EUVD-2026-68542

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-38577: Use of Hard-coded Credentials

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

Linux Distros Unpatched Vulnerability : CVE-2026-59683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full...

PT-2026-83734

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e- roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

PT-2026-83976

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

EUVD-2026-68879

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

CVE-2026-38577

The Tenda HG21 (XPON Fiber Modem) , specifically version V4.0.0-260302 (Product Key: HG21-V1.0-TDE01 , Hardware Version: V1.0 ), is vulnerable to the use of hardcoded credentials (CWE-798) in the shipped firmware. Firmware analysis reveals a static admin account with a password hash resolving to ...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679: Improper Access Control

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68881

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

Exploit for Type Confusion in Google Chrome

CVE-2026-78905 — Meta-Phishing Facebook Graph API — OAuth...

Exploit for Code Injection in Gitea

🫖 CVE-2026-60004 — Gitea RCE PoC A direct, single-target va...

CVE-2026-82653

creationtimestamp| type| source ---|---|--- 2026-08-30 16:02:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucrb67gkf27 2026-08-30 16:07:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mucrkndz762c 2026-08-30 16:10:07+00:00| seen|...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980

The MyHome Core WordPress plugin (all versions ≤ 4.4.5) contains an Authentication Bypass caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. Unauthenticated attackers can generate an activation token for an unconfirmed user ac...

Linux Distros Unpatched Vulnerability : CVE-2026-82466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other accoun...

[SECURITY] [DLA 4760-1] roundcube security update

Debian LTS Advisory DLA-4760-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 29, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11 CVE ID : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999...