CVE-2026-51614

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51618

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51611

Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message...

CVE-2026-51616

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51610

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51617

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-51613

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

UBUNTU-CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

EUVD-2026-66713

Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project...

GHSA-786W-P5PM-CVGH phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

Summary phpSysInfo's PSIALLOWED IP allowlist can be trivially bypassed by any unauthenticated remote attacker. The access-control check in readconfig.php derives the client IP from the attacker-controlled X-Forwarded-For and Client-IP HTTP headers before falling back to REMOTEADDR. An attacker ca...

CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584

phpSysInfo versions ≤ 3.4.5 contain an IP allowlist bypass in the PSI_ALLOWED check within read_config.php. The vulnerable code resolves the client IP from attacker-controlled X-Forwarded-For and Client-IP headers before falling back to REMOTE_ADDR, with no trusted-proxy concept. A remote unauthe...

CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-55425 Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-55425

Graylog (free and open log management platform) has an authorization flaw in the System Catalog entity titles endpoint (EntityTitleServiceImpl.java). An authenticated user can request composite display fields without the server verifying that every selected field is readable, allowing retrieval o...

EUVD-2026-42984

Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...

EUVD-2026-44960

Yamcs: Insecure Direct Object Reference IDOR in PacketsApi allows unprivileged users to dump all telemetry packets...

GHSA-FWWW-CP23-7F5G Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...