CVE-2026-106000 to CVE-2026-106999

33 CVEs with public proof-of-concept exploits.

• CVE-2026-1060291 PoCWeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
• CVE-2026-1060301 PoCMissing Authorization in NordVPN for Windows
• CVE-2026-1060311 PoCSpin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
• CVE-2026-1060951 PoCCode Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet
• CVE-2026-1060971 PoCCode Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)
• CVE-2026-1060981 PoCWP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update
• CVE-2026-1060991 PoCWP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
• CVE-2026-1061002 PoCsPayload: Field-level write access bypass in Payload on MongoDB
• CVE-2026-1061011 PoCQuasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
• CVE-2026-1061041 PoCQuasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
• CVE-2026-1061061 PoCQuasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
• CVE-2026-1061101 PoCImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
• CVE-2026-1061111 PoCImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
• CVE-2026-1061121 PoCImageSharp: ICC LUT16 output channel count can write beyond Vector4
• CVE-2026-1061131 PoCImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
• CVE-2026-1061141 PoCImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
• CVE-2026-1061151 PoCImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
• CVE-2026-1061161 PoCImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
• CVE-2026-1061171 PoCImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in…
• CVE-2026-1061181 PoCImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
• CVE-2026-1061201 PoCLiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index…
• CVE-2026-1061211 PoCRabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
• CVE-2026-1061221 PoCRabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
• CVE-2026-1061231 PoCRabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
• CVE-2026-1061661 PoCNEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
• CVE-2026-1064431 PoCWeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
• CVE-2026-1064452 PoCsHandlebars: JavaScript Injection via Own Property Check Bypass
• CVE-2026-1064462 PoCsHandlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
• CVE-2026-1064541 PoCTwisted: IMAP wildcardToRegexp() ReDoS
• CVE-2026-1064691 PoCGutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
• CVE-2026-1064701 PoCWP Data Access < 5.5.88 - Subscriber+ SSRF
• CVE-2026-1066101 PoCWordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
• CVE-2026-1066461 PoCClassified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers