CVE-2026-11406 GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection

A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

PT-2026-45215

Name of the Vulnerable Software and Affected Versions Assimp versions prior to 6.0.5 Description A null pointer dereference occurs in the glTFImporter component within the Assimp::glTFImporter::ImportMeshes function of the glTFImporter.cpp file. This issue allows for local execution attacks...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: json-server, py3-jupyterlab, saf, tileserver-gl, code-server, kubeflow-pipelines, kubeflow-centraldashboard, langfuse, sqlpad, kubeflow-katib, thingsboard, opensearch-dashboards, renovate, prism, argo-workflows...

CVE-2026-8723 vulnerabilities

Vulnerabilities for packages: json-server, py3-jupyterlab, saf, tileserver-gl, code-server, kubeflow-pipelines, kubeflow-centraldashboard, langfuse, sqlpad, kubeflow-katib, thingsboard, opensearch-dashboards, renovate, prism, argo-workflows...

CVE-2026-8723 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, gitlab-rails-ce-fips, py3-jupyterlab, wazuh-dashboard, kibana, json-server, langfuse-fips, thingsboard-fips, renovate, tileserver-gl-fips, thingsboard, arangodb, redisinsight, unleash, code-server, tensorflow-gpu-jupyter, py3-captum, pelias-api, sqlpa...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, gitlab-rails-ce-fips, py3-jupyterlab, wazuh-dashboard, kibana, json-server, langfuse-fips, thingsboard-fips, renovate, tileserver-gl-fips, thingsboard, arangodb, redisinsight, unleash, code-server, tensorflow-gpu-jupyter, py3-captum, pelias-api, sqlpa...

MAL-2026-4019 Malicious code in @antv/gl-matrix (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/gl-matrix (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

EUVD-2023-50669

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

CVE-2023-46453

Certain GL.iNet devices with 4.x firmware allow authentication bypass resulting in administrative control of the device via a username that is both a valid SQL statement and a valid regular expression. For example, this affects version 4.3.7 on GL-MT3000 GL-AR300M GL-B1300 GL-AX1800 GL-AR750S...

GHSA-J452-XHG8-QG39 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, wazuh-dashboard-fips, opensearch-dashboards, tileserver-gl-fips, wazuh-dashboard, tileserver-gl...

CVE-2026-5758 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, wazuh-dashboard-fips, opensearch-dashboards, tileserver-gl-fips, wazuh-dashboard, tileserver-gl...

GHSA-J452-XHG8-QG39 vulnerabilities

Vulnerabilities for packages: tileserver-gl, opensearch-dashboards...

CVE-2026-5758 vulnerabilities

Vulnerabilities for packages: tileserver-gl, opensearch-dashboards...

CVE-2026-22166 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the...

JLSEC-2026-365

A potential memory leak issue was discovered in SDL2 in GLESCreateTexture function in SDLrendergles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected...