VYPR

CVEs

378,628 total · page 221 of 7,573

AllCriticalHighKEV
  • CVE-2026-75132MedAug 31, 2026
    Wapt
    Wapt Server
    risk 0.42cvss 6.5epss 0.00

    WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by…

  • CVE-2026-73819CriAug 31, 2026
    EBYTE
    gateway product's vendor configuration utility
    risk 0.64cvss 9.8epss 0.01

    The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change…

  • CVE-2026-51719HigAug 31, 2026
    Totolink
    T6
    risk 0.49cvss 7.5epss 0.00

    Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51718CriAug 31, 2026
    Totolink
    T6
    risk 0.64cvss 9.8epss 0.00

    Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51717CriAug 31, 2026
    Totolink
    T6
    risk 0.59cvss 9.1epss 0.00

    Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51716HigAug 31, 2026
    Totolink
    T6
    risk 0.49cvss 7.5epss 0.00

    Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51715Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51714MedAug 31, 2026
    Totolink
    T6
    risk 0.38cvss 5.9epss 0.00

    Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roaming behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51713Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51712MedAug 31, 2026
    Totolink
    T6
    risk 0.38cvss 5.9epss 0.00

    Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51711CriAug 31, 2026
    Totolink
    T6
    risk 0.59cvss 9.1epss 0.00

    Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wireless pairing window via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51710CriAug 31, 2026
    Totolink
    T6
    risk 0.59cvss 9.1epss 0.00

    Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parental-control behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51709CriAug 31, 2026
    Totolink
    T6
    risk 0.64cvss 9.8epss 0.00

    Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51708CriAug 31, 2026
    Totolink
    T6
    risk 0.64cvss 9.8epss 0.00

    Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51706MedAug 31, 2026
    Totolink
    T6
    risk 0.28cvss 4.3epss 0.00

    Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51705CriAug 31, 2026
    Totolink
    T6
    risk 0.64cvss 9.8epss 0.00

    Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51704MedAug 31, 2026
    Totolink
    T6
    risk 0.28cvss 4.3epss 0.00

    Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51703MedAug 31, 2026
    Totolink
    T6
    risk 0.35cvss 5.4epss 0.00

    Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51702MedAug 31, 2026
    Totolink
    T6
    risk 0.28cvss 4.3epss 0.00

    Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51701CriAug 31, 2026
    Totolink
    T6
    risk 0.59cvss 9.1epss 0.00

    Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51700Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51699Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51698Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51153MedAug 31, 2026
    Qd Today
    Qd
    risk 0.35cvss 5.4epss 0.00

    Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML…

  • CVE-2026-51152CriAug 31, 2026
    risk 0.59cvss 9.1epss 0.00

    Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not…

  • CVE-2026-21827LowAug 31, 2026
    HCL Software
    Connections
    risk 0.20cvss 3.1epss 0.00

    HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.

  • CVE-2026-82970CriAug 31, 2026
    WordPress
    WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
    risk 0.65cvss 10.0epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.

  • CVE-2026-82801HigAug 31, 2026
    Nasa
    earthdata-search
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack…

  • CVE-2026-82703MedAug 31, 2026
    Edimax
    BR-6214K
    risk 0.43cvss 6.6epss 0.02

    A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be…

  • CVE-2026-82702MedAug 31, 2026
    Edimax
    BR-6214K
    risk 0.43cvss 6.6epss 0.02

    A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The…

  • CVE-2026-82701HigAug 31, 2026
    Code Projects
    Online Shopping System
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to…

  • CVE-2026-78422HigAug 31, 2026
    Z Galaxy
    Zbus Polkit
    risk 0.40cvss —epss 0.00

    Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this…

  • CVE-2026-66047HigAug 31, 2026
    WordPress
    Profilepress
    risk 0.53cvss 8.1epss 0.01

    ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the…

  • CVE-2026-63083Aug 31, 2026
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • CVE-2026-59111CriAug 31, 2026
    Digitální A Informační Agentura
    eObčanka-Identifikace
    risk 0.60cvss 9.3epss 0.01

    Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized…

  • CVE-2026-51697Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51696Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51695Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51694Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51693Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51692Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51691Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51690Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51689Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51688Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51687Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51686CriAug 31, 2026
    Totolink
    T6
    risk 0.64cvss 9.8epss 0.00

    Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51684Aug 31, 2026
    Totolink
    T6
    risk 0.00cvss —epss 0.00

    Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-51683MedAug 31, 2026
    Totolink
    T6
    risk 0.28cvss 4.3epss 0.00

    Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

  • CVE-2026-82700MedAug 31, 2026
    Code Projects
    Online Shopping System
    risk 0.28cvss 4.3epss 0.00

    A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The…