PT-2026-83893

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

CVE-2026-51730 is an incorrect access control vulnerability in the delWiFiAclRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove Wi-Fi ACL rules , potentially allowing unauthorize...

CVE-2026-51668

CVE-2026-51668 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setLanguageCfg function allows an unauthenticated attacker to modify the device's language configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The C...

CVE-2026-51686

CVE-2026-51686 is an incorrect access control flaw in the setWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure or disable wireless networks. The CVSS 3.1 score...

CVE-2026-51704

CVE-2026-51704 is an incorrect access control vulnerability in the setWiFiMeshConfig function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter WiFi mesh configur...

CVE-2026-51721

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the setPairCfg function. An unauthenticated attacker can alter the mesh pairing state by sending a crafted POST request to /cgi-bin/cstecgi.cgi over the network with no privileges or user interaction ...

ALSA-2026:61383 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

PT-2026-83831

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setStorageCfg function allows unauthenticated attackers to alter the storage-related service state. This is achieved by sending a crafted POST request to the...

CVE-2026-51701

CVE-2026-51701 is an incorrect access control flaw in the setMacFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to modify the device's MAC filter rules , effectively alteri...

CVE-2026-51689

TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setUpgradeFW function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger firmware-upgrade workflow changes, rated CVSS 9.1 (CRITICA...

Linux Distros Unpatched Vulnerability : CVE-2026-82659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-80599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself i...

Amazon Linux 2 : libXfont2, --advisory ALAS2-2026-3889 (ALAS-2026-3889)

The version of libXfont2 installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3889 advisory. A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font...

The vulnerability of the uncore_discoverypci() function in the arch/x86/events/intel/uncore_discovery.c module of the Linux operating system’s x86 kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the uncorediscoverypci function in the arch/x86/events/intel/uncorediscovery.c module of the Linux operating system’s x86 kernel is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-80688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and...

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

CVE-2026-51724

TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 , is affected by an incorrect access control flaw in the delSmartQosCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to remove Smart QoS rules , rated CVSS 3.1 9.8 (Critical) with high impact on co...

EUVD-2026-68541

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673

CVE-2026-51673 is an incorrect access control vulnerability in the setNtpCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's time synchronization (NTP) settings , resulti...