EUVD-2026-68580

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83987

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/update exchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

EUVD-2026-68589

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84006

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

PT-2026-83944

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

EUVD-2026-68584

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83835

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setUpgradeFW function allows unauthenticated attackers to trigger firmware-upgrade workflow changes. This is achieved by sending a crafted POST request to th...

PT-2026-83876

Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83840

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on com menus.item.id or core.admin. An authenticated us...

CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51711

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWiFiWpsStart function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Success...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51693

The TOTOLINK T6 (version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setVpnPassCfg function. This vulnerability allows unauthenticated attackers to weaken edge filtering by sending a crafted POST request to /cgi-bin/cstecgi.cgi . No specific exploit links or r...

CVE-2026-51683

A vulnerability exists in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An incorrect access control in the setLanCfg function allows unauthenticated attackers to modify the LAN network configuration . This can be achieved by sending a crafted POST request to the /cgi-bin...

CVE-2026-51710

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability within the setParentalRules function. This flaw allows unauthenticated attackers to modify parental-control behavior by sending a crafted POST request to the /cgi-bin/cstecg...

CVE-2026-51720

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the delIpPortFilterRules function. This vulnerability allows unauthenticated attackers to remove firewall filter rules by sending a crafted POST re...

EUVD-2026-68542

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51738

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51700

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...