PT-2026-67846

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.8.8 through 0.10.2 Description An issue exists where inline direct model metadata accepts client-supplied knowledge attachments without verifying the caller's read access. This occurs when a client defines a model inline...

vigolium v0.3.6

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

resterm v0.50.0

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

CVE-2026-18616

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

EUVD-2026-52401

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

CVE-2026-18614

CVE-2026-18614 affects GL-iNet GL-MT3000 devices (firmware up to 4.4.5). The vulnerability lies in the s2s.so Native Plugin, specifically the function s2s.enable_echo_server in the file /cgi-bin/glc . An attacker can manipulate the port argument to trigger a command injection . The attack can be ...

CVE-2026-18614 GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enableechoserver of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit...

CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613

GL-iNet GL-MT3000 (firmware up to 4.4.5) is affected by a vulnerability in the plugins.so Native Plugin: the function plugins.set_config in /cgi-bin/glc can be manipulated to cause injection. The attack is remote and publicly disclosed; vendor awareness confirmed. No remediation details are provi...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18612

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

CVE-2026-18612 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

EUVD-2026-52335

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.getrecommendconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be...

CVE-2026-18601 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

CVE-2026-18601 GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.checkconfig of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack ...

PT-2026-67452

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove package/plugins.install package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

CVE-2026-18648: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

CVE-2026-18614: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enableechoserver of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit...

resterm v0.49.4

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...