Medium: python3.13-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

CVE-2026-51712

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68585

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83810

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83820

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83829

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51706

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setOpModeCfg function, allowing unauthenticated attackers to change the device's operating mode by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (Critical) with high con...

PT-2026-83875

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83874

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83975

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

PT-2026-84044

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check img type of the file admin/pack.php. Executing a manipulation of the argument pack img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to...

CVE-2026-51733

An incorrect access control flaw in the FirmwareUpgrade function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated CVSS 9.8 (CR...

PT-2026-83861

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...