Total
7905 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-37072 | 2026-09-03 | 9.8 Critical | ||
| Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. | ||||
| CVE-2026-73741 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-03 | 4.3 Medium |
| A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level. | ||||
| CVE-2026-71574 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 6.5 Medium |
| Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | ||||
| CVE-2026-72532 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 5.4 Medium |
| Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints. | ||||
| CVE-2026-72531 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 5.4 Medium |
| Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components. | ||||
| CVE-2026-73372 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 4.3 Medium |
| Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets. | ||||
| CVE-2026-73371 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 4.3 Medium |
| Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. | ||||
| CVE-2026-51684 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51691 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51733 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51738 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51751 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51763 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51768 | 1 Totolink | 1 T6 | 2026-09-03 | 7.5 High |
| Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-37070 | 2026-09-03 | 6.5 Medium | ||
| Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint. | ||||
| CVE-2026-51744 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51760 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51765 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-52111 | 2026-09-03 | 9.8 Critical | ||
| An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey | ||||
| CVE-2026-51611 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message. | ||||