Atomicorp WAF Research Notes
Research Update - 2026-07-18
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
- CVE-2026-22557 - UniFi Network Application - Path Traversal - rules observed: 340007
- CVE-2026-29059 - Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal - rules observed: 347009
- CVE-2021-3239 - E-Learning System 1.0 - SQL Injection - rules observed: 340016
- CVE-2026-6433 - FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution - rules observed: 340016
- CVE-2023-7327 - Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read - rules observed: 390716
- CVE-2019-25246 - BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure - rules observed: 347009
- CVE-2021-4463 - Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download - rules observed: 347009
- CVE-2024-9362 - Polyaxon - Unauthenticated Directory Traversal - rules observed: 347009
- CVE-2025-13339 - Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read - rules observed: 344360, 347009
- CVE-2026-30958 - OneUptime < 10.0.21 - Path Traversal - rules observed: 347009
- CVE-2025-61224 - DokuWiki <= 2025-05-14a Librarian - Reflected Cross-Site Scripting - rules observed: 333141
- CVE-2026-50229 - Apache Tomcat - Cross-Site Scripting - rules observed: 341266
- CVE-2026-52774 - YesWiki Bazar Widget - Reflected XSS via ‘id’ Parameter - rules observed: 333141
- CVE-2024-12008 - W3 Total Cache < 2.8.2 - Log File Exposure - rules observed: 390716
- CVE-2026-11111 - Research note for exploit techniques associated with CVE-2026-11111 - rules observed: 340016, 340162
- CVE-2026-48907 - Research note for exploit techniques associated with CVE-2026-48907 - rules observed: 383871, 333360