CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh routing information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh configuration and runtime state information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 allows unauthenticated attackers to obtain a client MAC address via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getInitCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive device configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain network topology and interface configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getOnlineClient function of TOTOLINK T6 allows unauthenticated attackers to obtain online client information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWizardCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getLanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Reflected Cross-Site Scripting (XSS) vulnerability in the JetEngine plugin by Crocoblock. Improper neutralization of input during web page generation allows reflection of a malicious script in the server response.
Vulnerability allowing remote code execution (RCE) by a user with the author role in the Rank Math SEO plugin in versions up to and including 1.0.276.
Unauthenticated Denial of Service (DoS) attack in the Smush Image Compression and Optimization plugin in versions up to and including 4.2.0.
In wolfEngine before version 1.4.1, the 8-byte explicit AES-GCM nonce is generated once when the TLS write key is set and never incremented per record. As a result, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream and leaks the GHASH authentication key, enabling authentication tag forgery.
In wolfProvider before version 1.2.2, the 8-byte explicit AES-GCM nonce is generated once when the TLS write key is set and never incremented per record. As a result, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream and leaks the GHASH authentication key, enabling authentication tag forgery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS