CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67893

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626

CVE-2026-51626 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the getWiFiWpsCfg function, allowing unauthenticated attackers to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the WPS configuration, includi...

CVE-2026-51639

CVE-2026-51639 is an incorrect access control flaw in the getApWiFiSchCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve AP-specific Wi-Fi scheduling rules...

CVE-2026-51646

CVE-2026-51646 is an incorrect access control vulnerability in the getParentalRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain parental-control rules. The CNA-assigned C...

CVE-2026-51654

CVE-2026-51654 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getScheduleCfg function allows unauthenticated attackers on the adjacent network to send a crafted POST request to /cgi-bin/cstecgi.cgi, thereby retrieving schedule or sc...

CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

TOTOLINK T6 router version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the getTracerouteCfg function. An unauthenticated attacker within the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain traceroute diagnostic logs , exposing networ...

CVE-2026-51627

TOTOLINK T6 (version 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getIptvCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker can obtain IPTV and IGMP configuration information , yielding a high confidentiality impact ...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51629

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getStaticDhcpRules function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to read static DHCP reservation rules. The im...

CVE-2026-51630

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51634

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51620

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

immich -- locked assets remain accessible through shared albums and links

VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk...

CVE-2026-51618

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWizardCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , allowing them to obtain sensitive setup wizard an...

CVE-2026-51641

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control issue within the getWiFiMeshConfig function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to obtain sensitive mesh configuration an...