CVE-2026-51718

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability in the delStaticDhcpRules function. This flaw allows unauthenticated attackers to remove static DHCP reservations by sending a crafted POST request to the /cgi-bin/cstecgi.cgi end...

CVE-2026-51699

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setDmzCfg function. This security weakness allows unauthenticated attackers to expose an internal host by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No specific expl...

CVE-2026-51683

A vulnerability exists in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An incorrect access control in the setLanCfg function allows unauthenticated attackers to modify the LAN network configuration . This can be achieved by sending a crafted POST request to the /cgi-bin...

CVE-2026-51691

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the setUploadSetting function. An unauthenticated attacker can manipulate the upload or flash workflow by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No...

CVE-2026-51725

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the NTPSyncWithHost function. This vulnerability allows unauthenticated attackers to modify the device clock by submitting a crafted POST request to the /cgi-bin/cstecgi.cgi endpoin...

CVE-2026-51711

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWiFiWpsStart function. An unauthenticated attacker can trigger the opening of a wireless pairing window by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No ...

CVE-2026-51709

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiBasicCfg function. An unauthenticated attacker can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploitation details or...

CVE-2026-51720

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the delIpPortFilterRules function. This vulnerability allows unauthenticated attackers to remove firewall filter rules by sending a crafted POST request to the /cgi-bi...

CVE-2026-51671

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getCloudDownloadStatus function. This vulnerability allows unauthenticated attackers to obtain sensitive cloud firmware download state information by sending a crafted POST requ...

CVE-2026-51738

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the LoadDefSettings function. This allows unauthenticated attackers to reset the device configuration and trigger a reboot by sending a crafted POST request to the /cgi-bin/cstecgi....

CVE-2026-51739

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is susceptible to an incorrect access control vulnerability within the CloudSrvVersionCheck function. This flaw allows unauthenticated attackers to trigger cloud update checks by sending a crafted POST request to the /cgi-bi...

CVE-2026-51722

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiRepeaterCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi, which allows them to repoint the device to an...

CVE-2026-51667

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the getWiFiIpMacTable function. This flaw allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No informa...

CVE-2026-51700

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setWiFiAdvancedCfg function. This vulnerability allows unauthenticated attackers to degrade wireless behavior by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpo...

CVE-2026-51727

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the SystemSettings function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve sensitive administrative import a...

CVE-2026-51681

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the setRemoteCfg function. This vulnerability allows unauthenticated attackers to expose WAN-side administration by sending a crafted POST request to the /cgi-bin/cstecgi.cgi...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84006

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68741

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83944

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...