CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 allows unauthenticated attackers to change the device operating mode via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to delete port-forwarding rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove MAC filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to alter roaming behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 allows unauthenticated attackers to manipulate WAN dial state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to alter wireless availability windows via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 allows unauthenticated attackers to open a wireless pairing window via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setParentalRules function of TOTOLINK T6 allows unauthenticated attackers to alter parental-control behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 allows unauthenticated attackers to change WPS availability via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade traffic handling via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 allows unauthenticated attackers to rename mesh entries via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to alter mesh configurations via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to alter Wi-Fi availability schedule by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter firewall policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to change device access control by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 allows unauthenticated attackers to degrade wireless behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to expose an internal host by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to alter browsing policies by sending a crafted POST request to /cgi-bin/cstecgi.cgi.
Stored Cross-Site Scripting (XSS) vulnerability in TaskRunHandler.post() in web/handlers/task.py in QD. When a task is run via /task/<taskid>/run, task log content is rendered into the HTML response without HTML encoding, allowing a low-privileged attacker to inject malicious script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS