PT-2026-83889

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83887

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83960

Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove VLAN entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83828

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83810

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51676

Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51735

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the setWiFiEasyCfg function. This flaw allows unauthenticated attackers to reconfigure or disable wireless networks by sending a specially crafted POS...

PT-2026-83855

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-56718

creationtimestamp| type| source ---|---|--- 2026-08-30 20:46:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gjr6e32eybwj7 2026-08-30 20:49:29+00:00| seen| https://bsky.app/profile/suriq.io/post/3mudbczrzqb2f 2026-08-30 23:22:56+00:00| seen|...

CVE-2026-82556

creationtimestamp| type| source ---|---|--- 2026-08-30 18:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3shvhizps2ufc...

CVE-2026-82644

creationtimestamp| type| source ---|---|--- 2026-08-30 16:03:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucrd7jjo722...

CVE-2026-82636

creationtimestamp| type| source ---|---|--- 2026-08-30 15:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucnuh3gnn2z 2026-08-30 18:09:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mucyfq3wqy2q 2026-08-30 18:09:53+00:00| seen|...

CVE-2026-82544

creationtimestamp| type| source ---|---|--- 2026-08-30 14:34:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/baujrtrh3e6m6...

CVE-2026-82641

creationtimestamp| type| source ---|---|--- 2026-08-30 14:26:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eppzem5eiti2r 2026-08-30 15:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucntzdfan2t 2026-08-31 04:02:56+00:00| seen|...

CVE-2026-55552

creationtimestamp| type| source ---|---|--- 2026-08-30 11:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucafrkawq2o 2026-10-05 06:12:25+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-55552.yaml...

CVE-2026-82483

creationtimestamp| type| source ---|---|--- 2026-08-30 10:14:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3oz7m7fecgazc 2026-08-30 12:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-82483...

CVE-2026-14835

The SOGO Add Script to Individual Pages Header Footer WordPress plugin (versions prior to 4.0 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox and does not restrict these actions ...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...