CVE-2026-82286: Improper Limitation of a Pathname to a Restricted Directory

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-51623: Improper Access Control

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51655: Improper Access Control

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83209

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getCrpcConfig function allows unauthenticated attackers to obtain cloud remote-control status and URL information. This is achieved by sending a crafted POST...

CVE-2026-51610

Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51625

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51630

Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

openSUSE 16 Security Update : liboqs (openSUSE-SU-2026:21634-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21634-1 advisory. Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized encapsderand...

CVE-2026-53578

creationtimestamp| type| source ---|---|--- 2026-08-27 22:09:09+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uevydce2e 2026-08-28 07:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4ubtmnvu2c...

CVE-2026-19092

creationtimestamp| type| source ---|---|--- 2026-08-27 22:08:52+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3uefzlzk2t 2026-08-28 08:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu4vfmgy762j 2026-09-01 12:00:06+00:00| confirmed|...

CVE-2026-69543

creationtimestamp| type| source ---|---|--- 2026-08-27 22:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu3ubafakl2c...

CVE-2026-81525

creationtimestamp| type| source ---|---|--- 2026-08-27 22:00:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fdi7tx66oeqsz 2026-08-27 23:00:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3xbkhsju2z 2026-08-28 12:45:52+00:00| seen|...

CVE-2026-75325

creationtimestamp| type| source ---|---|--- 2026-08-27 21:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu3tcscpy42j...

CVE-2026-81728

creationtimestamp| type| source ---|---|--- 2026-08-27 21:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3qkelswu2o 2026-09-01 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3muhlrktkrh2w 2026-09-03 13:35:40+00:00| seen|...

GO-2026-6297 linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request in github.com/andreimarcu/linx-server

linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service DoS via a crafted POST request in github.com/andreimarcu/linx-server...

CVE-2026-81699

creationtimestamp| type| source ---|---|--- 2026-08-27 19:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu3jutedft2r 2026-08-31 20:01:25+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mufp45rg2u2r 2026-09-04 08:37:06+00:00| seen|...

CVE-2026-65053

creationtimestamp| type| source ---|---|--- 2026-08-27 18:19:29+00:00| seen| https://bsky.app/profile/hacker.at.thenote.app/post/3mu3hk763c22q...

CVE-2026-65931

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-81703

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...