Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19471 | not reported | — | No | Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitize... | 2026-09-01 |
| CVE-2026-11873 | medium | 6.5 | No | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for u... | 2026-09-01 |
| CVE-2026-51766 | high | 7.5 | No | Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the lo... | 2026-09-01 |
| CVE-2026-51761 | medium | 5.3 | No | Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LA... | 2026-09-01 |
| CVE-2026-51756 | medium | 5.9 | No | Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmw... | 2026-09-01 |
| CVE-2026-51752 | medium | 5.3 | No | Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger sta... | 2026-09-01 |
| CVE-2026-51748 | medium | 5.9 | No | Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upd... | 2026-09-01 |
| CVE-2026-51745 | medium | 5.3 | No | Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh t... | 2026-09-01 |
| CVE-2026-51743 | critical | 9.1 | No | Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable gu... | 2026-09-01 |
| CVE-2026-51742 | medium | 5.9 | No | Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN di... | 2026-09-01 |
| CVE-2026-13348 | not reported | — | No | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized ac... | 2026-09-01 |
| CVE-2026-13337 | not reported | — | No | CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when... | 2026-09-01 |
| CVE-2026-13336 | not reported | — | No | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause exe... | 2026-09-01 |
| CVE-2026-10420 | medium | 5.5 | No | Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 10... | 2026-09-01 |
| CVE-2026-84165 | not reported | — | No | A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerab... | 2026-09-01 |
| CVE-2026-82927 | medium | 5.5 | No | Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06... | 2026-09-01 |
| CVE-2026-82926 | medium | 5.5 | No | NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59a... | 2026-09-01 |
| CVE-2026-4813 | not reported | — | No | A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute co... | 2026-09-01 |
| CVE-2026-78363 | medium | 4.8 | No | The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those v... | 2026-09-01 |
| CVE-2026-74916 | medium | 6.5 | No | The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while s... | 2026-09-01 |