CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to trigger mesh slave update coordination by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delVlanCfg function of TOTOLINK T6 allows unauthenticated attackers to remove VLAN entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.
MCPHub before version 0.12.15 lacks authorization checks for admin-only endpoints and does not sanitize command and args fields. Any authenticated non-admin user can execute arbitrary processes as the MCPHub server OS user, often root.
The delWiFiAclRules function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to remove Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delDevice function of TOTOLINK T6 allows unauthenticated attackers to request deletion of a managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 allows unauthenticated attackers to upload a crafted firmware image by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delParentalRules function of TOTOLINK T6 allows unauthenticated attackers to remove parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
The NTPSyncWithHost function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to change the device clock via a crafted POST request to /cgi-bin/cstecgi.cgi.
In TOTOLINK T6 router version 4.1.5cu.748_B20211015, incorrect access control in the delSmartQosCfg function allows unauthenticated attackers to remove Smart QoS rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 allows unauthenticated attackers to install a custom CGI module via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setPairCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the mesh pairing state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove firewall filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS