CVE-2026-51696

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the setPortForwardRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi , which may result in the exposure of internal servic...

CVE-2026-51736

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the clearSyslog function. This vulnerability allows unauthenticated attackers to erase system logs by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No spe...

CVE-2026-51688

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiSignalCfg function. An unauthenticated attacker can send a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to either reduce the wireless power or trigger a Denial of Serv...

CVE-2026-51690

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51695

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the setDdnsCfg function. This flaw allows unauthenticated attackers to alter the dynamic DNS state by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Exploitati...

CVE-2026-51679

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setPasswordCfg function. This vulnerability allows an unauthenticated attacker to change the administrator account by sending a crafted POST request to the /cgi-bin/cstecgi.cgi ...

CVE-2026-51712

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the setApWiFiSchCfg function. This vulnerability allows unauthenticated attackers to modify wireless availability windows by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint...

CVE-2026-51715

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83725

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

PT-2026-83899

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the delDevice function. This security weakness allows unauthenticated attackers to delete a managed slave device by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. E...

CVE-2026-51733

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015) is vulnerable to an incorrect access control flaw within the FirmwareUpgrade() function. This vulnerability allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

Linux Distros Unpatched Vulnerability : CVE-2023-42179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation process. CVE-2023-42179...

CVE-2026-51717

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setOpModeCfg function. This flaw allows unauthenticated attackers to change the device operating mode by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific reme...

CVE-2026-51686

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiEasyCfg function. This vulnerability allows unauthenticated attackers to reconfigure or disable wireless networks by sending a crafted POST request to the /cgi-...

CVE-2026-51689

The TOTOLINK T6 router, specifically version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability in the setUpgradeFW() function. This flaw allows unauthenticated attackers to trigger firmware-upgrade workflow changes by sending a crafted POST request to the /cgi-bi...

PT-2026-84010

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-51698

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setUrlFilterRules function. This vulnerability allows unauthenticated attackers to alter browsing policies by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

PT-2026-83815

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51697

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setIptvCfg function. This vulnerability allows unauthenticated attackers to modify the IPTV service configuration by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi end...