CVE Database

CVE-2026-51752 Medium · 5.3 CWE-284 Sep 1, 2026

Incorrect access control in the staticInfoSend function of TOTOLINK T6…

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51751 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the delSlaveDevice function of TOTOLINK T6…

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51750 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the updatePriChannel function of TOTOLINK T6…

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51748 Medium · 5.9 CWE-284 Sep 1, 2026

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6…

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs_broker component.

CVE-2026-84128 High · 8.8 CWE-284 Sep 1, 2026

Privilege escalation in the WebDriver BiDi component

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

CVE-2026-84117 High · 8.8 CWE-284 Sep 1, 2026

Privilege escalation in Firefox for Android

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-51747 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51745 Medium · 5.3 CWE-284 Sep 1, 2026

Incorrect access control in the updatePriStaList function of TOTOLINK T6…

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51744 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6…

Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51743 Critical · 9.1 CWE-284 Sep 1, 2026

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6…

Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component.

CVE-2026-51742 Medium · 5.9 CWE-284 Sep 1, 2026

Incorrect access control in the discoverWan function of TOTOLINK T6…

Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51741 Critical · 9.8 CWE-284 Sep 1, 2026

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6…

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-84200 Critical · 9.0 CWE-284 Sep 1, 2026

Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.

CVE-2026-84187 High · 8.2 CWE-284 Sep 1, 2026

AVideo on_publish.php Missing Authentication Check via RTMP Callback

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.

CVE-2026-84165 High · 8.7 CWE-284 Sep 1, 2026

Lack of authorisation in OpenNebula by OpenNebula Systems

A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.

CVE-2026-82745 Medium · 5.9 CWE-284 Sep 1, 2026

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ETS and Mnesia data layers implemented create as a keyed insert that replaces any existing entry with the same primary key (lib/ash/data_layer/ets/ets.ex, lib/ash/data_layer/mnesia/mnesia.ex). An actor who can set the primary key on a create (for example a user-supplied string or integer key) can submit a create whose key matches an existing record and silently overwrite it, destroying and replacing another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists with an already-taken error, and only allows duplicates for keyless resources. This issue affects ash: from 0.4.0 before 3.32.2.

CVE-2026-82921 High · 7.3 CWE-284 Aug 31, 2026

ShopEx ECShop pack.php check_img_type unrestricted upload

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-51740 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the killProcess function of TOTOLINK T6…

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51739 Medium · 5.9 CWE-284 Aug 31, 2026

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6…

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51738 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the LoadDefSettings function of TOTOLINK T6…

Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51737 Medium · 5.3 CWE-284 Aug 31, 2026

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6…

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51736 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the clearSyslog function of TOTOLINK T6…

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51735 High · 7.5 CWE-284 Aug 31, 2026

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51734 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6…

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51733 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6…

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.