CVE-2026-51633

An incorrect access control vulnerability in the getWiFiEasyGuestCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers on an adjacent network to obtain simplified guest Wi-Fi configuration, including guest credentials, by sending a crafted POST request to /...

CVE-2026-51664

An incorrect access control flaw in the getTelnetCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers on the adjacent network to obtain Telnet service enablement status by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS v3.1 score is 4.3 (...

PT-2026-83000

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmw external bo copy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped afte...

CVE-2026-51660

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67907

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51621

CVE-2026-51621 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getInitCfg function allows unauthenticated remote attackers to read sensitive device configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. ...

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-82899

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth hdr proto field When batadv get vid accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to...

EUVD-2026-67908

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67915

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67898

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67897

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83027

CVE ID: CVE-2026-9548 Severity: MEDIUM | CVSS Score: 6.5/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. An improper neutralization of input during web page generation 'Cross-site Scripting'...

CVE-2026-51610

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83226

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...

CVE-2026-51631

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getStaticDhcpRules function. An unauthenticated attacker on the adjacent network segment can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain WPS runtime status , with no user interaction requ...

CVE-2026-51661

TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getPortForwardRules function. An unauthenticated attacker can obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS v3.1 score is 9.1 ...

EUVD-2026-67911

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

PT-2026-83114

Name of the Vulnerable Software and Affected Versions Plesk for Linux versions 18.0.34 through 18.0.79.8 Description A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to...