Server-side request forgery in Wallos (versions 2.0.0 through 4.x) lets any authenticated user force the application server to open arbitrary outbound TCP connections to attacker-chosen hosts, including internal and link-local addresses. The per-user SMTP notification settings endpoint stores a user-supplied host without validation, and the notification cron job passes it directly to PHPMailer - no admin rights are required to abuse this path. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patched this in version 5.0.0.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Unauthenticated firewall policy manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setIpPortFilterRules function to any attacker on the adjacent network segment. A crafted POST request to /cgi-bin/cstecgi.cgi bypasses all access control (CWE-284) and allows modification of the device's IP/port filtering rules without credentials. No active exploitation is confirmed in CISA KEV, and EPSS at 0.18% (7th percentile) reflects limited opportunistic risk, consistent with the adjacent-only attack vector.
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits unauthenticated adjacent-network attackers to overwrite QoS traffic-shaping configuration via a crafted POST to /cgi-bin/cstecgi.cgi, intentionally degrading traffic handling for legitimate network users. The attack requires no credentials and no user interaction, but is bounded to Layer 2 adjacency (LAN or Wi-Fi segment), preventing internet-based exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) reflects low observed exploitation activity.
Unauthenticated mesh configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with adjacent network access to overwrite WiFi mesh settings by sending a crafted POST request directly to the /cgi-bin/cstecgi.cgi handler without supplying credentials. The setWiFiMeshConfig function applies no access control check before processing the request, a CWE-284 (Improper Access Control) condition consistent with a pattern of missing authentication enforcement observed across multiple CGI handlers in this firmware. No public exploit is confirmed and EPSS sits at 0.18% (7th percentile), marking this as low exploitation probability, though the adjacent-network-only constraint is the primary practical barrier rather than any authentication requirement.
Unauthenticated LAN configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the adjacent network to modify the router's LAN settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setLanCfg handler, which lacks access control enforcement. The attack requires only adjacent network positioning - no credentials, no user interaction - and can alter LAN network parameters such as IP addressing, subnet masks, or gateway settings. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.18%, reflecting low observed interest.
Unauthenticated syslog configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to alter logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The setSyslogCfg function performs no access control checks before applying submitted configuration changes (CWE-284), enabling log suppression or redirection that could obscure evidence of concurrent or subsequent malicious activity. No public exploit code has been identified and the EPSS score of 0.16% reflects minimal current exploitation interest; this vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the internal Wi-Fi client MAC-to-IP mapping table to any attacker with adjacent network access. The getWiFiIpMacTable function in the router's CGI handler fails to enforce authentication, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return a full enumeration of connected wireless clients. No public exploit has been identified at time of analysis; EPSS at 0.16% (6th percentile) reflects minimal observed exploitation interest.
Incorrect access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes the setWizardCfg CGI endpoint to unauthenticated reconfiguration by any attacker with adjacent network access. An actor on the same local network segment can issue a crafted POST request to /cgi-bin/cstecgi.cgi to silently overwrite WAN settings, Wi-Fi parameters, or device initialization state without supplying any credentials. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low observed exploitation interest.
CVE-2026-65928 has no available description, CVSS score, CWE classification, or affected version data at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu. No meaningful impact, attack vector, or affected population can be determined from the provided data. Security teams should monitor for NVD publication and Ubuntu Security Notices (USN) before making prioritization decisions.
CVE-2026-61406 is reported by Ubuntu with no public description, CVSS score, CWE classification, or affected version data available at time of analysis. The nature, impact, and exploitability of this vulnerability cannot be characterized from the provided intelligence. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE tracker for forthcoming disclosure.
CVE-2026-81493 is a Ubuntu-reported security update with no substantive public data available at time of analysis. The CVE record contains only the placeholder description 'security update' and carries no CVSS score, no CWE classification, no CPE strings, and no referenced advisories, making it impossible to characterize the vulnerability type, affected component, or attacker capability. No exploitation status, patch version, or technical detail can be derived from the available intelligence.
CVE-2026-61402 is reported by the Ubuntu vendor channel but carries no description, CVSS score, CWE classification, or reference URLs at this time. The affected package, vulnerability class, and impact are entirely unconfirmed from the available data. No meaningful characterization of attacker capability or affected user population is possible without additional intelligence.
Insufficient data exists to characterize CVE-2026-63323 meaningfully. The CVE record contains no description, no CVSS score, no CWE, and no references beyond a single vendor:ubuntu tag. The affected product, vulnerability class, and impact are all unknown at this time. Security teams should treat this as an unresolved record and monitor NVD and Ubuntu Security Notices (USN) for updates.
CVE-2026-61404 was reported by Ubuntu but carries no published description, CVSS score, vector, or CWE classification at the time of this analysis. The affected component, vulnerability class, and attacker capabilities cannot be determined from available data. No meaningful impact assessment is possible until Ubuntu publishes a security advisory.
Insufficient data prevents meaningful synthesis for CVE-2026-17516. The only available signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE, affected versions, or references provided. No impact, attack vector, or affected component can be determined from the supplied input.
CVE-2026-65929 is reported by Ubuntu with no description, CVSS data, CWE classification, or affected package information available at this time. The vulnerability cannot be characterized beyond its association with the Ubuntu vendor source. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE as data becomes available.
CVE-2026-63322 has been reported by Ubuntu's security team, but no description, CVSS score, CWE classification, or exploit intelligence is publicly available at time of analysis. The vulnerability's impact, affected component, and exploitability cannot be determined from current data. Security teams should monitor the Ubuntu Security Notices portal and USN advisories for disclosure.
CVE-2026-63320 has no publicly available description, CVSS score, or CWE classification at time of analysis. The sole intelligence signal is a vendor report attributed to Ubuntu. Without a description, affected version range, or impact details, no meaningful impact statement can be made - this record should be treated as pending NVD enrichment.
CVE-2026-63321 has been reported via Ubuntu's vendor channel, but no description, CVSS score, CWE classification, or technical detail is available in the provided intelligence data. The affected component, vulnerability class, and impact cannot be characterized with the current dataset. Security teams should query Ubuntu's security tracker directly for authoritative details before making prioritization decisions.
CVE-2026-63110 is reported by Ubuntu but carries no description, CVSS score, vector, or CWE in the available intelligence data, making meaningful impact assessment impossible at this time. The sole attribution signal is 'vendor:ubuntu', indicating Ubuntu has acknowledged or reported this identifier, but the affected component, vulnerability class, and exploitability are entirely unknown. Security teams should monitor Ubuntu Security Notices (USN) and the NVD entry for this CVE until authoritative details are published.
Insufficient data prevents meaningful synthesis of CVE-2026-63109. The only confirmed intelligence signal is a vendor report attributed to Ubuntu, with no description, CVSS score, CWE classification, or version information available at time of analysis. No impact, affected component, or attack scenario can be characterized from the provided data.
CVE-2026-61476 is reported by Ubuntu with no description, CVSS score, vector, or CWE available at time of analysis. Affected component, vulnerability class, and impact cannot be determined from the provided data. No meaningful synthesis is possible until Ubuntu publishes a security advisory.
Project restriction bypass in a network address set management component allows an authenticated user within one project to access or manipulate network address sets belonging to another project, violating multi-tenant isolation boundaries. The vulnerability is reported by Ubuntu vendor under GHSA-6v6x-387m-rj4w. No CVSS score, CWE classification, or confirmed patch version is available in the provided intelligence; the following analysis is substantially inferred from the advisory title and source.
CVE-2026-61405 has been reported via Ubuntu's vendor security channel, but no description, CVSS score, CWE classification, or supporting intelligence is available at time of analysis. The affected package, vulnerability class, and impact cannot be determined from the provided data. Security teams should consult Ubuntu Security Notices (USN) directly for authoritative details before making triage decisions.
CVE-2026-59944 was reported by Ubuntu as the originating vendor source, but no description, CVSS score, CWE, or reference data was supplied for this analysis. The vulnerability type, affected component, and impact cannot be characterized from available intelligence. Security teams should consult the Ubuntu Security Notices portal directly for authoritative details before making any triage or remediation decisions.
CVE-2026-58582 is an Ubuntu-reported vulnerability for which no description, CVSS score, CWE classification, or technical detail has been made publicly available at time of analysis. The sole intelligence signal is a vendor attribution to Ubuntu, meaning the affected component is likely within the Ubuntu distribution or an upstream package it ships. Without further disclosure, the impact, exploitability, and scope cannot be characterized.
CVE-2026-58581 has been reported through Ubuntu's vendor channel, but no description, CVSS score, vector, or CWE data is available at time of analysis. The affected product, vulnerability class, and impact cannot be characterized without a description. No exploitation status, patch information, or affected version range can be determined from the supplied intelligence.
CVE-2026-50624 has no publicly available description, CVSS score, CWE classification, or reference data at time of analysis. The only available metadata is a reporter tag of 'vendor:ubuntu', indicating Ubuntu as the reporting source. No meaningful impact, affected component, or attack vector can be determined from the supplied data.
CVE-2026-18054 is associated with the Ubuntu platform per vendor reporting, but no description, CVSS score, CWE classification, or technical details are available in the provided data. Without a vulnerability description, the affected component, impact, and exploitation conditions cannot be determined. A meaningful security assessment is not possible from the supplied intelligence.
CVE-2026-15264 is reported by the Ubuntu vendor source but carries no description, CVSS score, CWE classification, or reference links at time of analysis. No meaningful synthesis of impact, affected component, or attacker capability is possible from the available data. Security teams should treat this as an uncharacterized disclosure pending vendor publication of a full advisory.
CVE-2026-16288 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The vulnerability's nature, affected component, and impact are entirely unconfirmed. No meaningful synthesis is possible without a description or scoring data; treat this record as a placeholder pending vendor disclosure.
Ubuntu has published a security advisory for CVE-2026-81498, but the provided intelligence contains no substantive technical content - the description is only 'security update' with no affected package, version, or vulnerability class identified. No CVSS score, CWE, CPE strings, EPSS data, or advisory URL were supplied. This entry cannot be meaningfully characterized without further enrichment from Ubuntu Security Notices or NVD.
Arbitrary host filesystem write is achievable via two distinct attack paths in an OCI image-handling component: symlinks planted inside OCI image layers that resolve outside the container root during image extraction, and newline characters injected into oci.dns.* annotation values that corrupt host-side configuration files written from those annotations. Both paths allow an attacker who controls an OCI image to write attacker-controlled data to arbitrary paths on the host system, breaking container isolation. No public exploit has been identified at time of analysis, and no CVSS data is available from the source record.
CVE-2026-81496 is documented only as a 'security update' by the Ubuntu vendor source, with no description, CVSS score, CWE classification, or reference links provided in the available intelligence. The affected component, impact class, and exploitation conditions cannot be determined from the current data. No meaningful characterization of attacker capability or victim exposure is possible without additional vendor disclosure.
CVE-2026-81497 is an Ubuntu-reported security update with no substantive technical detail available in the current data set. The description contains only the phrase 'security update,' which provides no insight into the affected component, vulnerability class, or impact. No CVSS score, CWE, CPE strings, EPSS data, KEV status, or references were supplied, making meaningful risk characterization impossible at this time.
Insufficient data exists to characterize CVE-2026-81495 beyond its origin as a Ubuntu vendor security update. The description field contains only the text 'security update' with no detail on the affected component, vulnerability class, or attacker capability. No CVSS vector, CWE, CPE, EPSS, KEV status, references, or patch version are available in the provided intelligence. No meaningful synthesis is possible without additional sourcing.
CVE-2026-66022 is reported by Ubuntu but carries no public description, CVSS score, vector, or CWE at time of analysis. The affected product, vulnerability class, and impact are entirely unknown from the available data. No meaningful characterization of attacker capability or affected scope is possible without a vendor advisory or NVD entry.