CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51623

Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82252

creationtimestamp| type| source ---|---|--- 2026-08-28 20:01:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu65pqvz6227...

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...

GHSA-2P9G-X3CV-5HH4 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-55509 WsgiDAV: Blind SQL injection in the MySQL provider

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-17100

creationtimestamp| type| source ---|---|--- 2026-08-28 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mu5vneox562y...

CVE-2026-55545

CVE-2026-55545 is an authorization bypass in Yamcs , a mission control framework, affecting versions prior to 5.12.8 and 5.13.2 . Three WebSocket subscription handlers fail to enforce the privilege checks their REST counterparts require: PacketsApi.subscribePackets omits the ReadPacket check, Pro...

CVE-2026-75889

creationtimestamp| type| source ---|---|--- 2026-08-28 16:15:10+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-860...

CVE-2026-55583

creationtimestamp| type| source ---|---|--- 2026-08-28 13:00:05+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU 2026-08-29 00:00:09+00:00| seen| Telegram/S10hsFVDI82am35mLtrW2Lu7gt-O8uQTUdZrdbSt3B6uU...

CVE-2026-80681

creationtimestamp| type| source ---|---|--- 2026-08-28 09:16:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172375439048635 2026-08-29 17:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muaf5sz3ie2j...

CVE-2026-80654

creationtimestamp| type| source ---|---|--- 2026-08-28 09:02:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172322571380429...

CVE-2026-80617

creationtimestamp| type| source ---|---|--- 2026-08-28 08:49:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172270071043490 2026-08-29 14:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mua47pyh3t2e...

CVE-2026-80603

creationtimestamp| type| source ---|---|--- 2026-08-28 08:22:13+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172163914329708 2026-08-29 14:20:17+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mua33z4yg424...

CVE-2026-80711

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...

CVE-2026-80608

creationtimestamp| type| source ---|---|--- 2026-08-28 08:09:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172112457184475...

CVE-2026-80600

creationtimestamp| type| source ---|---|--- 2026-08-28 07:55:28+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117172058724621440 2026-08-29 14:20:16+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mua33xruaz2c...

CVE-2026-80711

CVE-2026-80711 affects the Linux kernel power: supply: max17040 driver. The MAX17040 fuel gauge does not report charger state itself, so the driver forwards POWER_SUPPLY_PROP_STATUS to a supplier power supply. When no supplier is registered, power_supply_get_property_from_supplier() returns -ENOD...

CVE-2026-80711 power: supply: max17040: handle missing status supplier

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: handle missing status supplier MAX17040 does not report charger state itself, so the driver forwards POWERSUPPLYPROPSTATUS to a supplier power supply. If no supplier is registered,...