CVE-2026-104000 to CVE-2026-104999

71 CVEs with public proof-of-concept exploits.

• CVE-2026-1040281 PoCAnton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
• CVE-2026-1040491 PoCAcademy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
• CVE-2026-1040501 PoCAcademy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers
• CVE-2026-1040511 PoCPictShare < 3.7.1 Sensitive Information Disclosure via info API
• CVE-2026-1040521 PoCitsourcecode Pet Shop Management System admin_reject_completed.php sql injection
• CVE-2026-1040541 PoCcalcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
• CVE-2026-1040771 PoCObsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
• CVE-2026-1040781 PoCObsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
• CVE-2026-1040791 PoCEnvira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
• CVE-2026-1040822 PoCsSmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
• CVE-2026-1040832 PoCsSmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
• CVE-2026-1040842 PoCsSmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
• CVE-2026-1040851 PoCodt2spip < 4.4.0 OS Command Injection via Document Filename
• CVE-2026-1041181 PoCRazorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
• CVE-2026-1041191 PoCSimple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
• CVE-2026-1041201 PoCmodelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
• CVE-2026-1041221 PoCUkr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name
• CVE-2026-1041821 PoCstream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
• CVE-2026-1041831 PoCstream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
• CVE-2026-1042461 PoCContact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
• CVE-2026-1042501 PoCunstructured: Stored XSS via unescaped HTML generation
• CVE-2026-1042521 PoCVitess vttablet /twopcz reflected XSS
• CVE-2026-1042863 PoCsKEVAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1…
• CVE-2026-1043351 PoCLangflow OSS is affected by multiple vulnerabilities
• CVE-2026-1043561 PoCPictShare < 3.7.1 Predictable Delete Code via rand()
• CVE-2026-1046061 PoCitsourcecode Online Admission System Project confirm.php sql injection
• CVE-2026-1046091 PoConetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
• CVE-2026-1046101 PoCTenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow
• CVE-2026-1046121 PoCSourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
• CVE-2026-1046131 PoCCodeAstro Simple Pharmacy Management System view.php sql injection
• CVE-2026-1046141 PoCCodeAstro Simple Pharmacy Management System delete.php sql injection
• CVE-2026-1046251 PoCCodeAstro Simple Loan Management System index.php sql injection
• CVE-2026-1046371 PoConetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload
• CVE-2026-1046381 PoConetwothreeneth HospitalManagementSystem sessions.php improper authentication
• CVE-2026-1046431 PoCEasy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
• CVE-2026-1046441 PoCImage Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
• CVE-2026-1046451 PoCImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR
• CVE-2026-1046461 PoCImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
• CVE-2026-1046511 PoCYaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR
• CVE-2026-1046521 PoCEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
• CVE-2026-1046531 PoCEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
• CVE-2026-1046671 PoCAnimated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order
• CVE-2026-1046711 PoCTutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
• CVE-2026-1046771 PoCWP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP
• CVE-2026-1046781 PoCCP Media Player < 1.3.4 - Contributor+ Media Player Settings Update
• CVE-2026-1046801 PoCEnvira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard
• CVE-2026-1046811 PoCEnvira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field
• CVE-2026-1046821 PoCEnvira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route
• CVE-2026-1046841 PoCEnvira Gallery < 1.16.2 - Author+ IDOR via Shortcode
• CVE-2026-1047112 PoCsApache Struts: OGNL injection in the legacy RESTful action mapper
• CVE-2026-1047151 PoCCifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
• CVE-2026-1047361 PoCLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
• CVE-2026-1047482 PoCsSimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
• CVE-2026-1047511 PoCRank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
• CVE-2026-1047521 PoCRank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import
• CVE-2026-1047531 PoCRank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter
• CVE-2026-1047541 PoCRank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
• CVE-2026-1047741 PoCOWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
• CVE-2026-1048271 PoCreact/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
• CVE-2026-1048481 PoCTinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
• CVE-2026-1048511 PoCfsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
• CVE-2026-1048611 PoCprobe-image-size: Quadratic-time Denial of Service in the SVG Parser
• CVE-2026-1048741 PoCMultidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
• CVE-2026-1049051 PoCFacturaScripts < 2026.7 PHP Object Injection via WidgetSelect
• CVE-2026-1049352 PoCsKEVAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands…
• CVE-2026-1049441 PoCUnauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
• CVE-2026-1049451 PoCAuthenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
• CVE-2026-1049531 PoCMPG < 4.2.3 - Editor+ SQLi via Project Import
• CVE-2026-1049821 PoCLinux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
• CVE-2026-1049831 PoCLinux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
• CVE-2026-1049911 PoCPhproject < 1.8.7 Missing Authorization via Issues REST API