PT-2026-93311

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

PT-2026-93305

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

PT-2026-94036

Name of the Vulnerable Software and Affected Versions Harness versions prior to 3.3.0 Description Authenticated users can retrieve provider configurations from spaces to which they do not belong due to missing access control validation in the infrastructure provider read endpoint. By querying the...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38437)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setRemoteCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

PT-2026-93978

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description Improper access control issues exist within the software, categorized under CWE-284, which refers to the failure to properly restrict access to a component or function...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38563)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setVpnPassCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38584)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the discoverWan function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38589)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the meshInfoKick function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38556)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38560)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setUploadSetting function. Attackers can exploit this vulnerability by sending specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38423)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the NTPSyncWithHost function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38434)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setPairCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38568)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setWiFiEasyCfg function. Attackers can exploit this vulnerability by sending a specially crafted POS...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38586)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the guestwifisync function. Attackers can exploit this vulnerability by sending a specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38582)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the clearDiagnosisLog function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38594)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an improper access control in the recvIndirectMeshInfo function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38420)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the informSlaveUpdate function. Attackers can exploit this vulnerability by sending a specially crafted POS...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38407)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delPortForwardRules function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38406)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to improper access control. This vulnerability stems from issues with the delParentalRules function, allowing attackers to exploit it by sending a specially crafted POST request to th...

PT-2026-94106

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A broken access control flaw exists in the 'actions/nested-elements/reorder' endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries permissions but lacking...