CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.
MCPHub before version 0.12.15 lacks authorization checks for admin-only endpoints and does not sanitize command and args fields. Any authenticated non-admin user can execute arbitrary processes as the MCPHub server OS user, often root.
The delWiFiAclRules function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to remove Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delDevice function of TOTOLINK T6 allows unauthenticated attackers to request deletion of a managed slave device by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 allows unauthenticated attackers to upload a crafted firmware image by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delParentalRules function of TOTOLINK T6 allows unauthenticated attackers to remove parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
The NTPSyncWithHost function in TOTOLINK T6 4.1.5cu.748_B20211015 has incorrect access control, allowing unauthenticated attackers to change the device clock via a crafted POST request to /cgi-bin/cstecgi.cgi.
In TOTOLINK T6 router version 4.1.5cu.748_B20211015, incorrect access control in the delSmartQosCfg function allows unauthenticated attackers to remove Smart QoS rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 allows unauthenticated attackers to install a custom CGI module via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setPairCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the mesh pairing state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove firewall filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to remove static DHCP reservations via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 allows unauthenticated attackers to change the device operating mode via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove MAC filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 allows unauthenticated attackers to manipulate WAN dial state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 allows unauthenticated attackers to open a wireless pairing window via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setParentalRules function of TOTOLINK T6 allows unauthenticated attackers to alter parental-control behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS