TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38407)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delPortForwardRules function. Attackers can exploit this vulnerability by sending a specially crafted...

PT-2026-83890

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delPortForwardRules function allows unauthenticated attackers to delete port-forwarding rules. This is achieved by sending a crafted POST request to the...

PT-2026-83338

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getPortForwardRules function allows unauthenticated attackers to obtain port-forwarding rules. This is achieved by sending a crafted POST request to the...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Sendmail .forward File - Exposure Detection

Sendmail .forward file is publicly accessible. This file is used to configure email forwarding and can expose sensitive information including email addresses, forwarding rules, and potentially executable commands pipe to programs. !/usr/bin/env python3 -- coding: utf-8 -- """Sendmail .""" import ...

USN-8533-1: OpenSSH vulnerabilities

It was discovered that OpenSSH sftp did not properly constrain the location of downloaded files when connecting to an attacker-controlled server. An attacker could possibly use this issue to write files to unintended locations on the file system. CVE-2026-59995 It was discovered that OpenSSH scp...

CVE-2025-45422

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules...

mailcow: Dockerized Access Control Vulnerability

mailcow: dockerized is a dockerized version of the mailcow open-source application. Versions of mailcow before 2026-03b contained an access control vulnerability. This vulnerability stemmed from the lack of administrator verification when deleting forwarding hosts, allowing any authenticated user...

Open5GS security vulnerabilities

Open5GS is an Open5GS open source C open source implementation of 5G Core and Epc, the core network of the Lte/Nr network. A security vulnerability exists in Open5GS version 2.7.5 and earlier, which stems from a misbehavior of the function ogspfcppdrfindoradd in the QER/FAR/URR/PDR component, whi...

EUVD-2009-0277

Malware in sbrugna...

CVE-2024-35400

TOTOLINK CP900L v4.1.5cu.798B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules...

CVE-2023-41155

A Stored Cross-Site Scripting XSS vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the forward to field while creating a mail forwarding rule...

PT-2021-3894

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description The issue is an information disclosure affecting Microsoft Exchange Server. It involves an authentication bypass, specifically through a flaw related to delegated...

Microsoft Disrupts Large, Cloud-Based BEC Campaign

Threat hunters at Microsoft recently uncovered and disrupted infrastructure that powered a large-scale business email compromise BEC campaign. The infrastructure was hosted on multiple cloud platforms, which allowed it to stay under the radar for quite some time. “The attackers performed discrete...

Cybercriminals want your cloud services accounts, CISA warns

On January 13 the Cybersecurity and Infrastructure Security Agency CISA issued a warning about several recent successful cyberattacks on various organizations’ cloud services. What methods did the attackers use? In the initial phase, the victims were targeted by phishing emails trying to capture...

PT-2019-8618

Name of the Vulnerable Software and Affected Versions Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096 Description An issue was discovered that allows command injection on the device. The device provides a user with the capability of adding new port forwarding rules, and th...

Synology DiskStation Manager (DSM) Denial of Service Vulnerability

DiskStation Manager DSM is an intuitive web-based operating system for every Synology NAS designed to help you manage digital assets in your home and office. A security vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation Manager DSM allows remote authenticated attackers to...

CVE-2017-12076

Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation DSM before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack...

PT-2017-12339 · Synology · Synology Disk Station

Name of the Vulnerable Software and Affected Versions: Synology DiskStation DSM versions prior to 6.1.1-15088 Description: The issue allows a remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack due to an Uncontrolled Resource Consumptio...