CVE-2026-19820 - A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creat

CVE-2026-83524 - A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optim

CVE-2026-82971 - A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown par

CVE-2026-4560 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-82957 - A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the fu

CVE-2026-82954 - A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikCo

CVE-2026-82922 - A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects

CVE-2026-82921 - A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_typ

CVE-2026-82882 - Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webho

CVE-2026-82398 - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PD

CVE-2026-82397 - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parse

CVE-2026-82396 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82395 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82394 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82393 - pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a t

CVE-2026-77353 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallo

CVE-2026-77352 - Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before

CVE-2026-77351 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallo

CVE-2026-77348 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the f

CVE-2026-83596 - A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to i

CVE-2026-82919 - A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the func

CVE-2026-82914 - A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability

CVE-2026-82909 - A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is s

CVE-2026-82908 - A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is th

CVE-2026-82906 - A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the fi

CVE-2026-82852 - Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.

CVE-2026-82392 - pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package n

CVE-2026-82346 - A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.

CVE-2026-82229 - Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

CVE-2026-82228 - Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

CVE-2026-82226 - Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

CVE-2026-82225 - Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

CVE-2026-82224 - Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

CVE-2026-82221 - Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

CVE-2026-81892 - EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 an

CVE-2026-81891 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81890 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81889 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81888 - @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in so

CVE-2026-81887 - Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-not

CVE-2026-81780 - Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVE-2026-81779 - Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows

CVE-2026-81778 - Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

CVE-2026-81768 - Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

CVE-2026-81765 - Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

CVE-2026-81764 - Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

CVE-2026-81763 - Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

CVE-2026-81762 - Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

CVE-2026-81758 - Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

CVE-2026-81756 - Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

CVE-2026-81298 - Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

CVE-2026-81297 - Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81296 - Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81293 - Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

CVE-2026-81291 - Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

CVE-2026-81290 - Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

CVE-2026-81287 - Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

CVE-2026-81280 - Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4

CVE-2026-81278 - Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured

CVE-2026-79483 - FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api

CVE-2026-79408 - An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary comma

CVE-2026-79407 - A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbi

CVE-2026-75594 - Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the releas

CVE-2026-75592 - Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the releas

CVE-2026-75460 - XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-en

CVE-2026-75458 - The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <=

CVE-2026-71415 - Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk up

CVE-2026-62993 - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from app

CVE-2026-61641 - Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before

CVE-2026-61640 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin

CVE-2026-61639 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST

CVE-2026-61638 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST

CVE-2026-54600 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo

CVE-2026-54599 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login

CVE-2026-54598 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo

CVE-2026-54179 - backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of

CVE-2026-50199 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpo

CVE-2026-50198 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an au

CVE-2026-38577 - Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to

CVE-2025-63607 - TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoe

CVE-2026-82905 - A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of

CVE-2026-82835 - A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unkno

CVE-2026-82834 - A security flaw has been discovered in Doccano Open Source Annotation Tools for Machine Learning Pra

CVE-2026-82833 - A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practiti

CVE-2026-81267 - A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address

CVE-2026-52730 - Xibo is an open source digital signage platform with a web content management system and Windows dis

CVE-2026-51740 - Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51739 - Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-51738 - Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51737 - Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51736 - Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51735 - Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51734 - Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51733 - Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51732 - Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51731 - Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-14697 - net_ipv6_send_ns() in subsys/net/ip/ipv6_nbr.c allocates a transmit net_pkt for a Neighbor Solicitat

CVE-2026-13732 - A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/sta

CVE-2026-83497 - Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch

CVE-2026-82821 - A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the functio

CVE-2026-82820 - A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the fil

CVE-2026-82818 - A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the fi

CVE-2026-72001 - Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated a

CVE-2026-53553 - Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traver

CVE-2026-53552 - Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile

CVE-2026-53508 - oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs

CVE-2026-53507 - oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review o

CVE-2026-14696 - When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys

CVE-2026-14368 - The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a par

CVE-2026-14367 - The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes throu

CVE-2023-31308 - A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of

CVE-2023-20511 - Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker

CVE-2026-82817 - A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown func

CVE-2026-82816 - A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an u

CVE-2026-82815 - A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file

CVE-2026-82813 - A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. Thi

CVE-2026-82811 - A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects a

CVE-2026-79750 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79749 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79748 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79747 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79746 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79745 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79744 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-79743 - MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP

CVE-2026-51730 - Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51729 - Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51728 - Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51727 - Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51726 - Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51725 - Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-19953 - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via miss

CVE-2026-82810 - A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The im

CVE-2026-82809 - A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The aff

CVE-2026-82808 - A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impac

CVE-2026-51724 - Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51723 - Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51722 - Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51721 - Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51720 - Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-17615 - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker

CVE-2026-14366 - The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx

CVE-2026-83492 - Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affec

CVE-2026-82823 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82814. Reason:

CVE-2026-82807 - A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown

CVE-2026-82805 - A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of

CVE-2026-82803 - A vulnerability has been found in armink struct2json 1.0. This affects the function S2J_STRUCT_GET_s

CVE-2026-82802 - A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSea

CVE-2026-77975 - The affected Ebyte product exports administrative credentials and other sensitive configuration i

CVE-2026-77966 - The affected Ebyte product does not provide separation between limited and administrative managem

CVE-2026-76133 - The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related oper

CVE-2026-75133 - Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulner

CVE-2026-75132 - WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns`

CVE-2026-73819 - The affected Ebyte product's vendor configuration utility permits access to administrative functi

CVE-2026-51719 - Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51718 - Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51717 - Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51716 - Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-51715 - Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51714 - Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51713 - Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51712 - Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51711 - Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51710 - Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51709 - Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51708 - Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51706 - Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51705 - Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51704 - Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51703 - Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51702 - Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-51701 - Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51700 - Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51699 - Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51698 - Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51153 - Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 th

CVE-2026-51152 - Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetche

CVE-2026-21827 - HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to

CVE-2026-82970 - Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for

CVE-2026-82801 - A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the f

CVE-2026-82703 - A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function

CVE-2026-82702 - A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file

CVE-2026-82701 - A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue i

CVE-2026-78422 - Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit sub

CVE-2026-66047 - ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code

CVE-2026-63083 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-59111 - Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi

CVE-2026-51697 - Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51696 - Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-51695 - Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51694 - Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51693 - Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51692 - Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51691 - Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51690 - Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51689 - Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51688 - Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51687 - Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51686 - Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51684 - Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51683 - Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-82700 - A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerabilit

CVE-2026-82699 - A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe53

CVE-2026-82698 - A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb

CVE-2026-82697 - A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e90

CVE-2026-82217 - In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change too

CVE-2026-78079 - Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.

CVE-2026-78078 - Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ulti

CVE-2026-78077 - Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container

CVE-2026-78076 - Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settin

CVE-2026-78075 - Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Heli

CVE-2026-78074 - Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various

CVE-2026-76986 - Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.mar

CVE-2026-76985 - Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ext

CVE-2026-76763 - A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly va

CVE-2026-51681 - Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51680 - Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51679 - Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51678 - Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51677 - Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51676 - Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51675 - Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51674 - Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51673 - Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51672 - Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51671 - Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015

CVE-2026-51670 - Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51669 - Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51668 - Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-19702 - Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi

CVE-2026-19616 - Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionalit

CVE-2026-82696 - A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element

CVE-2026-82695 - A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of th

CVE-2026-82694 - A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSe

CVE-2026-82693 - A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function

CVE-2026-82692 - A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown par

CVE-2026-74010 - Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Confi

CVE-2026-5956 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-51667 - Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51666 - Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-12894 - A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content l

CVE-2026-82797 - Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nest

CVE-2026-82691 - A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Af

CVE-2026-82690 - A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability

CVE-2026-82689 - A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affe

CVE-2026-76984 - Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.mar

CVE-2026-76983 - Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> ta

CVE-2026-76982 - Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.mar

CVE-2026-75802 - AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writ

CVE-2026-71378 - ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forge