EUVD-2026-71768

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

PT-2026-86257

An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-79423

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-79426

An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...

CVE-2026-79423

A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...

CVE-2026-79426

The CRMEB v6.0.0 platform contains an arbitrary file deletion vulnerability within the /adminapi/file/video_data_save component. This flaw allows authenticated attackers to delete arbitrary files on the system by sending a crafted POST request . Exploitation details or specific proof-of-concept l...

CVE-2026-84806 Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

CVE-2026-51741

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84202

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84203

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51742: Improper Access Control

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51742

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51741

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-69212

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-69410

llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service std::badalloc and HTTP 500 via a negative topn value in a POST request to /rerank...

CVE-2026-51741

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the clearDiagnosisLog function. This vulnerability allows unauthenticated attackers to erase diagnosis logs by sending a specially crafted POST request to the /cgi-...

CVE-2026-51742

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the discoverWan function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to /cgi-bin/cstecgi.cgi , which triggers...

CVE-2026-51739

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...