EUVD-2026-67893

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631: Improper Access Control

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51664: Improper Access Control

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51664

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the getDdnsStatus function. This flaw allows unauthenticated attackers to retrieve DDNS runtime status and public IP information by submitting a crafted POST request to the /cgi-bin...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623: Improper Access Control

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51647: Improper Access Control

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-53578

creationtimestamp| type| source ---|---|--- 2026-08-27 22:09:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uevydce2e 2026-08-28 07:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4ubtmnvu2c...

CVE-2026-81680

creationtimestamp| type| source ---|---|--- 2026-08-27 19:24:01+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117169103851890443 2026-08-28 08:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4xn35co725 2026-08-29 15:30:03+00:00| seen|...

CVE-2026-68861

creationtimestamp| type| source ---|---|--- 2026-08-27 19:10:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117169049441350258 2026-08-29 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu6vimppxt23...

CVE-2026-69519

creationtimestamp| type| source ---|---|--- 2026-08-27 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3ijqlmnk2h...

SUSE CVE-2026-55227

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

CVE-2026-1512

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/255 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/255 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/255...

GHSA-F558-MP87-58VJ

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/270 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/270 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/270...

CVE-2026-27579

creationtimestamp| type| source ---|---|--- 2026-08-27 15:00:12+00:00| seen| https://t.me/cve0day/257 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/257 2026-08-29 00:00:30+00:00| published-proof-of-concept| https://t.me/cve0day/257...

CVE-2026-81574

creationtimestamp| type| source ---|---|--- 2026-08-27 11:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2p267o7c2l 2026-08-27 11:01:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ibazv6h46utsr 2026-09-15 08:17:47+00:00| seen|...