CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.30)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Incorrect access control in the getRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain remote-management enablement and port information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain WAN information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getCrpcCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getCrpcConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain cloud remote-control status and URL information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh routing information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh configuration and runtime state information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getIptvCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain IPTV and IGMP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getStationMacByIp function of TOTOLINK T6 allows unauthenticated attackers to obtain a client MAC address via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getInitCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive device configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain network topology and interface configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getOnlineClient function of TOTOLINK T6 allows unauthenticated attackers to obtain online client information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWizardCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getWanIeCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Incorrect access control in the getLanCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via a crafted POST request to /cgi-bin/cstecgi.cgi.
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Reflected Cross-Site Scripting (XSS) vulnerability in the JetEngine plugin by Crocoblock. Improper neutralization of input during web page generation allows reflection of a malicious script in the server response.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS