EUVD-2026-68740

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507

oasdiff-action , a GitHub Action that detects breaking changes in OpenAPI specs and posts reviews on pull requests, contained a flaw prior to version 0.0.51 where external $refs in the spec were resolved by default (allow-external-refs: true). On a fork pull request in a public repository, an att...

Malicious code in node-request-utils (npm)

Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y/all.js TL...

CVE-2026-68525

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51728

Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to upload a crafted firmware image via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51729

Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to request deletion of a managed slave device via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51725

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51730

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

MAL-2026-15632 Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

CVE-2026-51721

Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51720

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51723

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

SUSE CVE-2026-72231

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51709

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51718

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...