Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-51956
Alta · 8.1
CWE-284 01/09/2026
A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to…
A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.
CVE-2026-51770
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6…
Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..
CVE-2026-51769
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6…
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51768
Alta · 7.5
CWE-284 01/09/2026
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6…
Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51767
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6…
Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51766
Alta · 7.5
CWE-284 01/09/2026
Incorrect access control in the setDevReboot function of TOTOLINK T6…
Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51765
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6…
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51764
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6…
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51763
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the freeStaClient function of TOTOLINK T6…
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51762
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the meshInfoKick function of TOTOLINK T6…
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51761
Média · 5.3
CWE-284 01/09/2026
Incorrect access control in the updateLanIp function of TOTOLINK T6…
Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51760
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6…
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51757
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6…
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51756
Média · 5.9
CWE-284 01/09/2026
Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6…
Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51754
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6…
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51752
Média · 5.3
CWE-284 01/09/2026
Incorrect access control in the staticInfoSend function of TOTOLINK T6…
Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51751
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the delSlaveDevice function of TOTOLINK T6…
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51750
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the updatePriChannel function of TOTOLINK T6…
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51748
Média · 5.9
CWE-284 01/09/2026
Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6…
Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs_broker component.
CVE-2026-84128
Alta · 8.8
CWE-284 01/09/2026
Privilege escalation in the WebDriver BiDi component
Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84117
Alta · 8.8
CWE-284 01/09/2026
Privilege escalation in Firefox for Android
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.
CVE-2026-51747
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51745
Média · 5.3
CWE-284 01/09/2026
Incorrect access control in the updatePriStaList function of TOTOLINK T6…
Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51744
Crítica · 9.8
CWE-284 01/09/2026
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6…
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.
CVE-2026-51743
Crítica · 9.1
CWE-284 01/09/2026
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6…
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.