EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

EUVD-2026-68650

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68641

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68672

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68675

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68671

Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Smart QoS rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83885

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68876

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-51668

CVE-2026-51668 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setLanguageCfg function allows an unauthenticated attacker to modify the device's language configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The C...

EUVD-2026-68713

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51736

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83891

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51738

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686

CVE-2026-51686 is an incorrect access control flaw in the setWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure or disable wireless networks. The CVSS 3.1 score...

CVE-2026-51676

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setAccessDeviceCfg function. An unauthenticated network attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter access-device policies , with potential high impact on both c...

CVE-2026-51721

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the setPairCfg function. An unauthenticated attacker can alter the mesh pairing state by sending a crafted POST request to /cgi-bin/cstecgi.cgi over the network with no privileges or user interaction ...

CVE-2026-51728

CVE-2026-51728 is an incorrect access control flaw in the UploadFirmwareFile function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to upload a crafted firmware image , potentially leading to full ...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51680

An incorrect access control vulnerability in the setLedCfg function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to modify LED behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with ...

CVE-2026-51689

TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setUpgradeFW function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to trigger firmware-upgrade workflow changes, rated CVSS 9.1 (CRITICA...