odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.
A critical stack-based buffer overflow vulnerability exists in the odhcpd DHCPv6 IA response handler used by OpenWrt. Versions prior to 25.12 are affected. The flaw allows writing beyond a fixed 512-byte stack buffer when processing DHCPv6 REQUEST packets with many IA options. The vulnerability is reachable remotely via unauthenticated UDP packets and runs with root privileges. This can lead to remote code execution, especially on embedded devices lacking typical memory protections. The issue has been fixed in OpenWrt version 25.12.
An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar. ZCS 10.1.16 and 10.1.21 are affected.
An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction. ZCS 10.1.16 and 10.1.21 are affected.
An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction. ZCS 10.1.16 and 10.1.21 are affected.
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
SignalK signalk-server versions from 2.28.0-beta.2 up to but not including 2.34.0 contain a server-side request forgery (SSRF) vulnerability. This flaw exists in the App Store icon fetcher component, which trusts absolute URLs for signalk.appIcon. An attacker can publish npm packages with Signal K keywords that cause the server to make requests to internal or cloud metadata endpoints. The responses, if image-typed, are then stored and served back via the admin UI. The vulnerability has a low CVSS 4.0 score of 2.3 and does not have known exploits in the wild.
Agentfront mcp-from-openapi versions from 2.2.0 up to but not including 2.9.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to bypass the denylist of blocked hosts by appending a trailing dot to hostnames, enabling unauthorized requests to operator-blocked hosts. The vulnerability arises from incomplete filtering of disallowed inputs in the OpenAPI specification URL or redirect targets.
A vulnerability in agentfront's mcp-from-openapi versions 2.5.0 up to but not including 2.9.0 allows attackers to capture Authorization and Cookie headers. This occurs because the safeFetch() function forwards these sensitive headers on cross-origin redirects, enabling attackers controlling a spec host or exploiting an open redirect to steal bearer tokens or cookies.
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.
CVE-2026-112848 is a critical deserialization of untrusted data vulnerability in AivahThemes Hostme v2. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects Hostme v2 versions from 0 up to and including 7.0. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. No patch or remediation information is provided in the available data.
A Cross-site Scripting (XSS) vulnerability exists in AivahThemes Hostme v2, identified as CVE-2026-112849. This vulnerability involves improper neutralization of input during web page generation, allowing DOM-based XSS attacks. It affects Hostme v2 versions up to and including 7.0. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or remediation information is currently provided.
CVE-2026-112850 is a high-severity vulnerability in AncoraThemes Your Dress (versions up to 1.4.1) involving improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. This flaw allows an attacker to include unauthorized files on the server, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-112854 is a critical deserialization of untrusted data vulnerability in axiomthemes Holistic Center up to version 1.2.6. It allows object injection, which can lead to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are currently provided.
A critical deserialization of untrusted data vulnerability (CVE-2026-112847) exists in ThemeREX ZenSoul up to version 1.13. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector and no required privileges or user interaction.
A critical deserialization of untrusted data vulnerability (CVE-2026-112846) exists in ThemeREX Group Save Life save-life, allowing object injection. This affects versions up to and including 1.2.14. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.
CVE-2026-112851 is a critical vulnerability in ThemeREX Group HotLock up to version 1.3.9 that allows deserialization of untrusted data leading to object injection. This flaw can be exploited remotely without authentication and results in full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-112852 is a high-severity vulnerability in ThemeREX Group Helion up to version 1.1.12. It involves deserialization of untrusted data, which allows object injection. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 8.1, indicating a network attack vector with high impact but requiring high attack complexity and no privileges or user interaction.