PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-51646

CVE-2026-51646 is an incorrect access control vulnerability in the getParentalRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain parental-control rules. The CNA-assigned C...

EUVD-2026-67889

Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51638

Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51650

Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain remote-management enablement and port information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...

EUVD-2026-67893

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51630

An incorrect access control flaw in the getDdnsCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker on the same network segment to send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve the router's DDNS configuration , including dom...

CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51648

Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WAN information returned by the endpoint via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51662

An incorrect access control flaw in the getCloudSrvCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and obtain cloud firmware check status information . The vulnerability carri...

CVE-2026-51627

TOTOLINK T6 (version 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getIptvCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker can obtain IPTV and IGMP configuration information , yielding a high confidentiality impact ...

CVE-2026-51643

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getNtpCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve NTP configuration and current time data , with no user interaction or prior privi...

CVE-2026-51654

CVE-2026-51654 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getScheduleCfg function allows unauthenticated attackers on the adjacent network to send a crafted POST request to /cgi-bin/cstecgi.cgi, thereby retrieving schedule or sc...

CVE-2026-51636

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51620

Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51625

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51616

Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51627

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

CVE-2026-51628 is an incorrect access control vulnerability in the getGenerateWiFiWpsPin function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated network attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to generate and retrieve a new WPS PIN , enabl...