CVE-2026-51739

CVE-2026-51739 affects the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 . The vulnerability is an incorrect access control in the CloudSrvVersionCheck function, which allows unauthenticated attackers to trigger cloud update checks by sending a crafted POST request to /cgi-bin...

CVE-2026-75460

XueZhiSi Open Source Exam System versions 3.9.0 and below contain a privilege escalation vulnerability in the teacher-end interface at POST /api/teacher/user/page/list . The root cause is that the role parameter in UserPageRequestVM is fully controllable by the requester, allowing a low-privilege...

CVE-2026-51674

CVE-2026-51674 is an incorrect access control flaw in the setScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated, remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to configure forced reboot tasks , resulting in high impact to...

CVE-2026-51708

CVE-2026-51708 is a critical (CVSS 9.8) incorrect access control vulnerability in the setWiFiWpsCfg function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated, network-based attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change WPS availabi...

CVE-2026-51710

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control vulnerability in the setParentalRules function. An unauthenticated attacker on the network can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter parental-control behavior , with high impact t...

CVE-2026-51677

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setUPnPCfg function, accessible via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated network attacker can send a crafted POST request to change the UPnP service state , achieving high confident...

CVE-2026-51671

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the getCloudDownloadStatus function, exposed through the endpoint /cgi-bin/cstecgi.cgi. An unauthenticated attacker can send a crafted POST request to retrieve cloud firmware download state information...

CVE-2026-51675

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWanIeCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure the device's uplink settings, achieving high confidentiality and inte...

CVE-2026-51669

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the getPairCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain pairing and mesh-slave configuration data. The CVSS 3.1 score is 9.1 (Critic...

CVE-2026-51667

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is affected by an incorrect access control flaw in the getWiFiIpMacTable function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain Wi-Fi client MAC-to-IP mappings , a low-...

CVE-2026-51683

TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the setLanCfg function. An unauthenticated attacker on the adjacent network can alter LAN network configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS v3.1 score is 4.3 (...

CVE-2026-51738

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 are affected by an incorrect access control flaw in the LoadDefSettings function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to reset the device's configuration and trigger a reboot, resulting in h...

CVE-2026-51711

CVE-2026-51711 is an incorrect access control vulnerability in the setWiFiWpsStart function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to open a WPS (Wi-Fi Protected Setup) pairing window , rated...

CVE-2026-51725

CVE-2026-51725 is an incorrect access control vulnerability in the NTPSyncWithHost function of TOTOLINK T6 (version 4.1.5cu.748_B20211015). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change the device clock, rated CVSS 9.1 (CRITICAL) with high co...

CVE-2026-51687

An incorrect access control vulnerability in the setWiFiEasyGuestCf function of the TOTOLINK T6 wireless router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to create or weaken guest wireless access by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability...

CVE-2026-51694

CVE-2026-51694 affects TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the setStaticDhcpRules function, exposed via the endpoint /cgi-bin/cstecgi.cgi , allows an unauthenticated attacker to add or modify static DHCP rules by sending a crafted POST ...

CVE-2026-51722

CVE-2026-51722 affects the TOTOLINK T6 Wi-Fi router (firmware 4.1.5cu.748_B20211015). An incorrect access control flaw in the setWiFiRepeaterCfg function allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi and repoint the device to an attacker-controlled upst...

CVE-2026-51718

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 has an incorrect access control flaw in the delStaticDhcpRules function, allowing an unauthenticated attacker to remove static DHCP reservations by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated CVSS 9.8 (Critical) wi...

CVE-2026-51700

An incorrect access control flaw in the setWiFiAdvancedCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (CRITICAL) wi...

CVE-2026-51692

An incorrect access control flaw in the setWiFiGuestCfg function of the TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to establish or weaken guest wireless access by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CNA-assigned CVSS 3.1 score is 9.1 (C...

CVE-2026-51720

An incorrect access control vulnerability in the delIpPortFilterRules function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to delete firewall filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The NVD-assigned CVSS v3.1 score ...

CVE-2026-51691

CVE-2026-51691 is a critical (CVSS 9.8) incorrect access control vulnerability in the TOTOLINK T6 router, firmware version 4.1.5cu.748_B20211015 . The flaw resides in the setUploadSetting function, which is reachable via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated network a...

CVE-2026-51727

An incorrect access control vulnerability in the SystemSettings function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to retrieve administrative import and export endpoint information by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CV...

CVE-2026-51723

CVE-2026-51723 is an incorrect access control vulnerability in the UploadCustomModule function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to install a custom CGI module on the device. The CVSS 3.1 ...

CVE-2026-51681

An incorrect access control flaw in the setRemoteCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker to send a crafted POST request to /cgi-bin/cstecgi.cgi , thereby exposing the device's WAN-side administration interface. The vulnerability i...

CVE-2026-51693

CVE-2026-51693 is a critical access-control flaw in the setVpnPassCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to weaken the router's edge filtering. The flaw carries a CVSS 3.1 score ...

CVE-2026-51666

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) contains an incorrect access control flaw in the setWizardCfg function. An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to reconfigure WAN, Wi-Fi, and device initialization state , with low i...

CVE-2026-51684

TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setStorageCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to alter the storage-related service state, with no user interaction requir...

CVE-2026-51737

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the clearTracerouteLog function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to erase traceroute logs, enabling concealment of reconnaissance activity. Th...

CVE-2026-51705

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the setWiFiMeshName function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to rename mesh entries , with a CVSS 3.1 score of 9.8 (CRITICAL) reflecting high...

CVE-2026-51709

CVE-2026-51709 is an incorrect access control vulnerability in the setWiFiBasicCfg function of the TOTOLINK T6 router, firmware 4.1.5cu.748_B20211015 . Unauthenticated attackers can reconfigure primary Wi-Fi settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CNA-assigned CVSS...

CVE-2026-51719

CVE-2026-51719 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the delUrlFilterRules function allows an unauthenticated attacker to remove URL filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The CVSS v3.1 scor...

CVE-2026-82595

CVE-2026-82595 is a command injection vulnerability in D-Link DIR-825M firmware version 1.1.8 , located in the System Command Execution component (file /boafrm/formSysCmd, function sub_456CF4). Manipulating the sysCmd argument allows an authenticated remote attacker to inject and execute arbitrar...

CVE-2026-82594

LogNet grpc-spring-boot-starter (up to version 5.2.0 ) contains an improper authorization flaw in its Annotation Processing component, exploitable over the network. The specific function affected is described as unknown. The attack requires low privileges and has high complexity , limiting practi...

CVE-2026-82593

A stack-based buffer overflow exists in the D-Link DIR-825M router (firmware v1.1.8), specifically in function sub_41802C within the file /boafrm/formLtefotaUpgradeFibocom of the LTE Module Firmware Upgrade component. The root cause is improper handling of the fota_url argument, enabling a remote...

CVE-2026-82592

A stack-based buffer overflow in the D-Link DIR-825M (firmware 1.1.8) affects the Disk Formatting Handler Endpoint at /boafrm/formDiskFormat (function sub_46725C). By manipulating the partition argument, an authenticated remote attacker can trigger the overflow. The vulnerability is rated CVSS 3....

CVE-2026-82591

Open Asset Import Library Assimp versions up to 6.0.2 contain a heap-based buffer overflow in the function MD5Importer::MakeDataUnique within the file code/AssetLib/MD5/MD5Loader.cpp. The root cause is improper handling of the argument iNewIndex, which can lead to memory corruption. The vulnerabi...

CVE-2026-82590

Open5GS versions up to 2.7.7 are affected by a vulnerability in the SMF (Session Management Function) component, specifically in the function smf_nudm_sdm_handle_get within src/smf/nudm-handler.c. A remote attacker can manipulate the preemptCap argument to trigger a reachable assertion , resultin...

CVE-2026-82589

Open5GS (up to 2.7.7) contains a denial-of-service vulnerability in the N1-N2 Message Handler component, specifically in the function amf_namf_comm_handle_n1_n2_message_transfer within src/amf/namf-handler.c. Manipulation of the field N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoConten...

CVE-2026-82588

A null pointer dereference vulnerability exists in Open5GS versions up to 2.7.7 , located in the file src/amf/namf-handler.c within the Transfer Endpoint component. The exact processing triggering the issue is described as unknown in the provided documents. The attack can be launched remotely and...

CVE-2026-56718

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service. An unauthenticated remote attacker can supply path traversal sequences in the HTTP request URI on port 80 to read arbitrary files with root privileges . Exposed data inclu...

CVE-2026-82587

CVE-2026-82587 affects Open5GS versions up to 2.7.7 , specifically the AMF component in the file src/amf/namf-handler.c. The vulnerable function is amf_namf_comm_decode_ue_mm_context_list , where manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption . The a...

CVE-2026-78693

ash_graphql (ash-project, Elixir/Erlang) is vulnerable to incomplete error-message redaction . In AshGraphql.Errors, the configured error_handler output is merged with the pre-handler path via Map.put_new(handled, :path, path), which re-injects the original path even when a sanitizing handler rem...

CVE-2026-80223

ash_graphql (Elixir GraphQL binding for the Ash framework) contains a cross-tenant subscription disclosure in its subscription resolver (AshGraphql.Graphql.Resolver). The fast path calls Ash.can/3 with run_queries?: false, evaluating the read policy filter in memory via Ash.Expr.eval/2 without is...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

CVE-2026-81633

CVE-2026-81633 is an improper input validation vulnerability in ash-project ash_graphql (Elixir GraphQL library). The function resolve_node/2 base64-decodes a client-supplied global ID and passes the type segment directly to Map.fetch!/2, which raises an unhandled KeyError when the type is not a ...

CVE-2026-81643

CVE-2026-81643 is a broken access control flaw in ash_graphql (versions 1.4.0 through 1.10.0 ). In AshGraphql.Subscription.Batcher, the should_send?/1 authorization filter is applied only to the first notification in a batch; remaining notifications are appended to outgoing results without that f...

CVE-2026-82367

CVE-2026-82367 is a re-entrant data-exposure bug in ash_graphql (ash-project), affecting versions 1.4.0 through before 1.11.0 . The root cause lies in AshGraphql.Subscription.Batcher.do_send/5, which reads and deletes the process-dictionary key :batch_resolved without namespacing it per run. On t...

CVE-2026-81322

CVE-2026-81322 is an information disclosure vulnerability in ash-project ash_cloak (versions 0.1.0 through before 0.4.0). The root cause is in AshCloak.Transformers.SetUpEncryption, which creates an action argument carrying the plaintext value of a cloaked attribute. This argument inherits the se...

CVE-2026-81319

CVE-2026-81319 is a deserialization of untrusted data flaw in ash_cloak (an Erlang/BEAM encryption library by ash-project), affecting versions 0.1.0 through before 0.4.0 . The root cause is that AshCloak.Calculations.Decrypt decodes the decrypted binary using Ash.Helpers.non_executable_binary_to_...