CVE-2026-51680

An incorrect access control vulnerability in the setLedCfg function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to modify LED behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with ...

CVE-2026-51697

An incorrect access control flaw in the setIptvCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to alter IPTV service configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) , reflectin...

EUVD-2026-68754

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51673

CVE-2026-51673 is an incorrect access control vulnerability in the setNtpCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the device's time synchronization (NTP) settings , resulti...

Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-2088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2088 advisory. Issue summary: When an OpenSSL QUIC server Listener SSL object processesvalid QUIC Initial packets for unknown destination connection IDs, itcan allocate and queue new incoming channels without enforci...

Linux Distros Unpatched Vulnerability : CVE-2026-80622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - char: tlclk: fix use-after-free in tlclkcleanup This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race...

Amazon Linux 2 : apr-util, --advisory ALAS2-2026-3892 (ALAS-2026-3892)

The version of apr-util installed on the remote host is prior to 1.6.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3892 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or password...

ROS-20260831-73-0015

The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...

ROS-20260831-73-0006

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260831-73-0003

The vulnerability of the cryptorsacommon function in the libfreerdp/crypto/crypto.c file of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failure...

ROS-20260831-73-0001

The vulnerability of the essivaeadcrypt function in the essiv component of the Linux operating system is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security update for postgresql18 (important)

openSUSE security update: security update for postgresql18 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21703-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...

Security update for postgresql17 (important)

openSUSE security update: security update for postgresql17 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21702-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...

CVE-2026-51734

An incorrect access control vulnerability in the informSlaveUpdate function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows an unauthenticated network attacker to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS 3.1...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68652

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51720

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68638

Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68633

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68646

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...