CVE-2026-100000 to CVE-2026-100999

60 CVEs with public proof-of-concept exploits.

• CVE-2026-1001431 PoCFluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email
• CVE-2026-1001921 PoCX-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint
• CVE-2026-1003031 PoCTDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints
• CVE-2026-1003041 PoCTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
• CVE-2026-1003051 PoCTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint
• CVE-2026-1003061 PoCTDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
• CVE-2026-1003101 PoCGNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
• CVE-2026-1003111 PoCmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting
• CVE-2026-1003471 PoCkin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
• CVE-2026-1003491 PoCkin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
• CVE-2026-1003501 PoCkin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
• CVE-2026-1003511 PoCkin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
• CVE-2026-1003531 PoCkin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
• CVE-2026-1003721 PoCClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php
• CVE-2026-1003731 PoCOpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
• CVE-2026-1003821 PoCUnauthenticated remote code execution through wikitext in ExternalData
• CVE-2026-1003892 PoCsGestSup before 3.2.62 Remote Code Execution via IMAP Attachment
• CVE-2026-1005201 PoCLaranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
• CVE-2026-1006711 PoCGrav before 2.0.25 Session Cookie Theft via Twig Sandbox
• CVE-2026-1007212 PoCsvm2 before 3.12.2 Authorization Bypass via Custom Resolver
• CVE-2026-1007221 PoCvm2 before 3.12.2 Host Process Termination via Construct Trap
• CVE-2026-1007231 PoCvm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
• CVE-2026-1007391 PoCmathurvishal CloudClassroom-PHP-Project viewresult.php sql injection
• CVE-2026-1007402 PoCsD-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
• CVE-2026-1007441 PoCcoollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
• CVE-2026-1007451 PoCEdimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow
• CVE-2026-1007461 PoCcoollabsio Coolify GitHub App Setup redirect missing authentication
• CVE-2026-1007521 PoCJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
• CVE-2026-1008351 PoCContrast before 1.16.0 Remote Attestation Relay Attack
• CVE-2026-1008751 PoCmathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection
• CVE-2026-1008761 PoCmathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication
• CVE-2026-1008771 PoCmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting
• CVE-2026-1008781 PoCzhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization
• CVE-2026-1008791 PoCzhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization
• CVE-2026-1008801 PoCzhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting
• CVE-2026-1008811 PoCzhistaredu StarTraining application.yml cross site scripting
• CVE-2026-1008821 PoCKrayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting
• CVE-2026-1008831 PoCKrayin laravel-crm acl.php access control
• CVE-2026-1008841 PoCKrayin laravel-crm attachment-download Endpoint acl.php resource injection
• CVE-2026-1008852 PoCsKrayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
• CVE-2026-1008861 PoCSeetong T8108/T8108P/T8116/T8232 Debug Service improper authentication
• CVE-2026-1008871 PoCamirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection
• CVE-2026-1008881 PoCTrusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write
• CVE-2026-1008891 PoCTrusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
• CVE-2026-1008901 PoCTrusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference
• CVE-2026-1008911 PoCTrusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error
• CVE-2026-1008921 PoCaligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption
• CVE-2026-1008931 PoCPrivoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery
• CVE-2026-1008951 PoCTrusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference
• CVE-2026-1008961 PoCTOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
• CVE-2026-1008981 PoCDevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection
• CVE-2026-1008991 PoCDevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection
• CVE-2026-1009001 PoCDevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery
• CVE-2026-1009011 PoCathlon1600 youtube-downloader stream.php stream server-side request forgery
• CVE-2026-1009021 PoCBarco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input
• CVE-2026-1009032 PoCsООО НПО Ритм GEOritm REST API obj-groups missing authentication
• CVE-2026-1009061 PoCEyeplus ONVIF Device GetUsers information disclosure
• CVE-2026-1009071 PoCEyeplus p2pcam Service snapshot information disclosure
• CVE-2026-1009081 PoCEyeplus p2pcam HTTP stack-based overflow
• CVE-2026-1009091 PoCOctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery