CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18615 — A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected el...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was co

Analysis

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSS Score: 9.8. Published: 2026-08-03T19:16:45.383.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18615
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New Tool Traces AI Videos Back to Their Source

Researchers dug into the root of the problem with the goal of promoting industry collaboration on improved protective measures.

Dark Reading
HIGHVulnerability

NVD HIGH: CVE-2026-67599 — ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer com...

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webcon

CVE-2026-67599
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-67598 — Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerab...

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSe

CVE-2026-67598
NIST NVD