Atomicorp WAF Research Notes
Research Update - 2026-10-29
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-61564 | AVideo-Encoder: unauthenticated installer PHP code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2026-61567 | AVideo-Encoder: unauthenticated command execution through streamer login trust | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2023-49440 | AhnLab EPP 1.0.15 SQL Injection Vulnerability | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-59179 | OpenHop: Path Traversal in Flow ID File Operations | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-54455 | OpenCATS: Authenticated SQL injection in activity DataGrid date filters | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-61569 | AVideo-Encoder: pre-authentication streamer-login SQL injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-107743 | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-66090 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read | 330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 380018 |
| CVE-2026-57448 | Blombooru: administrator image-proxy server-side request forgery | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-118652 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-118680 | SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias | 340007 , 344360 , 390709 |
| CVE-2026-61529 | Endatix: Blind second-order SSRF via anonymous form-submission file URLs (SubmissionFileExtractor) | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-118258 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query s | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-118585 | configuroweb inventariobasico Add Product addlist.php cross site scripting | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-112375 | Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs | 340007 , 344360 , 344363 , 390709 , 393655 |