CVE-2026-51706

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling , resulting in a low a...

CVE-2026-51733

An incorrect access control flaw in the FirmwareUpgrade function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated CVSS 9.8 (CR...

CVE-2026-51696

CVE-2026-51696 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ), where an incorrect access control flaw in the setPortForwardRules function allows an unauthenticated attacker to expose internal services by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability i...

PT-2026-83836

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity. This is achieved by sending a crafted POST request to th...

jfrog-cli-2.122.0-1.1 on GA media (moderate)

jfrog-cli-2.122.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11631-1 Rating: moderate Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA...

RockyLinux 9 : nodejs:22 (RLSA-2026:61383)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61383 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

SUSE SLES15 Security Update : kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP5) (SUSE-SU-2026:3807-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3807-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.177 fixes various security issues: The following security issues were fixed:...

RockyLinux 9 : nodejs:24 (RLSA-2026:61386)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61386 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

SUSE SLES12 Security Update : kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3808-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3808-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.317 fixes various security issues: The following security issues were fixed: -...

Fedora 44 : nebula (2026-08fe186b29)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-08fe186b29 advisory. Update to 1.11.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Amazon Linux 2 : libXfont, --advisory ALAS2-2026-3890 (ALAS-2026-3890)

The version of libXfont installed on the remote host is prior to 1.5.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3890 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

Linux Distros Unpatched Vulnerability : CVE-2023-42179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process. CVE-2023-42179...

RHEL 10 : nodejs24 (RHSA-2026:61377)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61377 advisory. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an...

Fedora 43 : hcloud (2026-b661d1a235)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b661d1a235 advisory. Update to 1.67.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

CVE-2026-51716

CVE-2026-51716 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control in the delPortForwardRules function allows an unauthenticated attacker to delete port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The primary impact ...

CVE-2026-51698

An incorrect access control vulnerability in the setUrlFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated, remote attacker to alter URL browsing policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The flaw is rated CVSS 9.1 (...

EUVD-2026-68642

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68643

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68635

Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51722

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...