CVE-2026-92139: Server-Side Request Forgery (SSRF)

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

PT-2026-93818

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.25 Description A cross-site request forgery issue exists in the User Management component. A remote attacker can manipulate the UserController::del and UserController::mod functions within the...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38407)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delPortForwardRules function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38414)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the Firmware Upgrade function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38579)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from improper access control in the SystemSettings function. Attackers can exploit this vulnerability by sending a specially crafted POST request...

PT-2026-93992

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in a specific file download API allows an authenticated remote attacker to download arbitrary files from the system. This occurs because user input is not properly...

PT-2026-93915

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38570)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setWiFiGuestCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38574)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an issue with access control in the setWiFiScheduleCfg function. Attackers can exploit this vulnerability by sending a specially craft...

Linux Distros Unpatched Vulnerability : CVE-2024-14029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38401)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the clearTracerouteLog function. Attackers can exploit this vulnerability by sending a specially crafted...

RHEL 8 : libevent (RHSA-2026:67908)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67908 advisory. The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service vi...

RHEL 9 : libevent (RHSA-2026:67910)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67910 advisory. The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service vi...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38567)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWiFiBasicCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38410)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the delUrlFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

PT-2026-93968

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to obtain write access to the underlying operating system. This ...

PT-2026-94009

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-20282: Improper Restriction of Names for Files and Other Resources

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafte...

CVE-2026-27560: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38403)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from the delDevice function not properly implementing access control mechanisms. Attackers can exploit this vulnerability by sending...