CVE-2026-44629

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

EUVD-2026-67360

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

VulnCheck KEV: CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-51664

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51625

CVE-2026-51625 is an incorrect access control flaw in the getWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi over the network to retrieve sensitive Wi-Fi configuration data, inclu...

CVE-2026-51611

CVE-2026-51611 is an incorrect access control vulnerability in the startSlaveReboot function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated remote attacker can send a crafted MQTT message to force an arbitrary reboot of the device. The vulnerability is rated...

CVE-2026-51614

An incorrect access control flaw in the getAccessDeviceCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker on the adjacent network to disclose access-device policy and client state information by sending a crafted POST request to /cgi-bin/cst...

CVE-2026-51655

CVE-2026-51655 is an incorrect access control flaw in the getMacFilterRules function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker within the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve MAC filter rules, lea...

CVE-2026-51647

CVE-2026-51647 is an incorrect access control flaw in the getCrpcCfg function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain cloud remote-control status and URL information . The CVS...

CVE-2026-51645

CVE-2026-51645 is an incorrect access control flaw in the getPasswordCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can obtain the administrative username by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.8 (Critical) (AV:...

CVE-2026-51658

TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 , suffers from an incorrect access control flaw in the getDmzCfg function. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain DMZ configuration information , resulting in a high confidentiality im...

CVE-2026-51640

CVE-2026-51640 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getMeshNeighborTable function allows an unauthenticated attacker on the adjacent network to obtain mesh neighbor information by sending a crafted POST request to /cgi-bin...

CVE-2026-51610

CVE-2026-51610 is an incorrect access control flaw in the RebootSystem function of the TOTOLINK T6 wireless router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to force an immediate device reb...

CVE-2026-51651

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getSmartQosCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker on an adjacent network can retrieve Smart QoS configuration and rules, resulting in a l...

CVE-2026-51657

CVE-2026-51657 is an incorrect access control flaw in the getSyslogCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve syslog-related configuration from the device. The CNA-...

CVE-2026-51620

CVE-2026-51620 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getNetInfoCfg function allows an unauthenticated, remote attacker to disclose network topology and interface configuration by sending a crafted POST request to /cgi-bin/c...