PT-2026-84453

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer versions prior to 7.4.0 Description Issues in the API allow an unauthenticated remote attacker to bypass authentication controls. This could enable an attacker to obtain administrative privileges and achieve remo...

VulnCheck KEV: CVE-2023-54391

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2026-51747

TOTOLINK T6 mesh Wi-Fi routers (firmware 4.1.5cu.748_B20211015 ) suffer from an incorrect access control flaw in the keepAlive function. An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to emit indirect mesh heartbeat information toward the master nod...

CVE-2026-51767

CVE-2026-51767 is a critical (CVSS 3.1: 9.8 ) incorrect access control vulnerability in the recvClearPairCfg function of the TOTOLINK T6 mesh router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on the network can send a crafted MQTT message to the cs_broker component to reset th...

CVE-2026-51751

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

CVE-2026-51747

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the csbroker component...

CVE-2026-51769

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

Linux Distros Unpatched Vulnerability : CVE-2026-53682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating...

PT-2026-84378

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1 Description An unauthenticated remote attacker can cause a remote Denial of Service DoS by initiating a gRPC stream and fragmenting the payload into millions of small HTTP/2 DATA frames. In the...

PT-2026-84529

Name of the Vulnerable Software and Affected Versions Proxmox Virtual Environment VE versions 7.0 through 8.0 Description An authentication bypass exists in libpve-access-control that allows unauthenticated attackers to authenticate as any enabled user who does not have a second factor configured...

CVE-2026-51760

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the informSyncUpgfw function, mediated through the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to mass-trigger firmware update activity across a...

CVE-2026-51756

An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-51754

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). Unauthenticated attackers can overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The CVSS 3....

PT-2026-84405

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

EUVD-2026-69379

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...

CVE-2026-51751

CVE-2026-51751 is a critical (CVSS 9.8) incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from loc...

EUVD-2026-69209

Incorrect access control in the recvmeshinfosync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69378

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51764

An incorrect access control flaw in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...