CVE-2026-51631

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getStaticDhcpRules function. An unauthenticated attacker on the adjacent network segment can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain WPS runtime status , with no user interaction requ...

EUVD-2026-67897

Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67895

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-82919

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aa replace profiles The function aa replace profiles was accessing udata-size after calling aa put loaddataudata, causing a potential UAF. Fixed this by saving the size to a local variable before...

CVE-2026-51636

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51636

CVE-2026-51636 is an incorrect access control vulnerability in the getWiFiAclRules function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain Wi-Fi ACL rules , exposing access-control configurati...

CVE-2026-51648

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the getWanInfo function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain WAN information from the device. The CVSS 3.1 score is 7.5 (HIGH) ,...

PT-2026-83184

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67907

Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain online client information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83198

Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain simplified guest Wi-Fi configuration, including guest credentials, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83212

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51664

An incorrect access control flaw in the getTelnetCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers on the adjacent network to obtain Telnet service enablement status by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS v3.1 score is 4.3 (...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

PT-2026-82862

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-83016

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink snd pcm drain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after schedule timeout removes it only if that peer is still found in the...

CVE-2026-51661

TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getPortForwardRules function. An unauthenticated attacker can obtain port-forwarding rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS v3.1 score is 9.1 ...

PT-2026-82922

In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclk cleanup This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the file operations structure does not specif...

PT-2026-83257

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.6.0 through 2.8.0 Description The OIDC authorization page in the frontend redirects the browser to an attacker-controlled URL without consulting the backend redirect URI allow-list when the request uses prompt=none. An...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

ROS-20260828-73-0012

The vulnerability of the iavfallocqvectors function in the drivers/net/ethernet/intel/iavf/iavfmain.c file of the Intel Ethernet network adapter driver for the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote...