Atomicorp WAF Research Notes
Research Update - 2026-10-11
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-93674 | Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution | 300008 , 344370 , 380122 |
| CVE-2019-25471 | FileThingie 2.5.7 Arbitrary File Upload via ft2.php | 351000 |
| CVE-2026-108598 | Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-84259 | click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-108540 | OpenSpug File Transfer transfer os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-108161 | FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-91136 | Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-108593 | 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-108554 | PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-108585 | argocd-mcp through 0.9.0 Path Traversal via delete_application Tool | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-108523 | Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-108541 | highwarden Super Store Finder index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-108542 | 021is elvix-sdk MCP Request index.ts server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-8511 | Portabilis i-Diario Observações diario-de-observacoes cross site scripting | 333140 , 333141 , 342259 |
| CVE-2025-8786 | Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-8787 | Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108521 | Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |