wire permits YAML type tags supplied within serialized input to
influence Java class selection and object instantiation during untyped
deserialization.

When applications deserialize attacker-controlled or otherwise untrusted
YAML through APIs such as readObject() or object(Object.class), an
externally controlled YAML type tag can identify a Java class that
Chronicle Wire resolves through its configured ClassLookup.

When the default...

Posted by Ron E on Aug 26

Chronicle Wire's MethodReader implements message dispatch by dynamically
mapping serialized wire events to Java handler methods. During
initialization, the framework discovers public methods exposed by the
registered handler interfaces and registers those methods as callable wire
events.

When a message is processed, the event name supplied within the wire data
determines which registered handler method is selected. Method arguments
are then...

Posted by Ron E on Aug 26

Chronicle Wire's FileMarshallableOut follows symbolic links when writing
files in append mode. When ?append=true is enabled, the implementation
opens the supplied output path directly using FileOutputStream(path, true)
without preventing symbolic-link resolution.

If an attacker can create or replace the expected output file with a
symbolic link before the append operation occurs, the operating system
resolves the link and Chronicle Wire...