344266 matches found
CVE-2026-51768
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...
PT-2026-84240
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs broker component...
CVE-2026-51763
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...
CVE-2026-51764
An incorrect access control flaw in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...
CVE-2026-51751
CVE-2026-51751 is a critical (CVSS 9.8) incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from loc...
CVE-2026-51768
CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...
PT-2026-84312
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs broker component...
EUVD-2026-69379
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the csbroker component...
CVE-2026-51756
An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...
PT-2026-84256
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uri string:get port/1 passes the port substring to binary to integer/1 with no length bound,...
PT-2026-84073
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...
CVE-2026-51750
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...
CVE-2026-51762
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...
The vulnerability of the Key Guard component in Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Key Guard component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the GDI+ component in Windows operating systems allows attackers to exploit their privileges.
The vulnerability of the Windows Graphics Device Interface Plus GDI+ component in operating systems involves the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-84185
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description An information disclosure issue exists within the Networking: HTTP component. Recommendations...
CVE-2026-51754
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...
PT-2026-84175
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 140.15 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird ESR versions prior to 140.15 Thunderbird ESR versions prior to 153.2 Description A...