CVE-2026-51733

An incorrect access control flaw in the FirmwareUpgrade function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated CVSS 9.8 (CR...

PT-2026-83861

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83775

Name of the Vulnerable Software and Affected Versions HTML::FormFu versions prior to 2.09 Description Repeatable elements allow resource exhaustion through an unbounded repeat count provided via the query string. When a Repeatable element has counter name set, the process function reads the repea...

EUVD-2026-68537

Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83778

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4 Description A flaw in the Widget Editor component allows for unrestricted upload of files. This issue occurs within an unknown function located in the file...

PT-2026-83721

A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. This vulnerability affects the function unlink of the file app/Http/Controllers/Admin/ImageLibraryController.php of the component Image Library Cleanup. The manipulation of the argument file path results in path traversal. The attack...

PT-2026-83647

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

PT-2026-83871

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83645

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681 B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

PT-2026-83681

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb ajax simple avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload...

PT-2026-83717

Name of the Vulnerable Software and Affected Versions valkey-io valkey version 9.1.0 Description A use after free flaw exists in the Blocked-on-keys Subsystem within the handleClientsBlockedOnKey function located in the src/blocked.c file. This issue can be triggered remotely, although the attack...

Important: firefox

Issue Overview: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determin...

Important: firefox

Issue Overview: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determin...

CVE-2026-51729

CVE-2026-51729 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). The root cause is an incorrect access control in the delDevice function, reachable via a crafted POST request to /cgi-bin/cstecgi.cgi , which allows an unauthenticated attacker to request deletion of a managed slave ...

Linksys E1200 2.0.04 Command Injection

Linksys E1200 firmware versions 2.0.04 and below suffer from an unauthenticated remote command injection vulnerability. Exploit Title: Linksys E12002.0.04 - Unauthenticated OS Command Injection Date: 2026-07-22 Exploit Author: JarrettgxzSec Vendor Homepage: www.linksys.com Version: FW " printf"!...

PT-2026-83709

A security vulnerability has been detected in code-projects Employee Leave Managing System 1.0. Affected is an unknown function of the file /EmpManageSys/editaction.php of the component Employee Profile Update. The manipulation of the argument Name leads to cross site scripting. The attack can be...

EUVD-2026-68750

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Important: libgit2

Issue Overview: libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend vuln111 CVE-2026-53583 libgit2 Submodule path traversal CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size Header CVE-2026-53585 libgit2's builtin HTTP transport follows offsite redirects for the...

PT-2026-84022

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The checkExtractItems function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Due to the absence of .phtml, .phar, .php5, a...

EUVD-2026-68752

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...