CVE Database

CVE-2026-20279 Critical · 9.8 CWE-284 Sep 2, 2026

Cisco IOS XR Software Security Hardening Release: September 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

CVE-2026-84668 High · 8.8 CWE-284 Sep 2, 2026

Improper Access Control in Jenkins Project Jenkins SAML Plugin

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user.

CVE-2026-84651 Medium · 6.3 CWE-284 Sep 2, 2026

Improper Access Control in Jenkins

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.

CVE-2026-84804 Medium · 5.4 CWE-284 Sep 2, 2026

Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

CVE-2026-73762 Medium · 6.6 CWE-284 Sep 1, 2026

Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.

CVE-2026-73750 High · 8.8 CWE-284 Sep 1, 2026

Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.

CVE-2026-73749 Critical · 9.8 CWE-284 Sep 1, 2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code execution with elevated privileges.

CVE-2026-73741 Medium · 4.3 CWE-284 Sep 1, 2026

Authenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API

A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level.

CVE-2026-52111 Critical · 9.8 CWE-284 Sep 1, 2026

An issue in fast-note-sync-service

An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey

CVE-2024-7953 High · 8.7 CWE-284 Sep 1, 2026

DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project.

CVE-2026-51956 High · 8.1 CWE-284 Sep 1, 2026

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to…

A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. An authenticated user from one tenant can read and modify another tenant's company record by changing only the numeric ID in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing cross-tenant access and modification of company profile data.

CVE-2026-51770 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6…

Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via sending a crafted MQTT message to the cs_broker component..

CVE-2026-51769 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6…

Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51768 High · 7.5 CWE-284 Sep 1, 2026

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6…

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51767 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6…

Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51766 High · 7.5 CWE-284 Sep 1, 2026

Incorrect access control in the setDevReboot function of TOTOLINK T6…

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51765 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6…

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51764 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6…

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51763 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the freeStaClient function of TOTOLINK T6…

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51762 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the meshInfoKick function of TOTOLINK T6…

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51761 Medium · 5.3 CWE-284 Sep 1, 2026

Incorrect access control in the updateLanIp function of TOTOLINK T6…

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51760 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6…

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51757 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6…

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51756 Medium · 5.9 CWE-284 Sep 1, 2026

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6…

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51754 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6…

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the cs_broker component.