Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51762 | critical | 9.8 | No | Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean... | 2026-09-03 |
| CVE-2026-51754 | critical | 9.8 | No | Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrit... | 2026-09-03 |
| CVE-2026-51747 | critical | 9.8 | No | Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect me... | 2026-09-03 |
| CVE-2026-51741 | critical | 9.8 | No | Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase di... | 2026-09-03 |
| CVE-2026-84831 | not reported | — | No | SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is com... | 2026-09-03 |
| CVE-2026-84830 | not reported | — | No | SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute c... | 2026-09-03 |
| CVE-2026-76178 | not reported | — | No | A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notificat... | 2026-09-03 |
| CVE-2026-76177 | not reported | — | No | Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the H... | 2026-09-03 |
| CVE-2026-76176 | not reported | — | No | SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID f... | 2026-09-03 |
| CVE-2026-76175 | not reported | — | No | SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authentic... | 2026-09-03 |
| CVE-2026-76174 | not reported | — | No | Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates... | 2026-09-03 |
| CVE-2026-6071 | not reported | — | No | A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write pa... | 2026-09-03 |
| CVE-2026-82968 | medium | 6.4 | No | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider ac... | 2026-09-03 |
| CVE-2021-43614 | medium | 6.7 | No | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. | 2026-09-03 |
| CVE-2021-43613 | medium | 6.5 | No | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables,... | 2026-09-03 |
| CVE-2021-38489 | high | 8.2 | No | HDD password plaintext is stored in a UEFI variable. | 2026-09-03 |
| CVE-2026-82293 | medium | 4.3 | No | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorr... | 2026-09-03 |
| CVE-2026-8151 | medium | 5.4 | No | The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers... | 2026-09-03 |
| CVE-2026-83547 | medium | 6.8 | No | The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attr... | 2026-09-03 |
| CVE-2026-83533 | medium | 5.3 | No | The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an or... | 2026-09-03 |