Atomicorp WAF Research Notes
Research Update - 2026-11-03
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-116366 | ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write | 340362 , 390614 , 390626 |
| CVE-2026-75128 | Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE | 340029 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-77876 | Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory | 340014 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-120213 | @fastify/http-proxy vulnerable to prefix escape via decoded route parameters | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-51863 | DB-GPT v0.7.5 and 0.8.0 Path Traversal Vulnerability | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-117616 | jenkins Arbitrary Code Execution Vulnerability | 340007 , 344360 , 347009 |
| CVE-2026-111048 | FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes | 333140 , 333141 |
| CVE-2026-117518 | @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-120558 | Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-120441 | OwnTone Server through 29.3 SQL Injection via MPD sticker find Command | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-120552 | SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-t | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-120575 | Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collec | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-120492 | Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-119735 | Munshi XSS via Purchase Inquiry Thread Rendering | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-120488 | LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content | 333140 , 333141 , 340095 , 340148 , 350148 |
| CVE-2026-120597 | Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-120630 | CrewAI Server-Side Request Forgery Vulnerability | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |