CVE-2026-51617

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) suffers from incorrect access control in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to disclose sensitive data including operation mode, firmware version, serial number, WAN/LAN IP ...

CVE-2026-51651

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getSmartQosCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker on an adjacent network can retrieve Smart QoS configuration and rules, resulting in a l...

CVE-2026-51652

CVE-2026-51652 is an incorrect access control flaw in the getUPnPCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve UPnP enablement status and parsed port...

PT-2026-83222

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain syslog-related configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51624

CVE-2026-51624 is an incorrect access control flaw in the getStationMacByIp function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve a connected client's MAC address , enabling netwo...

CVE-2026-51624

Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain a client MAC address via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83084

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.7.2 Description An issue involving the deserialization of untrusted data allows for PHP object injection, which can be chained from an unauthenticated starting point to achieve remote code execution. The attack...

PT-2026-83105

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

PT-2026-83201

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67879

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83352

A pre-authentication stack-based buffer overflow vulnerability exists in the http gdpr decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: virglrenderer (UTSA-2024-005589)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005589 advisory. An out-of-bounds read in the vrendblitneedswizzle function in vrendrenderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: fribidi (UTSA-2025-002250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002250 advisory. A segmentation fault SEGV flaw was found in the Fribidi package and affects the fribidiremovebidimarks function of the lib/fribidi.c file. This flaw allows an attack...

Linux Distros Unpatched Vulnerability : CVE-2026-80643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - EDAC/igen6: Fix call trace due to missing release When unloading the igen6edac driver, there is a call trace: Device 'null' does not have a release function, it...

CVE-2026-51650

An incorrect access control vulnerability in the getRemoteCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and disclose remote-management enablement status and port information . The ...

CVE-2026-51656

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the getVpnPassCfg function. An unauthenticated attacker on an adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to disclose VPN pass-through and WAN ping filter se...

The vulnerability of the ceph_monmap_decode() function in the net/ceph/mon_client.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the cephmonmapdecode function in the net/ceph/monclient.c module, which implements networking functions for the Linux operating system’s kernel, is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow a remote attacker to caus...

PT-2026-83024

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmclock miscdev mmap function within the drivers/ptp/ptp vmclock.c file. This flaw allows read-only mappings to become writable, which may impact the...

CVE-2026-51634

Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83341

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...