CVE-2026-76591

HighCVSS 7.4/10Last modified Aug 21, 2026

Description

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Aug 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-765968.7Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpointCVE-2026-765978.7Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list emailCVE-2026-765988.7Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolderCVE-2026-765998.7Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 - The ajax_tables methodCVE-2026-76606.1The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, aCVE-2026-766006.9Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 - The DeleteComment endpoint did not perform anyCVE-2026-766016.9Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks.CVE-2026-766029.3Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used iCVE-2026-766036.9Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 - The inineedit form controller does CVE-2026-7660410.0Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulCVE-2026-7660510.0Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.CVE-2026-7660610.0Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2.
CVE-2026-76591: High severity, CVSS 7.4 | Vulnix