Posted by Thomas Weber | CyberDanube via Fulldisclosure on Aug 29

CyberDanube Security Research 20260611-0
-------------------------------------------------------------------------------
title| Multiple Denial of Service
product| Dahua DH-IPC-HFW Series
vulnerable version| <=V3.142.0000000.8.R.250826
fixed version| Versions build including and after 2026-03-26.
CVE number| CVE-2026-29115, CVE-2026-29116
impact| High
homepage| https://www.dahuasecurity.com/
found| 20.10.2025
by| T. Weber, S. Eisenreich-Dietz...

Posted by t.preissl via Fulldisclosure on Aug 29

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

Posted by t.preissl via Fulldisclosure on Aug 29

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code...

Posted by Daniel Owens via Fulldisclosure on Aug 29

On 26 October 2025 we published "Struts2 and Related Framework Array/Collection DoS", which was followed up on 07 March
2026 by "JSON Deserialiser Unconstrained Resource Consumption Quick Overview". Today we are publishing a proof of
concept that we have been using for more than 15 years against Struts2, Newtonsoft JSON, JSON.org, and various other
JSON parsers. We are publishing, in part, because of the theft of our...

Posted by Aki Tuomi on Aug 29

Hi!

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. This advisory will also be published at
https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html

---

Classification: TLP:GREEN

Internal reference: DOV-8476
Type: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor...