CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-18616 — A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted el...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about thi

Analysis

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. CVSS Score: 9.8. Published: 2026-08-03T19:16:45.557.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18616
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New Tool Traces AI Videos Back to Their Source

Researchers dug into the root of the problem with the goal of promoting industry collaboration on improved protective measures.

Dark Reading
HIGHVulnerability

NVD HIGH: CVE-2026-67599 — ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer com...

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webcon

CVE-2026-67599
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-67598 — Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerab...

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSe

CVE-2026-67598
NIST NVD