PT-2026-84035

Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.7 Smarty versions prior to 5.8.2 Description Smarty is a PHP template engine that separates presentation from application logic. A flaw exists in the fetch handling within libs/plugins/function.fetch.php and...

CVE-2026-51700: Improper Access Control

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

libyuv DoS

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service outage through a specially created HTML page...

Workers Component Compromise Data Compromise

The vulnerability of the Workers component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Extensions Component Confidential Data Access

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

DevTools DoS

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

CVE-2026-21827: Exposure of Private Personal Information to an Unauthorized Actor

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data...

CVE-2026-51709: Improper Access Control

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-79747: Server-Side Request Forgery (SSRF)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51727

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the SystemSettings function. An unauthenticated attacker can exploit this flaw by sending a specially crafted POST request to the /cgi-bi...

CVE-2026-51681

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability within the setRemoteCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. Succes...

PT-2026-83787

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Description An issue exists when parsing multipart requests where the request body has already been consumed ...

EUVD-2026-68751

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84031

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.15.1 Description An unauthenticated Server Side Request Forgery SSRF exists in the MapSVG plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended locatio...

PT-2026-84053

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1 Description A server-side request forgery SSRF exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions function located in the...