# Vulnerabilities published in 2026


- [CVE-2026-51821](https://insights.sbomify.com/CVE-2026-51821/): SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /use (critical 9.8)
- [CVE-2026-5182](https://insights.sbomify.com/CVE-2026-5182/): SourceCodester Teacher Record System Parameter sql injection (medium 6.9)
- [CVE-2026-5181](https://insights.sbomify.com/CVE-2026-5181/): SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload (medium 5.3)
- [CVE-2026-51808](https://insights.sbomify.com/CVE-2026-51808/): Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl:: (critical 9.8)
- [CVE-2026-51807](https://insights.sbomify.com/CVE-2026-51807/): Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) ca (critical 9.8)
- [CVE-2026-5180](https://insights.sbomify.com/CVE-2026-5180/): SourceCodester Simple Doctors Appointment System ajax.php sql injection (medium 6.9)
- [CVE-2026-5179](https://insights.sbomify.com/CVE-2026-5179/): SourceCodester Simple Doctors Appointment System login.php sql injection (medium 6.9)
- [CVE-2026-51788](https://insights.sbomify.com/CVE-2026-51788/): An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification function and the acc (high 7.5)
- [CVE-2026-51785](https://insights.sbomify.com/CVE-2026-51785/): An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request (critical 9.8)
- [CVE-2026-5178](https://insights.sbomify.com/CVE-2026-5178/): Totolink A3300R cstecgi.cgi setIptvCfg command injection (medium 5.3)
- [CVE-2026-51775](https://insights.sbomify.com/CVE-2026-51775/): SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller (critical 9.8)
- [CVE-2026-51773](https://insights.sbomify.com/CVE-2026-51773/): An issue in the VMware datastore driver of OpenStack glance_store. (high 8.1)
- [CVE-2026-51772](https://insights.sbomify.com/CVE-2026-51772/): A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. (medium 6.5)
- [CVE-2026-51770](https://insights.sbomify.com/CVE-2026-51770/): Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forw (critical 9.8)
- [CVE-2026-5177](https://insights.sbomify.com/CVE-2026-5177/): Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injection (medium 5.3)
- [CVE-2026-51769](https://insights.sbomify.com/CVE-2026-51769/): Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to res (critical 9.8)
- [CVE-2026-51768](https://insights.sbomify.com/CVE-2026-51768/): Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify p (high 7.5)
- [CVE-2026-51767](https://insights.sbomify.com/CVE-2026-51767/): Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pai (critical 9.8)
- [CVE-2026-51766](https://insights.sbomify.com/CVE-2026-51766/): Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the lo (high 7.5)
- [CVE-2026-51765](https://insights.sbomify.com/CVE-2026-51765/): Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to inser (critical 9.8)
- [CVE-2026-51764](https://insights.sbomify.com/CVE-2026-51764/): Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to (critical 9.8)
- [CVE-2026-51763](https://insights.sbomify.com/CVE-2026-51763/): Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly dis (critical 9.8)
- [CVE-2026-51762](https://insights.sbomify.com/CVE-2026-51762/): Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean (critical 9.8)
- [CVE-2026-51761](https://insights.sbomify.com/CVE-2026-51761/): Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the LA (medium 5.3)
- [CVE-2026-51760](https://insights.sbomify.com/CVE-2026-51760/): Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigg (critical 9.8)
- [CVE-2026-5176](https://insights.sbomify.com/CVE-2026-5176/): Totolink A3300R cstecgi.cgi setSyslogCfg command injection (medium 6.9)
- [CVE-2026-51757](https://insights.sbomify.com/CVE-2026-51757/): Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a fi (critical 9.8)
- [CVE-2026-51756](https://insights.sbomify.com/CVE-2026-51756/): Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start firmw (medium 5.9)
- [CVE-2026-51754](https://insights.sbomify.com/CVE-2026-51754/): Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrit (critical 9.8)
- [CVE-2026-51752](https://insights.sbomify.com/CVE-2026-51752/): Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger sta (medium 5.3)
- [CVE-2026-51751](https://insights.sbomify.com/CVE-2026-51751/): Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a sp (critical 9.8)
- [CVE-2026-51750](https://insights.sbomify.com/CVE-2026-51750/): Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan an (critical 9.8)
- [CVE-2026-5175](https://insights.sbomify.com/CVE-2026-5175/): Missing authorization in Server (medium 5.0)
- [CVE-2026-51748](https://insights.sbomify.com/CVE-2026-51748/): Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upd (medium 5.9)
- [CVE-2026-51747](https://insights.sbomify.com/CVE-2026-51747/): Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect me (critical 9.8)
- [CVE-2026-51745](https://insights.sbomify.com/CVE-2026-51745/): Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh t (medium 5.3)
- [CVE-2026-51744](https://insights.sbomify.com/CVE-2026-51744/): Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force (critical 9.8)
- [CVE-2026-51743](https://insights.sbomify.com/CVE-2026-51743/): Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable gu (critical 9.1)
- [CVE-2026-51742](https://insights.sbomify.com/CVE-2026-51742/): Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN di (medium 5.9)
- [CVE-2026-51741](https://insights.sbomify.com/CVE-2026-51741/): Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase di (critical 9.8)
- [CVE-2026-51740](https://insights.sbomify.com/CVE-2026-51740/): Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to terminate crit (critical 9.8)
- [CVE-2026-5174](https://insights.sbomify.com/CVE-2026-5174/): Improper Access Control Vulnerability in Progress MOVEit Automation (high 7.7)
- [CVE-2026-51739](https://insights.sbomify.com/CVE-2026-51739/): Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigg (medium 5.9)
- [CVE-2026-51738](https://insights.sbomify.com/CVE-2026-51738/): Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the (critical 9.8)
- [CVE-2026-51737](https://insights.sbomify.com/CVE-2026-51737/): Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase t (medium 5.3)
- [CVE-2026-51736](https://insights.sbomify.com/CVE-2026-51736/): Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system l (critical 9.1)
- [CVE-2026-51735](https://insights.sbomify.com/CVE-2026-51735/): Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve recent (high 7.5)
- [CVE-2026-51734](https://insights.sbomify.com/CVE-2026-51734/): Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger (critical 9.8)
- [CVE-2026-51733](https://insights.sbomify.com/CVE-2026-51733/): Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi- (critical 9.8)
- [CVE-2026-51732](https://insights.sbomify.com/CVE-2026-51732/): Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove (medium 5.3)
- [CVE-2026-51731](https://insights.sbomify.com/CVE-2026-51731/): Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove VLAN ent (critical 9.1)
- [CVE-2026-51730](https://insights.sbomify.com/CVE-2026-51730/): Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi- (critical 9.1)
- [CVE-2026-5173](https://insights.sbomify.com/CVE-2026-5173/): Exposed Dangerous Method or Function in GitLab (high 8.5)
- [CVE-2026-51729](https://insights.sbomify.com/CVE-2026-51729/): Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to request deletion (critical 9.1)
- [CVE-2026-51728](https://insights.sbomify.com/CVE-2026-51728/): Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to upload (critical 9.8)
- [CVE-2026-51727](https://insights.sbomify.com/CVE-2026-51727/): Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to retrieve ad (medium 5.3)
- [CVE-2026-51726](https://insights.sbomify.com/CVE-2026-51726/): Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove pa (critical 9.1)
- [CVE-2026-51725](https://insights.sbomify.com/CVE-2026-51725/): Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the (critical 9.1)
- [CVE-2026-51724](https://insights.sbomify.com/CVE-2026-51724/): Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Smar (critical 9.8)
- [CVE-2026-51723](https://insights.sbomify.com/CVE-2026-51723/): Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install (critical 9.1)
- [CVE-2026-51722](https://insights.sbomify.com/CVE-2026-51722/): Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to repoint (critical 9.1)
- [CVE-2026-51721](https://insights.sbomify.com/CVE-2026-51721/): Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh (critical 9.1)
- [CVE-2026-51720](https://insights.sbomify.com/CVE-2026-51720/): Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remov (critical 9.1)
- [CVE-2026-5172](https://insights.sbomify.com/CVE-2026-5172/): CVE-2026-5172 (high 7.3)
- [CVE-2026-51719](https://insights.sbomify.com/CVE-2026-51719/): Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove U (high 7.5)
- [CVE-2026-51718](https://insights.sbomify.com/CVE-2026-51718/): Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove (critical 9.8)
- [CVE-2026-51717](https://insights.sbomify.com/CVE-2026-51717/): Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the de (critical 9.1)
- [CVE-2026-51716](https://insights.sbomify.com/CVE-2026-51716/): Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to delete (high 7.5)
- [CVE-2026-51715](https://insights.sbomify.com/CVE-2026-51715/): Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove M (critical 9.8)
- [CVE-2026-51714](https://insights.sbomify.com/CVE-2026-51714/): Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter roamin (medium 5.9)
- [CVE-2026-51713](https://insights.sbomify.com/CVE-2026-51713/): Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat (critical 9.1)
- [CVE-2026-51712](https://insights.sbomify.com/CVE-2026-51712/): Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter wire (medium 5.9)
- [CVE-2026-51711](https://insights.sbomify.com/CVE-2026-51711/): Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to open a wir (critical 9.1)
- [CVE-2026-51710](https://insights.sbomify.com/CVE-2026-51710/): Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter par (critical 9.1)
- [CVE-2026-5171](https://insights.sbomify.com/CVE-2026-5171/): Missing authorization in Server (medium 4.3)
- [CVE-2026-51709](https://insights.sbomify.com/CVE-2026-51709/): Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigur (critical 9.8)
- [CVE-2026-51708](https://insights.sbomify.com/CVE-2026-51708/): Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change WPS a (critical 9.8)
- [CVE-2026-51706](https://insights.sbomify.com/CVE-2026-51706/): Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade tra (medium 4.3)
- [CVE-2026-51705](https://insights.sbomify.com/CVE-2026-51705/): Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mes (critical 9.8)
- [CVE-2026-51704](https://insights.sbomify.com/CVE-2026-51704/): Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter me (medium 4.3)
- [CVE-2026-51703](https://insights.sbomify.com/CVE-2026-51703/): Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter w (medium 5.4)
- [CVE-2026-51702](https://insights.sbomify.com/CVE-2026-51702/): Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter (medium 4.3)
- [CVE-2026-51701](https://insights.sbomify.com/CVE-2026-51701/): Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change d (critical 9.1)
- [CVE-2026-51700](https://insights.sbomify.com/CVE-2026-51700/): Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade (critical 9.1)
- [CVE-2026-5170](https://insights.sbomify.com/CVE-2026-5170/): Users could trigger a crash of mongod primaries during promotion to sharded (medium 6.0)
- [CVE-2026-51699](https://insights.sbomify.com/CVE-2026-51699/): Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an intern (critical 9.8)
- [CVE-2026-51698](https://insights.sbomify.com/CVE-2026-51698/): Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter br (critical 9.1)
- [CVE-2026-51697](https://insights.sbomify.com/CVE-2026-51697/): Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV serv (critical 9.1)
- [CVE-2026-51696](https://insights.sbomify.com/CVE-2026-51696/): Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose (critical 9.8)
- [CVE-2026-51695](https://insights.sbomify.com/CVE-2026-51695/): Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic D (high 7.5)
- [CVE-2026-51694](https://insights.sbomify.com/CVE-2026-51694/): Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or (high 7.5)
- [CVE-2026-51693](https://insights.sbomify.com/CVE-2026-51693/): Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge (critical 9.8)
- [CVE-2026-51692](https://insights.sbomify.com/CVE-2026-51692/): Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish (critical 9.1)
- [CVE-2026-51691](https://insights.sbomify.com/CVE-2026-51691/): Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulat (critical 9.8)
- [CVE-2026-51690](https://insights.sbomify.com/CVE-2026-51690/): Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream p (critical 9.1)
- [CVE-2026-5169](https://insights.sbomify.com/CVE-2026-5169/): Cross-site scripting in Inquiry form to posts or pages (medium 4.4)
- [CVE-2026-51689](https://insights.sbomify.com/CVE-2026-51689/): Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmw (critical 9.1)
- [CVE-2026-51688](https://insights.sbomify.com/CVE-2026-51688/): Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wi (high 7.5)
- [CVE-2026-51687](https://insights.sbomify.com/CVE-2026-51687/): Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create (critical 9.1)
- [CVE-2026-51686](https://insights.sbomify.com/CVE-2026-51686/): Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/571/