CVE-2026-51764

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

PT-2026-84497

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description The web-based management interface lacks Cross-Site Request Forgery CSRF protection for certain sessions. This allows a remote unauthenticated attacker to execute arbitrary input...

PT-2026-84422

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the web-based management interface allows an unauthenticated remote attacker to access sensitive information. This occurs if an authenticated user is persuade...

PT-2026-84488

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authentication issue in the management interface and API allows for improper authentication processing. An unauthenticated remote attacker can exploit this under specific conditions to bypa...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51701

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-68951

GROWI, a platform by GROWI, Inc., contains an incorrect authorization flaw (CWE-863) in its bookmark listing APIs . An unauthenticated attacker could retrieve other users' bookmark data, resulting in a low confidentiality impact . The CVSS 3.1 base score is 5.3 (MEDIUM) ; CVSS 4.0 rates it 6.9 (M...

Linux Distros Unpatched Vulnerability : CVE-2026-15576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification...

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

CVE-2026-51674

CVE-2026-51674 is an incorrect access control flaw in the setScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to configure forced reboot tasks , resulting in high impact to...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Incorrect authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-5934 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocketbeacon AJAX endpoint. This makes it possible for unauthenticated...

CVE-2026-19318

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...

CVE-2026-75814

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

CVE-2026-38821

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...