CVE-2026-51632

Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain advanced wireless settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51633

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51619

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51615

Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82252

creationtimestamp| type| source ---|---|--- 2026-08-28 20:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu65pqvz6227...

CVE-2026-81285

creationtimestamp| type| source ---|---|--- 2026-08-28 20:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu65pjvucs27...

CVE-2026-77063

creationtimestamp| type| source ---|---|--- 2026-08-28 19:58:10+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mu65jia53s2k...

CVE-2026-77037

creationtimestamp| type| source ---|---|--- 2026-08-28 19:48:29+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mu64x7sf222k 2026-08-29 06:02:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu77chep2i2r...

CVE-2026-19234

creationtimestamp| type| source ---|---|--- 2026-08-28 18:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5yynzt3f2m...

CVE-2026-17100

creationtimestamp| type| source ---|---|--- 2026-08-28 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5vneox562y...

CVE-2026-17093

creationtimestamp| type| source ---|---|--- 2026-08-28 17:07:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5txqav5c24...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-55064

Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parentprojectid equal to 0 to POST /api/v1/projects/project. The Project.CanUpdate...

CVE-2026-17494

creationtimestamp| type| source ---|---|--- 2026-08-28 16:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5sc3d7xf22...

CVE-2026-82286

gpt-crawler through version 1.5.1 (BuilderIO) is vulnerable to an arbitrary file write via the outputFileName parameter in the POST /crawl endpoint. The root cause is a failure to validate this parameter, allowing unauthenticated attackers to supply absolute paths or parent-directory segments and...

EUVD-2026-67817

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...