CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to change WPS availability via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 allows unauthenticated attackers to rename mesh entries via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to change device access control by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to expose an internal host by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter browsing policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Server-side request forgery (SSRF) vulnerability in the /har/test endpoint in QD. Fetcher.build_request() constructs an HTTP request from user-supplied data without validating URL scheme, host, or IP range, and the endpoint does not require authentication.
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.
An OS command injection vulnerability in the eObčanka-Identifikace application (DIA) on MacOS allows an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
Incorrect access control in the setIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to alter IPTV service configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to expose internal services via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to weaken edge filtering via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 allows unauthenticated attackers to establish or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setUploadSetting function of TOTOLINK T6 allows unauthenticated attackers to manipulate the upload or flash workflow via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWanCfg function of TOTOLINK T6 allows unauthenticated attackers to alter WAN configuration and connectivity via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 allows unauthenticated attackers to create or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure or disable wireless networks via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the storage-related service state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS