CVE-2026-81517

creationtimestamp| type| source ---|---|--- 2026-08-29 05:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu73txpiib2m...

PT-2026-83404

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-59313

creationtimestamp| type| source ---|---|--- 2026-08-28 23:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu6hovg3sk2b...

CVE-2026-82017

creationtimestamp| type| source ---|---|--- 2026-08-28 22:37:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/buzdraobdsxip 2026-08-29 00:01:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu6l5fd2ov22...

CVE-2026-3686

creationtimestamp| type| source ---|---|--- 2026-08-28 22:31:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cdkyeqexdo33c...

GHSA-MRPP-V6PG-P54X

creationtimestamp| type| source ---|---|--- 2026-08-28 22:19:38+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mu6fgl7bp42g 2026-08-29 15:32:25+00:00| seen| https://gist.github.com/alon710/a4189f000966d11dd547e0bc128cf503...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82281

creationtimestamp| type| source ---|---|--- 2026-08-28 22:09:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu6etyi4qo2p 2026-08-29 18:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muajmuznvc2t...

CVE-2026-75126

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation:...

CVE-2026-51646

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51649

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51651

Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Smart QoS configuration and rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51653

Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain storage feature state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51655

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51637

Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh portal table information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51645

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51642

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51632

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...