CVE Vulnerability Catalog

In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.

In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during refill retry on a legacy cyclic RQ. When refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer, which may be allocated to another WQE, leading to freeing a live buffer and double-publishing the same UMEM frame. The fix marks the WQE as released immediately after the driver-side free.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during MPWQE refill retry on a striding RQ. When XSK allocation returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll may call xsk_buff_free() again through stale pointers after frames return to the XSK pool. The fix sets all skip_release_bitmap bits in the error path of mlx5e_xsk_alloc_rx_mpwqe().

In the Linux kernel, a bug in btrfs occurs when replacing the value of an extended attribute (xattr) if multiple xattrs are packed into the same btrfs_dir_item. The new btrfs_dir_item is not fully initialized, leading to tree corruption detected by the tree checker during extent buffer writeback.

In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.

The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.

The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.

The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.

The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.

The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.

The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.

The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.

The HotLock WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects HotLock from n/a through 1.3.9.

A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.

A deserialization of untrusted data vulnerability in the ThemeREX ZenSoul WordPress theme allows object injection. The issue affects ZenSoul from n/a through version 1.13.

A deserialization of untrusted data vulnerability in the ThemeREX Group Save Life WordPress theme allows object injection. The issue affects Save Life from n/a through version 1.2.14.

The WebSocket streaming client in agentjido req_llm starts WebSockex without TLS options, so WebSockex defaults to insecure: true and connects with verify: :verify_none, meaning the server certificate is not validated. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot enable verification. The OpenAI Responses, Realtime, and Codex WebSocket paths send the API key or OAuth access token in the authorization header, which an on-path attacker can read and modify.

In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign is vulnerable to deserialization of untrusted data, allowing Object Injection. The issue affects versions up to and including 2.7.8.5.