Atomicorp WAF Research Notes
Research Update - 2026-11-04
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-38600 | the /upload endpoint of codeskyblue gohttpserver through v1.3.0 Security Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-44267 | Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access in Elo Jav | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-51912 | OpenBMB XAgent v1.0.0 Path Traversal Vulnerability | 344360 , 347009 , 390709 |
| CVE-2026-121607 | Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-54419 | PIAF-HMS ec.php - SQL Injection | 340016 , 340017 , 340145 , 340157 , 341145 , 341245 , 360147 , 360148 |
| CVE-2024-49368 | Unchecked logrotate settings lead to arbitrary command execution | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 390904 , 393655 |
| CVE-2026-92194 | Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-92195 | Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution Vulnerability | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-121429 | AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe() | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-121448 | Dockhand before 1.0.54 Path Traversal via Stack Environment Routes | 340007 , 344360 , 347009 |
| CVE-2026-52805 | Gogs: Migration Redirect Bypass Leads to Internal Repository Theft | 337109 , 337110 , 340162 , 340163 , 344360 , 393655 , 398021 , 398022 |
| CVE-2026-73328 | Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/ | 351000 |
| CVE-2026-121260 | Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-63502 | Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write | 340007 , 344360 , 390709 |
| CVE-2026-119977 | WordPress Core - Unauthenticated Upgrade-Window Remote Code Execution | 398129 |
| CVE-2026-51851 | modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2026-63197 | traQ: XSS in the User Uploaded File Retrieval API | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-115541 | HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-45146 | Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-121544 | Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-110265 | runZero search SQL injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-121502 | mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-121524 | sumiie24 School-Management-System Public Search Feature parent_Login.php sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2026-121627 | buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-67295 | FreeRDP before 3.29.0 Path Traversal via drive redirection | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-108050 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 |
| CVE-2026-108051 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108052 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-108053 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108054 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-108055 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108056 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108057 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 346755 |
| CVE-2026-108058 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-108059 | Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-11753 | Armeria Security Vulnerability | 340162 , 340163 , 344365 |
| CVE-2026-121453 | SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-121551 | PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description | 333140 , 333141 |
| CVE-2026-121263 | phpMyAdmin MoTranslator Loader.php getTranslator path traversal | 340007 , 344360 , 347009 , 390709 |