CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68753

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83885

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the setWiFiWpsStart function allows unauthenticated attackers to open a wireless pairing window. This is achieved by sending a crafted POST request to the...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

DevTools DoS

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Workers Component Compromise Data Compromise

The vulnerability of the Workers component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially crafted HTML page...

libyuv DoS

The vulnerability of the libyuv component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service outage through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Extensions Component Confidential Data Access

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

EUVD-2026-68651

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83930

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68715

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51726

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the delParentalRules function. An unauthenticated attacker can remove parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi....

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83866

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data...

CVE-2026-51714

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw in the setRoamingCfg function. This vulnerability allows unauthenticated attackers to modify the device's roaming behavior by sending a crafted POST reque...

CVE-2026-51675

The TOTOLINK T6 wireless dual-band Mesh router (specifically version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control flaw in the setWanIeCfg function. This vulnerability allows unauthenticated attackers to reconfigure uplink settings by sending a specially crafted POST reques...

CVE-2026-51686

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an incorrect access control issue within the setWiFiEasyCfg function. This flaw allows unauthenticated attackers to reconfigure or disable wireless networks by sending a specially crafted POS...

CVE-2026-51679

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw within the setPasswordCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...