CVE-2026-51711

CVE-2026-51711 is an incorrect access control vulnerability in the setWiFiWpsStart function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to open a WPS (Wi-Fi Protected Setup) pairing window , rated...

CVE-2026-51723

CVE-2026-51723 is an incorrect access control vulnerability in the UploadCustomModule function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to install a custom CGI module on the device. The CVSS 3.1 ...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setUPnPCfg function, accessible via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated network attacker can send a crafted POST request to change the UPnP service state , achieving high confident...

CVE-2026-51718

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 has an incorrect access control flaw in the delStaticDhcpRules function, allowing an unauthenticated attacker to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated CVSS 9.8 (Critical) wi...

EUVD-2026-68743

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684

TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setStorageCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the storage-related service state, with no user interaction requir...

CVE-2026-51709

CVE-2026-51709 is an incorrect access control vulnerability in the setWiFiBasicCfg function of the TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 . Unauthenticated attackers can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS...

CVE-2026-51737

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the clearTracerouteLog function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to erase traceroute logs, enabling concealment of reconnaissance activity. Th...

CVE-2026-51693

CVE-2026-51693 is a critical access-control flaw in the setVpnPassCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to weaken the router's edge filtering. The flaw carries a CVSS 3.1 score ...

CVE-2026-51708

CVE-2026-51708 is a critical (CVSS 9.8) incorrect access control vulnerability in the setWiFiWpsCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated, network-based attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change WPS availabi...

CVE-2026-51738

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the LoadDefSettings function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reset the device's configuration and trigger a reboot, resulting in h...

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge web browsers allows a hacker to compromise data integrity.

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

CVE-2026-51720

An incorrect access control vulnerability in the delIpPortFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to delete firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The NVD-assigned CVSS v3.1 score ...

SUSE SLES15 Security Update : kernel (Live Patch 57 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:3829-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3829-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.228 fixes various security issues: The following security issues were fixed:...

CVE-2026-51671

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getCloudDownloadStatus function, exposed through the endpoint /cgi-bin/cstecgi.cgi. An unauthenticated attacker can send a crafted POST request to retrieve cloud firmware download state information...

Linux Distros Unpatched Vulnerability : CVE-2026-82660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local...

Linux Distros Unpatched Vulnerability : CVE-2026-80696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add...

Linux Distros Unpatched Vulnerability : CVE-2026-18702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the enti...

RHEL 10 : nodejs22 (RHSA-2026:61376)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61376 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...