CVE-2026-51645

CVE-2026-51645 is an incorrect access control flaw in the getPasswordCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can obtain the administrative username by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.8 (Critical) (AV:...

CVE-2026-51657

CVE-2026-51657 is an incorrect access control flaw in the getSyslogCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve syslog-related configuration from the device. The CNA-...

CVE-2026-51614

An incorrect access control flaw in the getAccessDeviceCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker on the adjacent network to disclose access-device policy and client state information by sending a crafted POST request to /cgi-bin/cst...

CVE-2026-51655

CVE-2026-51655 is an incorrect access control flaw in the getMacFilterRules function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker within the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve MAC filter rules, lea...

CVE-2026-51647

CVE-2026-51647 is an incorrect access control flaw in the getCrpcCfg function of the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain cloud remote-control status and URL information . The CVS...

CVE-2026-51653

CVE-2026-51653 is an incorrect access control flaw in the getStorageCfg function of the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain storage feature state i...

CVE-2026-51640

CVE-2026-51640 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getMeshNeighborTable function allows an unauthenticated attacker on the adjacent network to obtain mesh neighbor information by sending a crafted POST request to /cgi-bin...

CVE-2026-51610

CVE-2026-51610 is an incorrect access control flaw in the RebootSystem function of the TOTOLINK T6 wireless router, firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to force an immediate device reb...

CVE-2026-51658

TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 , suffers from an incorrect access control flaw in the getDmzCfg function. An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain DMZ configuration information , resulting in a high confidentiality im...

CVE-2026-51625

CVE-2026-51625 is an incorrect access control flaw in the getWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi over the network to retrieve sensitive Wi-Fi configuration data, inclu...

EUVD-2026-67910

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

EUVD-2026-67920

Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51611

CVE-2026-51611 is an incorrect access control vulnerability in the startSlaveReboot function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated remote attacker can send a crafted MQTT message to force an arbitrary reboot of the device. The vulnerability is rated...

CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

The vulnerability in the `drivers/net/ipa/reg/gsi_reg-v5.0.c` module of the Linux kernel’s network device drivers allows a attacker to cause a service failure.

The vulnerability in the drivers/net/ipa/reg/gsireg-v5.0.c module of the Linux kernel’s network device drivers is related to an incorrect check of a specified index, position, or offset in the input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

The vulnerability of the xdp_umem_reg() function in the net/xdp/xdp_umem.c module, which implements networking functions for the Linux operating system’s kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xdpumemreg function in the net/xdp/xdpumem.c module, which implements networking functions for the Linux kernel, is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a intruder to access confidential data.

The vulnerability of the Sandboxing component in Firefox web browsers, Firefox ESR, and the email client Thunderbird relates to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

VulnCheck KEV: CVE-2026-81578

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...