CVE-2026-110958

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflow

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

EUVD-2026-102150

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

CVE-2026-110958

A heap-based buffer overflow vulnerability exists in the api.cgi file of the Wavlink WN530HG4B (firmware M30HG4B_V260724). The root cause is tied to the api=info&client=app handler, which previously built shell commands insecurely using system(). Attackers can achieve remote execution by exploiti...

PT-2026-114986

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4B M30HG4B V260724 Description A heap-based buffer overflow exists in the api.cgi file. This issue allows a remote attacker to trigger the overflow via an unknown function. The vendor noted that the api=info&client=app handler...

Exploit for CVE-2026-104051

CVE-2026-104051 — Sensitive Information Disclosure via info...

EUVD-2026-91065

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051

PictShare versions prior to 3.7.1 are vulnerable to an information disclosure vulnerability via the API::info() endpoint. The root cause is the lack of a field whitelist, allowing unauthenticated attackers to retrieve complete raw metadata objects. By using a publicly visible file hash, an attack...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051 PictShare < 3.7.1 Sensitive Information Disclosure via info API

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-104051: Insufficiently Protected Credentials

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

EUVD-2026-44933

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...

CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses

Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...

CVE-2026-32100

Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

CVE-2026-32100

Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

CVE-2026-30933 FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and...

FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info

Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2. Details The issue stems from two flaws: 1. Tokenized download URLs are written into the...