CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68673

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68716

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83931

Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705

The TOTOLINK T6 (version 4.1.5cu.748_B20211015) is affected by an incorrect access control vulnerability in the setWiFiMeshName function. An unauthenticated attacker can rename mesh entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No information regarding specific remediation or...

CVE-2026-51708

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setWiFiWpsCfg function. This flaw allows unauthenticated attackers to modify WPS availability by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. N...

CVE-2026-51709

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw within the setWiFiBasicCfg function. An unauthenticated attacker can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific exploitation details or...

CVE-2026-51711

The TOTOLINK T6 (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWiFiWpsStart function. An unauthenticated attacker can trigger the opening of a wireless pairing window by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No ...

CVE-2026-51709

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51711

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Linux Distros Unpatched Vulnerability : CVE-2026-19197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover...

The vulnerability of the Browser component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Browser component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially created HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-18705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different,...

PT-2026-83963

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51737

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51710

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability within the setParentalRules function. This flaw allows unauthenticated attackers to modify parental-control behavior by sending a crafted POST request to the /cgi-bin/cstecg...

HP ImageDiags - Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. HP has identified affected versions and the minimum version that...

CVE-2026-51667

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to incorrect access control within the getWiFiIpMacTable function. This flaw allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No informa...