By publication date

Exploited and new serious CVEs: August 2026

5,873 records · 20 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 58 of 59

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-82680No exploit	D-Link DSM-G600 Multipart load_file.cgi out-of-bounds writed-link · dsm-g600 · CWE-119 Memory safety	High7.4	—	0.8%	Aug 31, 2026
35Monitor	CVE-2026-82688No exploit	D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injectiond-link · dns-340l · CWE-77 RCE Command injection	High8.5	—	3.6%	Aug 31, 2026
37Monitor	CVE-2026-82876No exploit	Phison PS3111-S11 Controller Firmware Signature Verification Bypassphison electronics corporation · ps3111-s11 controller firmware · CWE-347 Weak crypto	Critical9.3	—	0.1%	Aug 31, 2026
34Monitor	CVE-2026-82880No exploit	YaCy Search Server through 1.941 XML External Entity Injection via Parsersyacy · yacy_search_server · CWE-611 Pre-auth XXE	High8.7	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-58574No exploit	Dell PowerStore contains a Missing Authentication for Critical Function vulnerability.dell · powerstoreos · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.6%	Aug 31, 2026
21Monitor	CVE-2026-70449No exploit	Apache Wicket: Path traversal in resource style/variation/localeapache · wicket · CWE-22 Pre-auth Path traversal	Medium5.3	—	0.9%	Aug 31, 2026
30Monitor	CVE-2026-71257No exploit	Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedapache · wicket · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Aug 31, 2026
35Monitor	CVE-2026-82689No exploit	D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injectiond-link · dns-320l · CWE-77 RCE Command injection	High8.6	—	3.2%	Aug 31, 2026
35Monitor	CVE-2026-82690No exploit	D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injectiond-link · dns-327l · CWE-77 RCE Command injection	High8.5	—	3.6%	Aug 31, 2026
35Monitor	CVE-2026-82691No exploit	D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injectiond-link · dns-320l · CWE-77 RCE Command injection	High8.5	—	3.6%	Aug 31, 2026
30Monitor	CVE-2026-81624No exploit	Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinitered hat · red hat build of apache camel for spring boot 4 · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Aug 31, 2026
38Monitor	CVE-2026-82854No exploit	Nodemailer before 8.0.4 SMTP Command Injection via envelope.sizenodemailer · nodemailer · CWE-93 pre-auth RCE Command injection	Critical9.3	—	1.9%	Aug 31, 2026
37Monitor	CVE-2026-82855No exploit	@hulumi/policies before 1.3.2 Evidence Validation Bypasshulumi · policies · CWE-693 Pre-auth	Critical9.3	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-82856No exploit	@hulumi/policies before 1.3.2 OIDC Trust Policy Bypasshulumi · policies · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-82858No exploit	@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptancehulumi · drift · CWE-345 Pre-auth	Critical9.3	—	0.2%	Aug 31, 2026
37Monitor	CVE-2026-82860No exploit	@hulumi/policies before 1.3.2 Admin Policy Bypasshulumi · policies · CWE-269 Pre-auth	Critical9.3	—	0.5%	Aug 31, 2026
34Monitor	CVE-2026-82861No exploit	@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypasshulumi · policies · CWE-284 Pre-auth Broken access control (IDOR)	High8.7	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-82863No exploit	@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detectionhulumi · baseline · CWE-778 Pre-auth	High8.7	—	0.2%	Aug 31, 2026
28Monitor	CVE-2026-82864No exploit	pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bombpdfme · pdf-lib · CWE-409	High7.1	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-82866No exploit	@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetchpdfme · common · CWE-918 Pre-auth SSRF	High8.9	—	0.3%	Aug 31, 2026
35Monitor	CVE-2026-5956No exploit	SQLi in Ankara Hosting's Site Management Panelankara hosting · site management panel · CWE-89 SQL injection	High8.8	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-82692No exploit	D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injectiond-link · dns-340l · CWE-77 RCE Command injection	High8.6	—	3.2%	Aug 31, 2026
37Monitor	CVE-2026-82693No exploit	Tenda AC1206 Web UI telnet TendaTelnet missing authenticationtenda · ac1206 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	1.4%	Aug 31, 2026
37Monitor	CVE-2026-82694No exploit	Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authenticationtenda · ac1206 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	1.4%	Aug 31, 2026
37Monitor	CVE-2026-82695No exploit	Tenda AC18 Telnet telnet missing authenticationtenda · ac18 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	1.4%	Aug 31, 2026
30Monitor	CVE-2026-19616No exploit	Information Disclosure in TBC Technology's KitLogistictbc technology inc. · kitlogistic · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Aug 31, 2026
31Monitor	CVE-2026-19702No exploit	OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repairtübi̇tak bi̇lgem software technologies research institute · pardus boot repair · CWE-78 RCE Command injection	High7.8	—	0.8%	Aug 31, 2026
30Monitor	CVE-2026-51668No exploit	Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify langCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51669No exploit	Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51670No exploit	Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slaveCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51671No exploit	Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51672No exploit	Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the rCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-51673No exploit	Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
39Monitor	CVE-2026-51674No exploit	Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure fCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51675No exploit	Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure upCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51676No exploit	Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter aCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51677No exploit	Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP serCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51679No exploit	Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51680No exploit	Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51681No exploit	Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-siCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
35Monitor	CVE-2026-78074No exploit	Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensionsminiorgange.com · miniorange oauth client (free) extension for joomla · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High8.8	—	0.5%	Aug 31, 2026
35Monitor	CVE-2026-78078No exploit	Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10joomshaper.com · helix ultimate extension for joomla · CWE-434 File upload	High8.9	—	0.4%	Aug 31, 2026
35Monitor	CVE-2026-82217No exploit	In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContenteclipse foundation · eclipse theia · CWE-22 Pre-auth Path traversal	High8.8	—	0.6%	Aug 31, 2026
28Monitor	CVE-2026-82877No exploit	ILIAS Arbitrary File Read via SOAP addFileilias-elearning e.v. · ilias · CWE-22 Path traversal	High7.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51684No exploit	Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the stCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51686No exploit	Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigureCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51687No exploit	Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
30Monitor	CVE-2026-51688No exploit	Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wiCWE-284 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51689No exploit	Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmwCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51690No exploit	Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream pCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51691No exploit	Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulatCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51692No exploit	Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51693No exploit	Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51694No exploit	Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
30Monitor	CVE-2026-51695No exploit	Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
39Monitor	CVE-2026-51696No exploit	Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to exposeCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51697No exploit	Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV servCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-59111No exploit	Command Injection vulnerability in eObčanka-Identifikaceministry of the interior (mvčr) · eobčanka-identifikace · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.3%	Aug 31, 2026
36Monitor	CVE-2026-66047No exploit	ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCEproper fraction · profilepress · CWE-306 pre-auth RCE Auth bypass	Critical9.2	—	0.9%	Aug 31, 2026
29Monitor	CVE-2026-78422No exploit	zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UIDz-galaxy · zbus_polkit · CWE-367 Local privilege escalation Race condition	High7.3	—	0.1%	Aug 31, 2026
40Plan	CVE-2026-82970No exploit	WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerabilitywp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consent · CWE-434 Pre-auth File upload	Critical10.0	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51152No exploit	Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.CWE-918 Pre-auth SSRF	Critical9.1	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51698No exploit	Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter brCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51699No exploit	Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51700No exploit	Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degradeCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51701No exploit	Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change dCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51705No exploit	Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51708No exploit	Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS aCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
39Monitor	CVE-2026-51709No exploit	Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigurCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51710No exploit	Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter parCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51711No exploit	Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wirCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51713No exploit	Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulatCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51715No exploit	Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove MCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51716No exploit	Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to deleteCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
36Monitor	CVE-2026-51717No exploit	Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the deCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51718No exploit	Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
30Monitor	CVE-2026-51719No exploit	Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove UCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Aug 31, 2026
37Monitor	CVE-2026-73819No exploit	Ebyte NA111-M Weak Authenticationebyte · ebyte na111-m firmware · CWE-1390 Pre-auth Auth bypass	Critical9.3	—	0.5%	Aug 31, 2026
28Monitor	CVE-2026-75132No exploit	WAPT Server SQL Injection via /api/v3/hosts Endpointtranquil_it · wapt · CWE-89 SQL injection	High7.1	—	0.4%	Aug 31, 2026
34Monitor	CVE-2026-75133No exploit	Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_processfahad mahmood · keep backup daily · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Aug 31, 2026
37Monitor	CVE-2026-76133No exploit	Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithmebyte · ebyte na111-m firmware · CWE-327 Pre-auth Weak crypto	Critical9.3	—	0.3%	Aug 31, 2026
34Monitor	CVE-2026-77966No exploit	Ebyte NA111-M Missing Authorizationebyte · ebyte na111-m firmware · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-77975No exploit	Ebyte NA111-M Cleartext Storage of Sensitive Informationebyte · ebyte ne2-d11 firmware · CWE-312 Pre-auth	High7.1	—	0.1%	Aug 31, 2026
34Monitor	CVE-2026-82807No exploit	ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges managementieungsoft · ultra ramdisk pro · CWE-266 Local privilege escalation	High8.5	—	0.1%	Aug 31, 2026
35Monitor	CVE-2026-12894No exploit	Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template enginequarkus · quarkus-qute · CWE-1336 RCE SSTI	High8.8	—	0.9%	Aug 31, 2026
36Monitor	CVE-2026-51720No exploit	Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to removCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51721No exploit	Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51722No exploit	Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repointCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51723No exploit	Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to installCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51724No exploit	Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove SmarCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51725No exploit	Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change theCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51726No exploit	Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove paCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
39Monitor	CVE-2026-51728No exploit	Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Aug 31, 2026
36Monitor	CVE-2026-51729No exploit	Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletionCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
36Monitor	CVE-2026-51730No exploit	Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-CWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Aug 31, 2026
35Monitor	CVE-2026-79744No exploit	MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configurationsamanhappy · mcphub · CWE-269	High8.8	—	0.5%	Aug 31, 2026
28Monitor	CVE-2026-79745No exploit	MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)samanhappy · mcphub · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Aug 31, 2026
32Monitor	CVE-2026-79746No exploit	MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matchingsamanhappy · mcphub · CWE-863 Broken access control (IDOR)	High8.1	—	0.4%	Aug 31, 2026
28Monitor	CVE-2026-79747No exploit	MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)samanhappy · mcphub · CWE-918 SSRF	High7.1	—	0.3%	Aug 31, 2026
39Monitor	CVE-2026-79748No exploit	MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)samanhappy · mcphub · CWE-862 RCE Broken access control (IDOR)	Critical9.9	—	0.6%	Aug 31, 2026

CVE-2026-82680
29Monitor
D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write
HighCVSS 7.4No exploitEPSS 0%
- Memory safety
d-link · dsm-g600Aug 31, 2026
CVE-2026-82688
35Monitor
D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection
HighCVSS 8.5No exploitEPSS 3%
- RCE
- Command injection
d-link · dns-340lAug 31, 2026
CVE-2026-82876
37Monitor
Phison PS3111-S11 Controller Firmware Signature Verification Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Weak crypto
phison electronics corporation · ps3111-s11 controller firmwareAug 31, 2026
CVE-2026-82880
34Monitor
YaCy Search Server through 1.941 XML External Entity Injection via Parsers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- XXE
yacy · yacy_search_serverAug 31, 2026
CVE-2026-58574
39Monitor
Dell PowerStore contains a Missing Authentication for Critical Function vulnerability.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · powerstoreosAug 31, 2026
CVE-2026-70449
21Monitor
Apache Wicket: Path traversal in resource style/variation/locale
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Path traversal
apache · wicketAug 31, 2026
CVE-2026-71257
30Monitor
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · wicketAug 31, 2026
CVE-2026-82689
35Monitor
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
d-link · dns-320lAug 31, 2026
CVE-2026-82690
35Monitor
D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection
HighCVSS 8.5No exploitEPSS 3%
- RCE
- Command injection
d-link · dns-327lAug 31, 2026
CVE-2026-82691
35Monitor
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection
HighCVSS 8.5No exploitEPSS 3%
- RCE
- Command injection
d-link · dns-320lAug 31, 2026
CVE-2026-81624
30Monitor
Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat build of apache camel for spring boot 4Aug 31, 2026
CVE-2026-82854
38Monitor
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
nodemailer · nodemailerAug 31, 2026
CVE-2026-82855
37Monitor
@hulumi/policies before 1.3.2 Evidence Validation Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
hulumi · policiesAug 31, 2026
CVE-2026-82856
37Monitor
@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hulumi · policiesAug 31, 2026
CVE-2026-82858
37Monitor
@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
hulumi · driftAug 31, 2026
CVE-2026-82860
37Monitor
@hulumi/policies before 1.3.2 Admin Policy Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
hulumi · policiesAug 31, 2026
CVE-2026-82861
34Monitor
@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hulumi · policiesAug 31, 2026
CVE-2026-82863
34Monitor
@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
hulumi · baselineAug 31, 2026
CVE-2026-82864
28Monitor
pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
HighCVSS 7.1No exploitEPSS 0%
pdfme · pdf-libAug 31, 2026
CVE-2026-82866
35Monitor
@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- SSRF
pdfme · commonAug 31, 2026
CVE-2026-5956
35Monitor
SQLi in Ankara Hosting's Site Management Panel
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
ankara hosting · site management panelAug 31, 2026
CVE-2026-82692
35Monitor
D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
d-link · dns-340lAug 31, 2026
CVE-2026-82693
37Monitor
Tenda AC1206 Web UI telnet TendaTelnet missing authentication
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
tenda · ac1206Aug 31, 2026
CVE-2026-82694
37Monitor
Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
tenda · ac1206Aug 31, 2026
CVE-2026-82695
37Monitor
Tenda AC18 Telnet telnet missing authentication
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Auth bypass
tenda · ac18Aug 31, 2026
CVE-2026-19616
30Monitor
Information Disclosure in TBC Technology's KitLogistic
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
tbc technology inc. · kitlogisticAug 31, 2026
CVE-2026-19702
31Monitor
OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
tübi̇tak bi̇lgem software technologies research institute · pardus boot repairAug 31, 2026
CVE-2026-51668
30Monitor
Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify lang
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51669
36Monitor
Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pairing
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51670
39Monitor
Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to query slave
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51671
30Monitor
Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obt
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51672
36Monitor
Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the r
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51673
30Monitor
Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synch
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51674
39Monitor
Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to configure f
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51675
36Monitor
Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure up
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51676
36Monitor
Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter a
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51677
36Monitor
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP ser
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51679
36Monitor
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51680
36Monitor
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behav
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51681
36Monitor
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-si
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-78074
35Monitor
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
miniorgange.com · miniorange oauth client (free) extension for joomlaAug 31, 2026
CVE-2026-78078
35Monitor
Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10
HighCVSS 8.9No exploitEPSS 0%
- File upload
joomshaper.com · helix ultimate extension for joomlaAug 31, 2026
CVE-2026-82217
35Monitor
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
eclipse foundation · eclipse theiaAug 31, 2026
CVE-2026-82877
28Monitor
ILIAS Arbitrary File Read via SOAP addFile
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
ilias-elearning e.v. · iliasAug 31, 2026
CVE-2026-51684
39Monitor
Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the st
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51686
39Monitor
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51687
36Monitor
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51688
30Monitor
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wi
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
Aug 31, 2026
CVE-2026-51689
36Monitor
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmw
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51690
36Monitor
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream p
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51691
39Monitor
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51692
36Monitor
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51693
39Monitor
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51694
30Monitor
Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51695
30Monitor
Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic D
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51696
39Monitor
Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51697
36Monitor
Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV serv
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-59111
37Monitor
Command Injection vulnerability in eObčanka-Identifikace
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
ministry of the interior (mvčr) · eobčanka-identifikaceAug 31, 2026
CVE-2026-66047
36Monitor
ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
proper fraction · profilepressAug 31, 2026
CVE-2026-78422
29Monitor
zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
- Race condition
z-galaxy · zbus_polkitAug 31, 2026
CVE-2026-82970
40Plan
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- File upload
wp legal pages · wp cookie notice for gdpr, ccpa & eprivacy consentAug 31, 2026
CVE-2026-51152
36Monitor
Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
Aug 31, 2026
CVE-2026-51698
36Monitor
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter br
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51699
39Monitor
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an intern
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51700
36Monitor
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51701
36Monitor
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change d
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51705
39Monitor
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mes
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51708
39Monitor
Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS a
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51709
39Monitor
Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigur
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51710
36Monitor
Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter par
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51711
36Monitor
Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wir
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51713
36Monitor
Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51715
39Monitor
Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove M
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51716
30Monitor
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51717
36Monitor
Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the de
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51718
39Monitor
Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51719
30Monitor
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove U
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-73819
37Monitor
Ebyte NA111-M Weak Authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-75132
28Monitor
WAPT Server SQL Injection via /api/v3/hosts Endpoint
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
tranquil_it · waptAug 31, 2026
CVE-2026-75133
34Monitor
Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
fahad mahmood · keep backup dailyAug 31, 2026
CVE-2026-76133
37Monitor
Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-77966
34Monitor
Ebyte NA111-M Missing Authorization
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
ebyte · ebyte na111-m firmwareAug 31, 2026
CVE-2026-77975
28Monitor
Ebyte NA111-M Cleartext Storage of Sensitive Information
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
ebyte · ebyte ne2-d11 firmwareAug 31, 2026
CVE-2026-82807
34Monitor
ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
ieungsoft · ultra ramdisk proAug 31, 2026
CVE-2026-12894
35Monitor
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSTI
quarkus · quarkus-quteAug 31, 2026
CVE-2026-51720
36Monitor
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remov
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51721
36Monitor
Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51722
36Monitor
Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51723
36Monitor
Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51724
39Monitor
Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smar
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51725
36Monitor
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51726
36Monitor
Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove pa
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51728
39Monitor
Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51729
36Monitor
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-51730
36Monitor
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Aug 31, 2026
CVE-2026-79744
35Monitor
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
HighCVSS 8.8No exploitEPSS 0%
samanhappy · mcphubAug 31, 2026
CVE-2026-79745
28Monitor
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-79746
32Monitor
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026
CVE-2026-79747
28Monitor
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
HighCVSS 7.1No exploitEPSS 0%
- SSRF
samanhappy · mcphubAug 31, 2026
CVE-2026-79748
39Monitor
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
samanhappy · mcphubAug 31, 2026