CVE-2026-51637

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control issue in the getMeshPortalTable function. This flaw allows unauthenticated attackers to obtain mesh portal table information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No sp...

CVE-2026-51648

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWanInfo function. An unauthenticated attacker can obtain sensitive WAN information by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No exploit details ...

CVE-2026-51659

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the getUrlFilterRules function. This vulnerability allows unauthenticated attackers to obtain sensitive DMZ configuration information by sending a crafted POST request...

CVE-2026-51660

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67884

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83254

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI ALLOWED access-control check in read config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE ADDR. A remote unauthenticated attacker can supply an allowed addre...

EUVD-2026-67907

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51635

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the getWiFiScheduleCfg function. This vulnerability allows unauthenticated attackers to obtain internal Wi-Fi scheduling rules by sending a crafted POST request to the /c...

EUVD-2026-67911

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51643

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51664

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is susceptible to an incorrect access control vulnerability within the getTelnetCfg function. This flaw allows unauthenticated attackers to retrieve sensitive information regarding the Telnet service enablement status by submitting a ...

EUVD-2026-67921

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67874

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67925

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

The vulnerability of the User-Mode Power Service (UMPS) in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the User-Mode Power Service UMPS in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2026-51622

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67776

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

PT-2026-83211

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Linux Distros Unpatched Vulnerability : CVE-2026-18664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems,...