CVE-2026-51655: Improper Access Control

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51618: Improper Access Control

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626: Improper Access Control

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51629: Improper Access Control

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51661: Improper Access Control

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663: Improper Access Control

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67925

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51614: Improper Access Control

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51613: Improper Access Control

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-53578

creationtimestamp| type| source ---|---|--- 2026-08-27 22:09:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uevydce2e 2026-08-28 07:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4ubtmnvu2c...

CVE-2026-19092

creationtimestamp| type| source ---|---|--- 2026-08-27 22:08:52+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uefzlzk2t 2026-08-28 08:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4vfmgy762j 2026-09-01 12:00:06+00:00| confirmed|...

CVE-2026-69543

creationtimestamp| type| source ---|---|--- 2026-08-27 22:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3ubafakl2c...

CVE-2026-81525

creationtimestamp| type| source ---|---|--- 2026-08-27 22:00:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fdi7tx66oeqsz 2026-08-27 23:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3xbkhsju2z 2026-08-28 12:45:52+00:00| seen|...

CVE-2026-75325

creationtimestamp| type| source ---|---|--- 2026-08-27 21:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu3tcscpy42j...

CVE-2026-81728

creationtimestamp| type| source ---|---|--- 2026-08-27 21:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3qkelswu2o 2026-09-01 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3muhlrktkrh2w 2026-09-03 13:35:40+00:00| seen|...

GO-2026-6297 linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server

linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service DoS via a crafted POST request in github.com/andreimarcu/linx-server...

CVE-2026-81699

creationtimestamp| type| source ---|---|--- 2026-08-27 19:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3jutedft2r 2026-08-31 20:01:25+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mufp45rg2u2r 2026-09-04 08:37:06+00:00| seen|...

CVE-2026-65053

creationtimestamp| type| source ---|---|--- 2026-08-27 18:19:29+00:00| seen| https://bsky.app/profile/hacker.at.thenote.app/post/3mu3hk763c22q...

PYSEC-2026-3779

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

PYSEC-2026-3779

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...