Atomicorp WAF Research Notes
Research Update - 2026-10-24
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2023-30191 | cdesigner SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-115806 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Repla | 340014 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 |
| CVE-2026-35047 | Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-55486 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-115729 | @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114621 | baserCMS: SQL injection in the admin panel and admin API | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-35050 | text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention setti | 340007 , 344360 , 390709 |
| CVE-2026-55888 | XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal | 340007 , 344360 , 390709 |
| CVE-2026-56840 | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous to | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2022-4984 | ZenTao Biz < 6.5, Max < 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.html | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-112904 | Vvveb: Path Traversal in nextRestore() and nextBackup() | 344360 , 347009 |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 390719 |
| CVE-2026-40521 | FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-50053 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-115481 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbi | 351000 |
| CVE-2026-57114 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-115457 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-114623 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure | 344360 , 347009 |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI e | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-115750 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects | 344365 |
| CVE-2026-115810 | Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2023-23548 | XSS in business intelligence | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-16535 | WordPress Link Library < 7.9.4 - Cross-Site Scripting | 346755 |
| CVE-2026-46531 | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2 | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5665 | code-projects Online FIR System Login checklogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-115877 | Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value | 340006 , 390719 |
| CVE-2026-115730 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-115752 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-5670 | Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload | 351000 |
| CVE-2026-52356 | D-Link DAP1160L A1_FW101WWb04 Command Injection Vulnerability | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |