CVE-2026-53581: Improper Limitation of a Pathname to a Restricted Directory

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-63379 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63379 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63383 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63383 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63381 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63381 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63385 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63385 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63388 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63388 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63384 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63384 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-63387 affecting package ntp for versions less than 4.2.8p17-3

CVE-2026-63387 affecting package ntp for versions less than 4.2.8p17-3. A patched version of the package is available...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68536

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83815

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setNtpCfg function. This vulnerability allows unauthenticated attackers to modify time synchronization settings by sending a specially crafted POST...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51643

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Chromium: CVE-2026-79123 Improper input validation in NTP Footer

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-83208

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getNtpCfg function allows unauthenticated attackers to obtain NTP configuration and current time data. This is achieved by sending a crafted POST request to...

EUVD-2026-67923

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51643

Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi...