Atomicorp WAF Research Notes
Research Update - 2026-10-26
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-10134 | Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-57572 | Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34038 | Coolify authenticated remote command injection leading to RCE and secret exfiltration | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-50551 | SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54067 | SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-48114 | Metacat has an unauthenticated SQL injection vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-52186 | UTT nv518G nv518GV3v3.2.7-210919-161313 Arbitrary Code Execution Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13751 | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53662 | immich: One-click account takeover via XSS in login page continue redirect | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341256 , 341266 , 342259 |
| CVE-2026-55413 | ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34106 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34108 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34109 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34110 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34111 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34112 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34115 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-48777 | FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory | 340007 , 344360 , 390709 |
| CVE-2026-54527 | JupyterLab Git: Stored XSS leading to RCE | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-58457 | Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-56266 | Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59707 | LocalAI - Server-Side Request Forgery via POST /models/apply | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59800 | 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-12486 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-12849 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-12850 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-12851 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-37637 | Alexantr filemanager v.1.0 Arbitrary Code Execution Vulnerability | 340014 , 340023 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42555 | Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-44542 | FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-13603 | SSRF with API key leak in pretix-oppwa | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42238 | Unauthenticated Remote Code Execution via Backup Restore in nginx-ui | 301007 , 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-55570 | SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped data-obj attribute (Bypass for CVE-2026 | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-50189 | Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route | 390719 |
| CVE-2026-6154 | Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-6155 | Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7121 | Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-7244 | Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-10054 | Eclipse Theia Security Vulnerability | 390719 |
| CVE-2026-116176 | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector | 390719 |
| CVE-2026-116207 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116211 | YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-28805 | OpenSTAManager: Time-Based Blind SQL Injection via options[stato] Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-34057 | Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34153 | Coolify LocalFileVolume fs_path command injection enables RCE | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34158 | Coolify: Command injection via single-quote breakout in Docker Compose custom commands | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34594 | Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34599 | Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-39319 | ChurchCRM has a Second Order SQLI via FundRaiserEditor.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-42200 | Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE | 344360 , 390709 |
| CVE-2026-45418 | ClipBucket: Blind SQL Injection in subtitle_edit.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-54149 | MaxKB MCP tool import validation bypass allows post-authentication remote code execution | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-57296 | Jenkins External Workspace Manager Plugin Arbitrary Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-58166 | OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete | 344360 , 390709 |
| CVE-2026-59734 | Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-9783 | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116171 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-13323 | open vsx Security Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-28737 | Gitea 3D file viewer allows stored XSS through glTF extensionsRequired | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-49119 | Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() | 340007 , 344360 , 390709 |
| CVE-2026-58000 | luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-58452 | JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14471 | Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 , 390716 |
| CVE-2026-23698 | Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390501 , 390904 , 393655 |
| CVE-2026-49954 | Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory | 344360 |
| CVE-2026-56382 | Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-57573 | Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10055 | Eclipse Theia Security Vulnerability | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-12195 | vesta Arbitrary Code Execution Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55665 | DOM-based XSS in Grist via unsanitized links, enabling privilege escalation | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56663 | AutoGPT: SSRF-to-RCE Chain in SendWebRequestBlock via IP validation bypass and internal pg-meta access | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-61429 | PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via –rc-serve scheme-relative remote roots | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48788 | Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-53571 | Vite: server.fs.deny bypass on Windows alternate paths | 340007 , 344360 , 347009 |
| CVE-2026-58499 | Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id | 340007 , 344360 , 390709 |
| CVE-2026-49213 | TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-49340 | gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-cont | 340007 , 344360 , 347009 |
| CVE-2026-54591 | AsyncSSH: SCP Path Traversal to Arbitrary File Write | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33655 | New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-46717 | Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47684 | Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP | 390719 |
| CVE-2026-54607 | FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55659 | Grist: XSS through unsafe value interpolation in server-rendered pages | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56285 | Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-57999 | luci-app-tailscale-community - Command Injection via tailscale.do_login RPC | 340014 , 340023 , 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-116167 | SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41180 | PsiTransfer: Upload PATCH path traversal can create config.<NODE_ENV>.js and lead to code execution on restart | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-53754 | Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59834 | SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-45310 | CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56676 | 9router: Image prefetch DNS rebinding allows SSRF to internal services | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-116236 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload | 351000 |
| CVE-2026-45233 | HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave | 344360 |
| CVE-2026-9777 | ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-56221 | Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | 340007 , 344360 , 347009 , 390709 , 399069 |
| CVE-2026-57303 | assembla Server-Side Request Forgery Vulnerability | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58451 | Horde IMP < 7.0.1 Path Traversal via Compose.php img src | 340007 , 344360 , 390709 |
| CVE-2026-116066 | Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-116069 | NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-116168 | SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool | 340007 , 344360 , 390709 |
| CVE-2026-116205 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-14358 | Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-14363 | Cargo Extension: SQLi in Special:Drilldown | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14649 | code-projects Online Voting System saveVote.php test_input sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14747 | code-projects Real State Services addprojectsale.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-58521 | SQLi in Cargo extension via year range filter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-59101 | AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-53523 | Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection | 344365 |
| CVE-2026-31978 | motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-48129 | Kestra task inputFiles accepts traversal filenames for worker file writes | 340007 , 344360 , 390709 |
| CVE-2026-58418 | SSRF via HTTP Redirect in Repository Migration | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-9774 | ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-9775 | ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-47268 | Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-52781 | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter " | 333140 , 333141 |
| CVE-2026-56769 | Huly Platform - Server-Side Request Forgery via /import Endpoint | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56771 | NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-57947 | Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55481 | Snipe-IT: CSS Injection via header_color Setting | 333140 , 333141 , 340095 |
| CVE-2026-25779 | Gitea redirect handling permits open redirects through backslash paths | 344365 |
| CVE-2026-44587 | CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54714 | Logto: XSS via unescaped RelayState in SAML auto-submit form | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56275 | Flowise - Server-Side Request Forgery via Execute Flow Base URL | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55793 | Craft CMS: Stored XSS via Structure entry title in table view | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-55187 | Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44696 | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-0643 | projectworlds House Rental and Property Listing Signup register.php unrestricted upload | 351000 |
| CVE-2026-116060 | SourceCodester Performance Indicator System adddealer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116061 | SourceCodester Performance Indicator System edit_dealer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116062 | SourceCodester Performance Indicator System save_profile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116112 | HashenUdara edoc-doctor-appointment-system add-new.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12775 | Montodel House-Rental-Management login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13485 | SourceCodester Class and Exam Timetabling System preview.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13486 | SourceCodester Class and Exam Timetabling System preview6.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13487 | SourceCodester Class and Exam Timetabling System archive.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13521 | SourceCodester Class and Exam Timetabling System preview5.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13526 | SourceCodester Class and Exam Timetabling System edit_class.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13527 | SourceCodester Class and Exam Timetabling System preview4.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13550 | itsourcecode Baptism Information Management System delbaptism.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13551 | itsourcecode Baptism Information Management System editBaptism.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13553 | itsourcecode Online Hotel Management System controller.php add unrestricted upload | 351000 |
| CVE-2026-13559 | code-projects Real State Services single-list_sale.php add sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14635 | kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal | 340007 , 344360 , 390709 |
| CVE-2026-14640 | CodeAstro Apartment Visitor Management System Login index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14641 | SourceCodester Class and Exam Timetabling System edit_course.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14642 | SourceCodester Class and Exam Timetabling System edit_class2.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14648 | code-projects Online Voting System Login authentication.php test_input sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14652 | SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14653 | SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14654 | SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14660 | code-projects Online Job Portal login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14688 | itsourcecode Online Hotel Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 , 390572 |
| CVE-2026-14695 | SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14700 | code-projects Internship Management System Employer Login Endpoint login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 344370 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14705 | code-projects Online Examination head.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14713 | SourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-14732 | SourceCodester Class and Exam Timetabling System edit_exam.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14733 | SourceCodester Class and Exam Timetabling System edit_coursea.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14734 | SourceCodester Class and Exam Timetabling System edit_product.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14736 | Ruijie RG-UAC user_auth_commit.php unrestricted upload | 351000 |
| CVE-2026-14743 | code-projects Real State Services normalHomeSale.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14744 | code-projects Real State Services normalHomeRent.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14745 | code-projects Real State Services single-list_rent.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14746 | code-projects Real State Services addprojectrent.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14768 | code-projects Real State Services builderHome.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14769 | code-projects Real State Services pay.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14770 | SourceCodester Class and Exam Timetabling System edit_room.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14771 | SourceCodester Class and Exam Timetabling System edit_exam1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14772 | SourceCodester Class and Exam Timetabling System edit_course1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15134 | CodeAstro Simple Online Leave Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15135 | code-projects Online Food Order System edit_food_items.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15137 | code-projects Interview Management System View.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15190 | SourceCodester Simple and Nice Shopping Cart Script login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15204 | TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15489 | RafyMrX TOKO-ONLINE-ROTI login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-15490 | RafyMrX TOKO-ONLINE-ROTI add.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-55439 | Halo: Path Traversal in Backup Download Leads to Arbitrary File Read | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-5637 | projectworlds Car Rental System Parameter message_admin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5645 | projectworlds Car Rental System Parameter pay.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5985 | code-projects Simple IT Discussion Forum crud.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7060 | liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7062 | Intina47 context-sync Git Integration git-integration.ts os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-7070 | code-projects Inventory Management System Login sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7088 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2026-7128 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2026-7226 | SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-7670 | Jinher OA UserSel.aspx sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8132 | CodeAstro Leave Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-36163 | LiquidFiles v4.2.7 Security Vulnerability | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116203 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116206 | YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-12050 | pgAdmin 4: SQL injection in named restore point endpoint | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14636 | kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal | 340007 , 344360 , 344365 , 390709 |
| CVE-2026-15485 | TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-29202 | cPanel Security Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-49342 | YARD static cache reads raw traversal paths before router sanitization | 347009 |
| CVE-2026-49345 | Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54300 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56347 | AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-56779 | MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-58032 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html | 340095 , 346755 |
| CVE-2026-58450 | Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-116139 | WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering | 333140 , 333141 , 340147 , 340148 , 342259 , 350147 , 350148 |
| CVE-2026-116169 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116202 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-1630 | Reflected XSS in WEBCON BPS | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-50701 | Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54430 | Server-Site Request Forgery in liboauth2 | 390719 |
| CVE-2026-57958 | Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-58579 | RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-6954 | Multiple vulnerabilities in Intermark IT's WebControl CMS | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-28385 | SSRF via image import from URL allows internal network probing by authenticated users | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-22674 | Hashgraph Guardian Stored XSS via branding companyName field | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34096 | Guardian Language-System XSS via name Parameter in designer.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-34097 | Guardian Language-System XSS via id Parameter in text_file.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34098 | Guardian Language-System XSS via id Parameter in media.php | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-34729 | phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-50708 | Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-56283 | Capgo - HTML Injection Leading to Open Redirection in Organization Settings | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-50698 | Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-50700 | Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-50710 | Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-56381 | Craft CMS - Stored XSS via User Group Name in User Permissions Page | 333140 , 333141 , 340095 , 340148 |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | 333140 , 333141 , 340095 , 340148 , 346755 , 350148 |
| CVE-2026-34170 | Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48789 | AnythingLLM: Windows path containment bypass in document folder route | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-42201 | Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-11337 | tittuvarghese CollegeManagementSystem fetch.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116055 | SourceCodester Performance Indicator System deleteproduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116057 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload | 351000 |
| CVE-2026-116097 | CloudClassroom-PHP-Project addnewstudent.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-116101 | itsourcecode Online Cake Ordering System deletetransac.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-116113 | GouGuOA Api.php chunkUpload unrestricted upload | 351000 |
| CVE-2026-116224 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12774 | BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12776 | Montodel House-Rental-Management index.php houses sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-12798 | BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12814 | Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-13496 | itsourcecode Hospital Management System ajaxmedicine.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13499 | yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2026-13530 | itsourcecode Hospital Management System Appointment appointmentdetail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13532 | itsourcecode Hospital Management System departmentDoctor.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13541 | itsourcecode Hospital Management System doctorchangepassword.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13542 | itsourcecode Hospital Management System doctorprofile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13548 | itsourcecode Hospital Management System doctortimings.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13554 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13556 | itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13557 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13560 | Edimax EW-7478APC POST Request formAccept os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-13561 | Edimax EW-7478APC POST Request formiNICbasic os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-13567 | code-projects Online Music Site POST Request Feedback.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-13578 | itsourcecode Hospital Management System patientdetail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13579 | itsourcecode Hospital Management System patientchangepassword.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13581 | Edimax EW-7478APC POST Request formStaDrvSetup os command injection | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-14619 | itsourcecode Hospital Management System medicine.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14632 | kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect | 344365 |
| CVE-2026-14634 | kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site sc | 333140 , 333141 , 340095 , 340147 , 340148 , 346755 |
| CVE-2026-14638 | itsourcecode Hospital Management System patient.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14639 | CodeAstro Ecommerce Website my_account.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14656 | code-projects Assessment Management remove-user.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-14657 | code-projects Assessment Management Database Query marking-scheme.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14658 | code-projects Assessment Management marking-scheme.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14659 | itsourcecode Hospital Management System patientappointment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14689 | CodeAstro Apartment Visitor Management System add-apartment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14691 | SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code inject | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-14692 | SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save_shop_type sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14694 | SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14698 | SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-14701 | code-projects Internship Management System Password Change Endpoint change_password.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14703 | itsourcecode Hospital Management System patientorder.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14704 | stephen-kruger bluebox cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-14706 | code-projects Online Examination Quiz Creation Feature update.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14717 | itsourcecode Hospital Management System patientlogin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14748 | AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-14766 | CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14774 | itsourcecode Hospital Management System paymentdischarge.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-14776 | SourceCodester Onlne Examination & Learning Management System Filename Extension upload_files.php pathinfo unrestricted | 351000 |
| CVE-2026-14777 | SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload | 351000 |
| CVE-2026-14783 | NousResearch hermes-agent skills_tool.py skill_view path traversal | 340007 , 344360 , 347009 |
| CVE-2026-15138 | tumf mcp-text-editor text_editor.py _validate_file_path path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-15496 | SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-6032 | code-projects Simple Laundry System checkcheckout.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-6496 | prasathmani TinyFileManager POST Parameter filemanager.php path traversal | 340007 , 344360 , 390709 |
| CVE-2026-7114 | code-projects Employee Management System edit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7683 | Edimax BR-6428nC Web setWAN command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-7744 | CodeAstro Online Classroom addnewstudent sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-7746 | SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-8081 | router-for-me CLIProxyAPI api_tools.go server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-13495 | itsourcecode Hospital Management System adminprofile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-13504 | code-projects Project Management System Mail Compose mail.php cross site scripting | 333140 , 333141 , 342259 |
| CVE-2026-14791 | crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting | 333140 , 333141 |
| CVE-2026-15326 | halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal | 340007 , 344360 , 390709 |
| CVE-2026-15494 | AMTT Hotel Broadband Operation System switch_status.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-5848 | jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-116100 | gougucms User Level Level.php add cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2026-14655 | code-projects Assessment Management view-users.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-4972 | code-projects Online Reviewer System btn_functions.php cross site scripting | 333140 , 333141 |
| CVE-2026-58038 | Stored XSS through javascript URLs in SVGs generated by EasyTimeline | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |