CVE-2026-51639

CVE-2026-51639 is an incorrect access control flaw in the getApWiFiSchCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve AP-specific Wi-Fi scheduling rules...

CVE-2026-51628

CVE-2026-51628 is an incorrect access control vulnerability in the getGenerateWiFiWpsPin function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated network attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to generate and retrieve a new WPS PIN , enabl...

CVE-2026-51619

CVE-2026-51619 is an incorrect access control vulnerability in the getOnlineClient function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain online client information (connected device details) without an...

CVE-2026-51629

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getStaticDhcpRules function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to read static DHCP reservation rules. The im...

EUVD-2026-67905

Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive device configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

PT-2026-83123

Name of the Vulnerable Software and Affected Versions grpc-gateway version 2.28.0 Description Incorrect Access Control occurs because the application processes the X-HTTP-Method-Override header in the ServeMux.ServeHTTP function without restricting allowed methods. When a POST request with...

CVE-2026-51626

CVE-2026-51626 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the getWiFiWpsCfg function, allowing unauthenticated attackers to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the WPS configuration, includi...

The vulnerability of the nltk.corpus.reader component in the NLTK library for symbolic and statistical processing of natural language allows a hacker to gain unauthorized access to protected information.

The vulnerability of the nltk.corpus.reader component in the NLTK library for symbolic and statistical processing of natural language is related to improper external management of file names or file paths. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protecte...

The vulnerability of the Disability Access APIs in Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, allows a malicious actor to trigger a service failure.

The vulnerability of the Disability Access APIs in Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-51634

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) has an incorrect access control flaw in the getWiFiBasicCfg function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve core wireless settings, including SSIDs and Wi-Fi keys . The ...

EUVD-2026-67904

Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51641

CVE-2026-51641 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . The root cause is an incorrect access control in the getWiFiMeshConfig function, which allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve mesh configuration a...

Linux Distros Unpatched Vulnerability : CVE-2026-80695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte...

Linux Distros Unpatched Vulnerability : CVE-2026-80709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for...

Linux Distros Unpatched Vulnerability : CVE-2026-80637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields...

immich -- locked assets remain accessible through shared albums and links

NVD reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. The single-asset code path still lacks the album removal that the bulk path performs, s...

EUVD-2026-67886

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67923

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67925

Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh configuration and runtime state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...