CVE-2026-102000 to CVE-2026-102999

78 CVEs with public proof-of-concept exploits.

• CVE-2026-1022401 PoCNetcore NAP930 Network Tools CGI network_tools eval os command injection
• CVE-2026-1022411 PoCNetcore NAP930 Backup/Restore backup_common.sh hard-coded key
• CVE-2026-1022431 PoCMODSetter SurfSense MCP Connector Integration test command injection
• CVE-2026-1022441 PoCMODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
• CVE-2026-1022451 PoCMODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
• CVE-2026-1022471 PoCFastAdmin Database Management database.php unnecessary privileges
• CVE-2026-1022481 PoCRebuild Login Endpoint login improper authentication
• CVE-2026-1022491 PoCREBUILD file-editor-save authorization
• CVE-2026-1022531 PoCiperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
• CVE-2026-1022611 PoCowen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
• CVE-2026-1022651 PoCPyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
• CVE-2026-1022661 PoCPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
• CVE-2026-1022681 PoCPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
• CVE-2026-1022711 PoCPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
• CVE-2026-1022721 PoCPyJWT BOM Bypass
• CVE-2026-1022751 PoCPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
• CVE-2026-1022811 PoCNest: Remote process termination via a deeply nested microservice message pattern
• CVE-2026-1022822 PoCsadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
• CVE-2026-1022901 PoCCodeCanyon Rocket LMS Student Profile Image Upload cross site scripting
• CVE-2026-1022921 PoCcoolbeans1212 MateisHomePage-Website users.php cross site scripting
• CVE-2026-1022931 PoCrealjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
• CVE-2026-1023611 PoCmall4j through 4.0 Missing Authentication in Password Update Endpoint
• CVE-2026-1023621 PoCmall4j through 4.0 Missing Authentication in Product Review Deletion
• CVE-2026-1023631 PoCmall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
• CVE-2026-1023641 PoCmall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
• CVE-2026-1023651 PoCmall4j through 4.0 Missing Authorization in Admin User Address Endpoints
• CVE-2026-1023661 PoCmall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
• CVE-2026-1023671 PoCmall4j through 4.0 Insufficient Session Expiration via Token Refresh
• CVE-2026-1023722 PoCsGestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector
• CVE-2026-1023732 PoCsGestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
• CVE-2026-1023742 PoCsGestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector
• CVE-2026-1024141 PoCpbkdf2 rehashes long passwords on every iteration, enabling denial of service
• CVE-2026-1024221 PoCshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
• CVE-2026-1024252 PoCsJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
• CVE-2026-1024271 PoCJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
• CVE-2026-1024282 PoCsJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
• CVE-2026-1024894 PoCsKEVUndisclosed RCE in Zammad v6.3 and higher
• CVE-2026-1024911 PoCmahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
• CVE-2026-1025071 PoCSliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC
• CVE-2026-1025691 PoCClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
• CVE-2026-1025701 PoCClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
• CVE-2026-1026071 PoCZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
• CVE-2026-1026161 PoCrisesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
• CVE-2026-1026201 PoCFreedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
• CVE-2026-1026211 PoCFreedesktop Poppler SplashClip.cc clipToPath integer overflow
• CVE-2026-1026971 PoCOllama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
• CVE-2026-1027481 PoCDgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
• CVE-2026-1027641 PoCKEVImproper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
• CVE-2026-1027711 PoCNaichen ThinkCMF Email Template MailController.php templatePut special elements in template engine
• CVE-2026-1027821 PoCJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
• CVE-2026-1027921 PoCZiroom ZHOME A0101 set_syslog command injection
• CVE-2026-1027931 PoCZiroom ZHOME A0101 set_time_zone command injection
• CVE-2026-1027941 PoCZiroom ZHOME A0101 ping command injection
• CVE-2026-1028041 PoCNothings stb stb_hexwave.h hexwave_init integer overflow
• CVE-2026-1028051 PoCNothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
• CVE-2026-1028201 PoCpageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
• CVE-2026-1028211 PoCRussh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
• CVE-2026-1028251 PoCRussh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
• CVE-2026-1028261 PoCsimple-git allows command execution through unblocked Git configuration includes
• CVE-2026-1028291 PoCsimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
• CVE-2026-1028341 PoCJavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
• CVE-2026-1028421 PoCgedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
• CVE-2026-1028431 PoCgedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal
• CVE-2026-1028441 PoCgedelumbung HospitalManagement laporan_data_pasien.php detail authorization
• CVE-2026-1028451 PoCgedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
• CVE-2026-1028461 PoCgedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
• CVE-2026-1028471 PoCgedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting
• CVE-2026-1028741 PoCHKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
• CVE-2026-1029061 PoC0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection
• CVE-2026-1029081 PoCSourceCodester Online Reviewer Management System questions-view.php sql injection
• CVE-2026-1029091 PoCSourceCodester Online Reviewer Management System btn_functions.php sql injection
• CVE-2026-1029101 PoCSourceCodester Online Reviewer Management System exam-delete.php sql injection
• CVE-2026-1029111 PoCzosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
• CVE-2026-1029121 PoCSourceCodester Online Leave Management System page reports sql injection
• CVE-2026-1029131 PoCSourceCodester Car Driving School Management System Master.php save_enrollment sql injection
• CVE-2026-1029901 PoCbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
• CVE-2026-1029911 PoCMako: Path traversal via drive-letter URI on Windows in TemplateLookup
• CVE-2026-1029921 PoCpiscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env