EUVD-2026-67912

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51648

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51621

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

immich -- locked assets remain accessible through shared albums and links

VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk...

CVE-2026-51620: Improper Access Control

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67897

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83194

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83190

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83198

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83203

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83212

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67886

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51642: Improper Access Control

Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh routing information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650: Improper Access Control

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51630: Improper Access Control

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83150

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-51626: Improper Access Control

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663: Improper Access Control

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51648: Improper Access Control

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...