PT-2026-82899

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth hdr proto field When batadv get vid accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to...

EUVD-2026-67908

Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67898

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83027

CVE ID: CVE-2026-9548 Severity: MEDIUM | CVSS Score: 6.5/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. An improper neutralization of input during web page generation 'Cross-site Scripting'...

CVE-2026-51610

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83226

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...

CVE-2026-51631

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getStaticDhcpRules function. An unauthenticated attacker on the adjacent network segment can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain WPS runtime status , with no user interaction requ...

CVE-2026-51661

TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getPortForwardRules function. An unauthenticated attacker can obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS v3.1 score is 9.1 ...

EUVD-2026-67776

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

EUVD-2026-67911

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

PT-2026-83114

Name of the Vulnerable Software and Affected Versions Plesk for Linux versions 18.0.34 through 18.0.79.8 Description A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to...

CVE-2026-51659

CVE-2026-51659 is an incorrect access control vulnerability in the getUrlFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain DMZ configuration information , resulting in a hi...

CVE-2026-51643

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67894

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51635

An incorrect access control flaw in the getWiFiScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker on the same network to retrieve Wi-Fi scheduling rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is ...

EUVD-2026-67897

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83233

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.0 Description An authenticated user can enumerate tasks across different tenants and modify their completion metadata. This occurs because the endpoint "/api/v1/projects/project/views/view/buckets/bucket/tasks"...

EUVD-2026-67874

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IP and port filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51660

CVE-2026-51660 is an incorrect access control vulnerability in the getIpPortFilterRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain the device's IP and port filtering rules , ...