CVE-2026-105000 to CVE-2026-105999

159 CVEs with public proof-of-concept exploits.

• CVE-2026-1050301 PoCKener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
• CVE-2026-1050801 PoCIn ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from…
• CVE-2026-1050961 PoCOmega Solution CoinEx Crypto Customer Profile API customer authorization
• CVE-2026-1050971 PoCOmega Solution CoinEx Crypto Customer Information API customer-currency authorization
• CVE-2026-1050981 PoCOmega Solution CoinEx Crypto Support Ticket API customer information disclosure
• CVE-2026-1050991 PoCOmega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting
• CVE-2026-1051101 PoCIskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter
• CVE-2026-1051331 PoCKEVAhsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
• CVE-2026-1051342 PoCsKEVAhsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
• CVE-2026-1051351 PoCInternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
• CVE-2026-1051371 PoCLaradock Build Process Dockerfile code download
• CVE-2026-1051451 PoCWeaviate Verba generate_stream Endpoint util.py get_environment information disclosure
• CVE-2026-1051471 PoCSciPhi-AI R2R JWT Secret hard-coded credentials
• CVE-2026-1051481 PoCSciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
• CVE-2026-1051561 PoCYzmCMS MD5 system.func.php password weak password hash
• CVE-2026-1051571 PoCRainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal
• CVE-2026-1051581 PoCRainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection
• CVE-2026-1051661 PoCkishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection
• CVE-2026-1051671 PoCkishor-23 food-waste-management-system donate.php sql injection
• CVE-2026-1051681 PoCkishor-23 food-waste-management-system Order Assignment Block admin.php sql injection
• CVE-2026-1051691 PoCkishor-23 food-waste-management-system Take Order delivery.php sql injection
• CVE-2026-1051701 PoCkishor-23 food-waste-management-system Admin Signup signup.php missing authentication
• CVE-2026-1051711 PoCkishor-23 food-waste-management-system Role Attribute admin.php authorization
• CVE-2026-1051721 PoCitsourcecode Online Admission System login1.php sql injection
• CVE-2026-1051731 PoCcode-projects Human Resource Management Event Creation EventStore.php cross site scripting
• CVE-2026-1051741 PoCGerapy Project Management views.py project_create path traversal
• CVE-2026-1051801 PoCJeebase UserService info updateUser dynamically-determined object attributes
• CVE-2026-1051811 PoCitsourcecode Online Admission System register1.php sql injection
• CVE-2026-1051821 PoCSourceCodester Online Reviewer Management System btn_functions.php update sql injection
• CVE-2026-1051831 PoCitsourcecode Online Admission System confirm.php sql injection
• CVE-2026-1051841 PoCitsourcecode Online Admission System creteria.php sql injection
• CVE-2026-1051851 PoCitsourcecode Online Admission System examinee.php sql injection
• CVE-2026-1051861 PoCitsourcecode Online Admission System new.php sql injection
• CVE-2026-1051871 PoCitsourcecode Online Admission System key.php sql injection
• CVE-2026-1051881 PoCcode-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting
• CVE-2026-1051901 PoCEasy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
• CVE-2026-1051922 PoCsLMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
• CVE-2026-1051931 PoCBooking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
• CVE-2026-1051941 PoCEasy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
• CVE-2026-1051951 PoCBooking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
• CVE-2026-1051961 PoCLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
• CVE-2026-1051971 PoCLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
• CVE-2026-1051981 PoCLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
• CVE-2026-1052211 PoCGist RubyGem before 6.1.0 Disabled TLS Certificate Verification
• CVE-2026-1052251 PoCosCommerce osCommerce2 Payment payment.php include code injection
• CVE-2026-1052261 PoCosCommerce osCommerce2 Newsletter Management newsletters.php include code injection
• CVE-2026-1052291 PoCkishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection
• CVE-2026-1052301 PoCkishor-23 food-waste-management-system deliverymyord.php sql injection
• CVE-2026-1052311 PoCkishor-23 food-waste-management-system Admin Registration signup.php sql injection
• CVE-2026-1052321 PoCkishor-23 food-waste-management-system Registration deliverysignup.php sql injection
• CVE-2026-1052331 PoCkishor-23 food-waste-management-system Login Flow login.php session fixiation
• CVE-2026-1052371 PoClinlinjava litemall Login Endpoint AdminAuthController.java excessive authentication
• CVE-2026-1052381 PoCChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
• CVE-2026-1052451 PoCsgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission
• CVE-2026-1052461 PoCSourceCodester Online Reviewer Management System btn_functions.php update sql injection
• CVE-2026-1052471 PoCSourceCodester Online Reviewer Management System btn_functions.php course sql injection
• CVE-2026-1052531 PoCitsourcecode Online Admission System Project login1.php sql injection
• CVE-2026-1052541 PoCitsourcecode Online Admission System schoolyear.php sql injection
• CVE-2026-1052601 PoCDatabase Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
• CVE-2026-1052611 PoCPublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
• CVE-2026-1052841 PoCTotolink A3002MU Authentication Check boa sub_40FCFC improper authorization
• CVE-2026-1052851 PoCTotolink A3002MU QoS Rule formIpQoS stack-based overflow
• CVE-2026-1052861 PoCTotolink A3002MU File Upload formUploadFile sub_44B250 path traversal
• CVE-2026-1052871 PoCfeelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection
• CVE-2026-1052881 PoCfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting
• CVE-2026-1052891 PoCfeelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting
• CVE-2026-1052901 PoCfeelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery
• CVE-2026-1052911 PoCfeelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
• CVE-2026-1053142 PoCsPapermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth…
• CVE-2026-1053151 PoCdjango-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection
• CVE-2026-1053161 PoCMagee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
• CVE-2026-1053221 PoCMagee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form
• CVE-2026-1053291 PoCTallCMS PluginManager ThemeManager.php code injection
• CVE-2026-1053821 PoConetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization
• CVE-2026-1053831 PoConetwothreeneth HospitalManagementSystem controller.php sql injection
• CVE-2026-1053841 PoCUNION HospitalManagementSystem patient_info.php sql injection
• CVE-2026-1053851 PoConetwothreeneth HospitalManagementSystem transaction_details.php sql injection
• CVE-2026-1053861 PoConetwothreeneth HospitalManagementSystem print.php get sql injection
• CVE-2026-1053871 PoCgirishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection
• CVE-2026-1053881 PoCfeelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection
• CVE-2026-1053891 PoCfeelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload
• CVE-2026-1053921 PoCLybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key
• CVE-2026-1054381 PoCO2OA General url ActionUploadExcelWithUrl server-side request forgery
• CVE-2026-1054681 PoCgirishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection
• CVE-2026-1054691 PoCgirishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection
• CVE-2026-1054701 PoCgirishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection
• CVE-2026-1054711 PoCgirishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
• CVE-2026-1054721 PoCgirishsaraf Online-Appointment-Booking-System Booking book.php sql injection
• CVE-2026-1054861 PoCOSSRS srs System API api.go systemAPI.Run missing authentication
• CVE-2026-1054871 PoCyogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
• CVE-2026-1055711 PoCPickMall Lilishop Mobile Binding bindMobile improper authorization
• CVE-2026-1055721 PoCPickMall Lilishop Buyer Invoice List receipt authorization
• CVE-2026-1055731 PoCnewbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error
• CVE-2026-1056101 PoCchillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
• CVE-2026-1056111 PoCchillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
• CVE-2026-1056211 PoCjishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
• CVE-2026-1056971 PoCLangflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
• CVE-2026-1056981 PoCLangflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
• CVE-2026-1056991 PoCLangflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
• CVE-2026-1057031 PoCPHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
• CVE-2026-1057041 PoCSourceCodester Drug Recommendation System Auth Guard improper authentication
• CVE-2026-1057051 PoCSourceCodester Drug Recommendation System add_drug.php cross site scripting
• CVE-2026-1057061 PoCSourceCodester Drug Recommendation System cross-site request forgery
• CVE-2026-1057071 PoCuptrace user_handler.go Login information exposure
• CVE-2026-1057081 PoCimgproxy SVG svg.go sanitizeElement cross site scripting
• CVE-2026-1057411 PoCLangflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
• CVE-2026-1057441 PoCDocling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in…
• CVE-2026-1057491 PoCDocling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
• CVE-2026-1057511 PoCDocling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
• CVE-2026-1057751 PoCvllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
• CVE-2026-1057761 PoCbhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
• CVE-2026-1057781 PoCTenda AC5 Wifi setWifi stack-based overflow
• CVE-2026-1058001 PoCi18next-http-backend incomplete URL validation permits SSRF
• CVE-2026-1058042 PoCsPayload: Password hashes use insufficient PBKDF2 iterations
• CVE-2026-1058052 PoCsPayload: Sort queries could expose protected field information
• CVE-2026-1058062 PoCsPayload: Improper access control for MCP API keys
• CVE-2026-1058081 PoCSourceCodester Simple Student Information System searchresults.php clean cross site scripting
• CVE-2026-1058091 PoCSourceCodester Simple Student Information System Profile Field register.php cross site scripting
• CVE-2026-1058443 PoCsPayload: Prototype pollution in Payload Import Export plugin
• CVE-2026-1058452 PoCsPayload: SQL Injection in SQLite and Postgres
• CVE-2026-1058462 PoCsPayload: Untrusted redirect URL parameter exploit
• CVE-2026-1058472 PoCsPayload: Polymorphic join queries could disclose hidden fields
• CVE-2026-1058482 PoCsPayload: Insufficient Access Control in Stripe REST Proxy
• CVE-2026-1058492 PoCsPayload: API key disclosure through ordinary document reads
• CVE-2026-1058502 PoCsPayload: Order confirmation validation issue in Payload Ecommerce
• CVE-2026-1058512 PoCsPayload: Field access control bypass on auth collections
• CVE-2026-1058522 PoCsPayload relationship-query authorization bypass
• CVE-2026-1058532 PoCsPayload: Token refresh and password reset responses may expose restricted user fields
• CVE-2026-1058542 PoCsPayload: ReDoS in Multipart Content-Type Validation
• CVE-2026-1058552 PoCsPayload: Field-level password update restrictions were not enforced
• CVE-2026-1058562 PoCsPayload: SQL injection in SQLite/Postgres
• CVE-2026-1058572 PoCsPayload: RCE in Payload Form Builder
• CVE-2026-1058582 PoCsPayload: Remote Code Execution through first-register
• CVE-2026-1058592 PoCsPayload: Unauthorized update to collection documents
• CVE-2026-1058602 PoCsPayload: Tenant authorization bypass in Multi-Tenant Plugin
• CVE-2026-1058612 PoCsPayload external upload trust validation issue
• CVE-2026-1058622 PoCsPayload: Bypassed sanitization of user uploaded SVGs
• CVE-2026-1058632 PoCsPayload authentication token field handling issue
• CVE-2026-1058642 PoCsPayload: Cross-tenant create in @payloadcms/plugin-multi-tenant
• CVE-2026-1058652 PoCsPayload: Incomplete validation during the upload file lifecycle
• CVE-2026-1058662 PoCsPayload: Unauthenticated account-lockout denial of service
• CVE-2026-1058672 PoCsPayload: Client uploads could overwrite S3 objects
• CVE-2026-1058682 PoCsPayload: Uploaded XML files could execute same-origin JavaScript
• CVE-2026-1059181 PoCKusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection
• CVE-2026-1059191 PoCKusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection
• CVE-2026-1059201 PoCKusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection
• CVE-2026-1059211 PoCKusalkasilva Learning-Management-System search_class.php sql injection
• CVE-2026-1059221 PoCvllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
• CVE-2026-1059501 PoCgetformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
• CVE-2026-1059571 PoCSourceCodester Performance Indicator System view_product.php sql injection
• CVE-2026-1059691 PoCCodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
• CVE-2026-1059731 PoCVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization
• CVE-2026-1059741 PoCVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
• CVE-2026-1059751 PoCCamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
• CVE-2026-1059761 PoCPortfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions
• CVE-2026-1059771 PoCPortfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail
• CVE-2026-1059891 PoCAccept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery
• CVE-2026-1059901 PoCAccept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export
• CVE-2026-1059951 PoCBooking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure