Critical Alert 4 Active Exploits Detected Today

CVE-2026-56155 — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability →
CVE-2026-56164 — Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability →
CVE-2026-15409 — SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability →
CVE-2026-15410 — SonicWall SMA1000 Appliances Code Injection Vulnerability →
Powered by CVE Watchtower
×
July 15, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-62948NVD

Vulnerability Summary

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
Severity Level
CRITICAL(9.6)
Published Date
Jul 15, 2026
Last Modified
Jul 15, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-79: Cross-site Scripting (XSS) ↗
The software does not neutralize user-controllable input before it is placed in output that is used as a web page.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

External References