Atomicorp WAF Research Notes
Research Update - 2026-10-22
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-113708 | Argo CD: A Kustomize remote ref can run commands in the repo-server | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2023-30145 | Camaleon CMS v2.7.0 - Server-Side Template Injection (SSTI) | 344360 , 344370 |
| CVE-2023-48974 | Axigen < 10.5.7 - Persistent Cross-Site Scripting | 340147 , 340148 , 341256 , 342259 , 346755 , 350148 , 390585 |
| CVE-2026-113802 | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2016-20101 | Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-114053 | vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-114493 | LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2018-7702 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2026-10131 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10135 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-105772 | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId an | 347009 |
| CVE-2026-33568 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35499 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-40627 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9814 | Totolink Arbitrary Code Execution Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-9827 | Totolink Arbitrary Code Execution Vulnerability | 344360 , 390709 |
| CVE-2015-20128 | FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2023-43661 | Cachet vulnerable to Authenticated Remote Code Execution | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-113779 | pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2014-125133 | NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2014-125134 | ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-20124 | Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2015-20125 | Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2016-20103 | Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2016-20104 | EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-113390 | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-113506 | aaPanel File Manager common.py ExecShell os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-29001 | TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization | 340014 , 344362 , 344363 , 344370 , 344380 , 344382 , 344385 |
| CVE-2026-114081 | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name | 341250 |
| CVE-2026-114084 | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2018-7705 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2024-0399 | WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection | 330791 , 340152 |
| CVE-2026-113728 | Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2022-26986 | ImpressCMS v1.4.3 - Authenticated SQL Injection | 341245 , 380026 , 380122 |
| CVE-2026-114730 | Webmail Server-Side Request Forgery Vulnerability | 330708 , 390712 , 390722 |
| CVE-2026-6495 | WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting | 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 347198 , 350147 , 350148 |
| CVE-2026-114399 | Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-114492 | gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-7701 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2018-7704 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2018-7706 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2026-17557 | Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-112947 | Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance | 340007 , 344360 , 347009 , 390709 |
| CVE-2018-7703 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2018-7707 | SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities | 330791 , 340152 |
| CVE-2019-12905 | FileRun 2019.05.21 - Reflected Cross-Site Scripting | 330791 , 340152 |
| CVE-2026-113659 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-111761 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114242 | dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114243 | dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114255 | oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-114258 | oretnom23 file-management-system-php File Management files.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114259 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload | 351000 |
| CVE-2026-114263 | ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114441 | oretnom23 php-travel-agency-system update.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114577 | oretnom23 php-travel-agency-system Insertion insert.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-1262 | Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting | 390700 |
| CVE-2020-23518 | Neo Billing 3.5 - Persistent Cross-Site Scripting | 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2021-3298 | Collabtive 3.1 - 'address' Persistent Cross-Site Scripting | 330791 , 340152 |
| CVE-2026-113664 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-114076 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114080 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114362 | HarnessRouter Targets Test Endpoint app.py server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114634 | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2012-20003 | Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2014-125131 | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2014-125132 | Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-113683 | VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-114407 | e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-113712 | Cachet has Stored XSS in Incident Component | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-112949 | Vitest: Code injection via unauthenticated manual mock registration | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-114718 | Webmail Cross-Site Scripting Vulnerability | 330708 , 390712 , 390722 |
| CVE-2026-113671 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated S | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-113657 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-113651 | ApostropheCMS: Path traversal in uploadfs | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-114127 | Astro: Arbitrary CSS injection in Astro View Transitions | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-113384 | Optimal IdM OptimalCloud social redirect | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-113505 | aaPanel Download Endpoint v2.py send_file path traversal | 344360 , 347009 , 390709 |
| CVE-2026-113738 | R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal | 340007 , 344360 , 390709 |
| CVE-2026-113740 | itsourcecode Online Cake Ordering System deletecustomer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-113741 | itsourcecode Online Cake Ordering System 404.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-114039 | projectworlds Advanced Library Management System report_search.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114250 | itsourcecode Sales-and-Inventory-System cust_edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114251 | itsourcecode Sales-and-Inventory-System cust_del.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114265 | ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114266 | ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114374 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114375 | leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal | 340007 , 344360 , 390709 |
| CVE-2026-114376 | leomoon-studios wiki-go API editor.go SourceHandler path traversal | 340007 , 344360 , 347009 , 347019 , 390709 |
| CVE-2026-114378 | itsourcecode Online Cake Ordering System deleteproduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114380 | itsourcecode Online Cake Ordering System inserttrans.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114381 | itsourcecode Online Cake Ordering System orderdetail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114384 | itsourcecode Online Cake Ordering System transactionsave.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10074 | Portabilis i-Educar tipos cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-114264 | ProjectWorlds Advanced Library Management System edit_member.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-114377 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal | 340007 , 344360 , 344365 , 347009 , 390709 |
| CVE-2025-10099 | Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting | 333140 , 333141 , 340087 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-113388 | opensource-socialnetwork Cache Settings dynamic.php input code injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2026-86147 | Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof | 340007 , 344360 , 347009 , 390709 |