CVE-2026-51622

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWanCfg function. An unauthenticated attacker can obtain sensitive WAN configuration data by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploit detail...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the inclusion of functions from an unreliable and uncontrolled area, allows a perpetrator to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cpio (UTSA-2026-092971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-092971 advisory. The cpiosafernamesuffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service out-of-bounds write via a crafted cpio file. Tenable has...

The vulnerability of the lib/nghttp2_session.c component, part of the HTTP/2 implementation by Nghttp2, allows a attacker to cause a service failure.

The vulnerability of the lib/nghttp2session.c component in the HTTP/2 implementation of Nghttp2 is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-83287

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

PT-2026-83129

An issue in the seekdir function /dirent/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37710: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-82259: Deserialization of Untrusted Data

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82256: Uncontrolled Resource Consumption

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

PT-2026-82914

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the emac probe function. This occurs because devm request irq is called before devm platform ioremap resource, allowing an early interrupt to trigger...

EUVD-2026-67911

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-38638

An issue in the withargv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

EUVD-2026-67915

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-78239

Xiiaozet LK100W is a Wi-Fi access point affected by a missing authentication vulnerability in a critical management function. A remote, unauthenticated attacker over the network can invoke this function to enable administrative services that should be restricted, potentially gaining unauthorized ...

CVE-2026-78239 Xiiaozet LK100W Missing Authentication for Critical Function

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device...

CVE-2026-59299

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59298

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59301

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59300

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...