CVE-2026-51645

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51642

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51632

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51635

Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51634

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51619

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51615

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82252

creationtimestamp| type| source ---|---|--- 2026-08-28 20:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu65pqvz6227...

CVE-2026-81285

creationtimestamp| type| source ---|---|--- 2026-08-28 20:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu65pjvucs27...

CVE-2026-77063

creationtimestamp| type| source ---|---|--- 2026-08-28 19:58:10+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mu65jia53s2k...

CVE-2026-77037

creationtimestamp| type| source ---|---|--- 2026-08-28 19:48:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mu64x7sf222k 2026-08-29 06:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu77chep2i2r...

CVE-2026-19234

creationtimestamp| type| source ---|---|--- 2026-08-28 18:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5yynzt3f2m...

CVE-2026-17100

creationtimestamp| type| source ---|---|--- 2026-08-28 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5vneox562y...

CVE-2026-17093

creationtimestamp| type| source ---|---|--- 2026-08-28 17:07:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5txqav5c24...

CVE-2026-17494

creationtimestamp| type| source ---|---|--- 2026-08-28 16:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5sc3d7xf22...

EUVD-2026-67817

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286

gpt-crawler through version 1.5.1 (BuilderIO) is vulnerable to an arbitrary file write via the outputFileName parameter in the POST /crawl endpoint. The root cause is a failure to validate this parameter, allowing unauthenticated attackers to supply absolute paths or parent-directory segments and...

CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...