Total
7899 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-51677 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51709 | 1 Totolink | 1 T6 | 2026-09-01 | 9.8 Critical |
| Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51710 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51701 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51711 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51717 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51718 | 1 Totolink | 1 T6 | 2026-09-01 | 9.8 Critical |
| Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51740 | 1 Totolink | 1 T6 | 2026-09-01 | 9.8 Critical |
| Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51668 | 1 Totolink | 1 T6 | 2026-09-01 | 7.5 High |
| Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51671 | 1 Totolink | 1 T6 | 2026-09-01 | 7.5 High |
| Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51672 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51673 | 1 Totolink | 1 T6 | 2026-09-01 | 7.5 High |
| Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51674 | 1 Totolink | 1 T6 | 2026-09-01 | 9.8 Critical |
| Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51676 | 1 Totolink | 1 T6 | 2026-09-01 | 9.1 Critical |
| Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51708 | 1 Totolink | 1 T6 | 2026-09-01 | 9.8 Critical |
| Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51716 | 1 Totolink | 1 T6 | 2026-09-01 | 7.5 High |
| Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-84187 | 1 Wwbn | 1 Avideo | 2026-09-01 | 8.2 High |
| AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization. | ||||
| CVE-2026-82835 | 1 Caoqianming | 1 Django-vue-admin | 2026-09-01 | 5.4 Medium |
| A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82548 | 2 Linux Foundation, Linuxfoundation | 2 Magma, Magma | 2026-09-01 | 5.3 Medium |
| A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-77553 | 1 Ui | 1 Unifi Access Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device. | ||||