Atomicorp WAF Research Notes
Research Update - 2026-10-15
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-108390 | HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking | 340007 , 344360 , 347009 , 390709 |
| CVE-2024-4885 | Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution | 399889 , 399892 |
| CVE-2025-63742 | rockoa SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-67489 | @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serve | 340014 , 344361 , 344363 , 344364 , 344366 , 344370 , 390719 |
| CVE-2025-67506 | PipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File Upload | 340007 , 344360 , 390709 |
| CVE-2026-104252 | Vitess vttablet /twopcz reflected XSS | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108065 | Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-110002 | Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter | 351000 |
| CVE-2026-110392 | Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-37107 | HTMLy v.3.1.1 Improper Privilege Management Vulnerability | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55573 | e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-55680 | WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-55683 | WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-55684 | WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php | 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2025-67501 | WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-102989 | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses | 340099 , 341099 |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-110536 | D-Link DIR-868L HNAP CGI cgibin system os command injection | 381237 , 390719 |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-65473 | easyimages2.0 Arbitrary Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-55562 | Cronicle: Stored XSS in admin Activity Log via account full_name field | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-65471 | easyimages2.0 Arbitrary Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-66438 | erpnext Information Disclosure Vulnerability | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-66439 | erpnext SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2025-66440 | erpnext SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 |
| CVE-2025-66918 | edoc-doctor-appointment-system Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-68705 | RustFS Path Traversal Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-105106 | Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-110116 | Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile | 340007 , 344360 , 390709 |
| CVE-2026-110908 | pfSense-pkg-frr Command Injection Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-55681 | WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-78309 | SQL Injection in DIAEnergie | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12716 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104141 | DataEase: SQL Injection in datasource metadata identifiers | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-104142 | DataEase: Stored SQL Injection in group-field binning bounds | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109960 | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-110115 | Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-103904 | Stored XSS Vulnerability in JTL-Shop | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-102982 | Plane: XSS in work item comments | 333140 |
| CVE-2026-110255 | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-55786 | Flyto2 Core: Unauthenticated Command Execution via HTTP MCP execute_module | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86016 | VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-68147 | opensourcepos has a Cross-site Scripting vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-104995 | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'aja | 340006 , 344360 , 390709 |
| CVE-2025-12029 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 380018 |
| CVE-2024-13160 | Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard | 390143 |
| CVE-2025-63950 | twittodon Unsafe Deserialization Vulnerability | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2025-63951 | phoniebox Unsafe Deserialization Vulnerability | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2025-66645 | NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading | 344360 , 347009 , 390709 |
| CVE-2026-12741 | WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection | 340016 , 380122 |
| CVE-2026-96661 | Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-45869 | LogicalDOC Enterprise Version up to and before v9.1.1 Server-Side Request Forgery Vulnerability | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-67285 | covid tracking system using qr-code SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-66921 | open source point of sale Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-66923 | open source point of sale Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-105107 | Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-93885 | Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter | 346755 |
| CVE-2026-55787 | Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92153 | F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath | 340007 , 344360 , 390709 |
| CVE-2026-74031 | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-110222 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110719 | Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header | 390719 |
| CVE-2026-93347 | Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file | 344360 , 390709 |
| CVE-2026-102354 | BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2024-34319 | Server-Side Request Forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-66947 | student management system SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-68477 | Langflow vulnerable to Server-Side Request Forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-101926 | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Paramete | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-104107 | FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs | 340007 , 344360 , 390709 |
| CVE-2026-55679 | WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-63949 | hotel management system Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-65233 | slims Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-66924 | open source point of sale Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-67495 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2025-67502 | Taguette does not safeguard against Open Redirect | 344365 |
| CVE-2025-67648 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49264 | OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14189 | Chanjet CRM jxf_dump_table_demo.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14207 | tushar-2223 Hotel-Management-System invoiceprint.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14334 | itsourcecode Student Management System new_adviser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14335 | itsourcecode Student Management System new_school_year.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14336 | itsourcecode Student Management System promote.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14337 | itsourcecode Student Management System new_grade.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15002 | SeaCMS mysqli.class.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109115 | AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109522 | girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109523 | girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109606 | SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-109607 | SourceCodester Online Exam System Login Endpoint loginExe.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-109620 | SourceCodester Online Reviewer System index.php prepare sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-63947 | phpmsadmin Cross-Site Scripting Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-63948 | phpmsadmin SQL Injection Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67496 | WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34400 | MailEnable < 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspx | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-34408 | MailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspx | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-110212 | ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter | 340007 , 344360 , 390709 |
| CVE-2026-110254 | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110766 | Colanode Server through 0.4.7 Path Traversal via Avatar Download Route | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-25946 | Gitea OpenID discovery server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82402 | Gogs: Open Redirect in /redirect endpoint via backslash bypass in IsSameSite | 344365 |
| CVE-2025-10354 | Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-41011 | HTML injection in PHP Point Of Sale | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-102755 | DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-102756 | DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-110101 | Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-110225 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110625 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-110626 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-96535 | Cross-Site Scripting in the YouMind web application | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67819 | weaviate Path Traversal Vulnerability | 344360 , 347009 , 390709 |
| CVE-2026-107757 | Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name | 333140 , 333141 , 336469 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-76083 | Redash: JSON data source query URL can bypass base URL restriction | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-67342 | ruoyi Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67344 | jsherp Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-67737 | AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-110223 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-14203 | code-projects Question Paper Generator selectquestionuser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-14204 | TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command inje | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-14518 | PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-109160 | PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect | 344365 |
| CVE-2026-109402 | conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110627 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-14837 | ZZCMS Backend Website Settings siteconfig.php stripfxg code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2025-14966 | FastAdmin Backend Controller Backend.php selectpage sql injection | 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15187 | GreenCMS File DataController.class.php path traversal | 340007 , 344360 , 390709 |
| CVE-2025-15438 | PluXml Media Management medias.php __destruct deserialization | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2025-15442 | CRMEB product_list sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-15443 | CRMEB product_export sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |