CVE-2026-51750

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the updatePriChannel function, accessible via the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to rescan and switch the primary mesh channel , disrupting wire...

PT-2026-84240

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the informSyncUpgfw function allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves. This is achieved by sending a crafted...

CVE-2026-51754

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). Unauthenticated attackers can overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The CVSS 3....

KLA91252 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security vulnerability in the Remote Settings Client...

KLA91255 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

KLA91254 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

KLA91248 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1...

PT-2026-84172

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 115.40 Firefox ESR versions prior to 140.15 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 140.15 Thunderbird versions prior to...

PT-2026-84185

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description An information disclosure issue exists within the Networking: HTTP component. Recommendations...

PT-2026-84175

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 140.15 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird ESR versions prior to 140.15 Thunderbird ESR versions prior to 153.2 Description A...

CVE-2026-51768

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

CVE-2026-51754

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51765

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51751

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

CVE-2026-51763

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

Mozilla Firefox ESR < 140.15

The version of Firefox ESR installed on the remote Windows host is prior to 140.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-84 advisory. - Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbi...

The vulnerability of the Key Guard component in Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Key Guard component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the GDI+ component in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Graphics Device Interface Plus GDI+ component in operating systems involves the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the FilteredObjectInputStream component in the Apache Log4j2 logging library allows a hacker to execute arbitrary code.

The vulnerability of the FilteredObjectInputStream component in the Apache Log4j2 logging library is related to deserialization mechanism flaws. Exploiting this vulnerability allows an attacker to execute arbitrary code...