Atomicorp WAF Research Notes
Research Update - 2026-10-31
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-61738 | SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62853 | ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-109220 | PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote C | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2026-55598 | PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host valida | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-62849 | ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection | 340013 , 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-45144 | Chamilo LMS: Stored XSS in public user-profile fields | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2010-20125 | DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php | 344360 , 347009 , 390709 |
| CVE-2026-119655 | CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-119656 | CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-119713 | Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-62331 | praktor: Telegram upload traversal permits persistent agent instruction injection | 344360 , 390709 |
| CVE-2026-61804 | myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-119764 | Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-109997 | Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization | 333140 , 333141 , 340095 , 342259 |
| CVE-2026-115840 | VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-118238 | W18E Command Injection Vulnerability | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-119549 | Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-119553 | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-119575 | ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List | 337109 , 337110 , 340162 , 340163 , 344360 , 390109 , 398021 , 398022 |
| CVE-2026-62965 | SABnzbd: Orphan-job path traversal permits arbitrary file deletion | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-119545 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-119709 | Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-119714 | My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-119328 | Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning | 340007 , 344360 , 390709 |
| CVE-2026-119176 | CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Paramete | 333140 , 333141 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2026-119428 | phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-119554 | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-119619 | 37954679 cak-filemanagement-system save_student.php mysqli_query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2011-2927 | Spacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search forms | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2026-119342 | Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass | 340007 , 344360 , 390709 |
| CVE-2026-119563 | phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2026-7004 | WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 |
| CVE-2026-48164 | Collabora Online: Reflected HTML injection through host_session_id | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-119427 | phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-119562 | phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-117182 | Spina CMS v2.21.0 Cross-Site Scripting Vulnerability | 333140 , 333141 , 340095 |
| CVE-2026-64618 | Apache Fineract: SQL injection vulnerability in Search API | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-65874 | Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |