CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the setLedCfg function of TOTOLINK T6 allows unauthenticated attackers to modify LED behavior via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to change the administrator account via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to alter logging configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to change UPnP service state via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to alter access-device policies via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure uplink settings via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to configure forced reboot tasks via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to alter time synchronization settings via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getRoamingCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the roaming enablement flag via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud firmware download state information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getPairCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the setLanguageCfg function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify language configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.
Pardus Boot Repair (TÜBİTAK BİLGEM product) has an OS command injection vulnerability due to improper neutralization of special elements. Affects versions from 1.0.7 before 1.0.8.
KitLogistic (TBC Technology Inc. product) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions before v2.2.2.
A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in /pages/inv_searchfrm.php. Manipulation of the ID argument allows remote SQL queries. The exploit is public.
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS