CVE-2026-107000 to CVE-2026-107999

57 CVEs with public proof-of-concept exploits.

• CVE-2026-1071201 PoCContest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN
• CVE-2026-1071261 PoCWP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
• CVE-2026-1071581 PoCLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
• CVE-2026-1071601 PoCLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
• CVE-2026-1071661 PoCOpen5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources
• CVE-2026-1071781 PoCImage Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
• CVE-2026-1071814 PoCsTelegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
• CVE-2026-1072121 PoCExcelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
• CVE-2026-1072211 PoCExcelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet…
• CVE-2026-1072221 PoCExcelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check
• CVE-2026-1072231 PoCExcelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator…
• CVE-2026-1072241 PoCExcelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
• CVE-2026-1072251 PoCExcelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml
• CVE-2026-1072691 PoCGophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy
• CVE-2026-1072701 PoCGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
• CVE-2026-1072711 PoCGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
• CVE-2026-1072721 PoCGophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
• CVE-2026-1072731 PoCGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
• CVE-2026-1073191 PoCGamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
• CVE-2026-1073201 PoCGamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
• CVE-2026-1073211 PoCW3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
• CVE-2026-1073231 PoCGallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
• CVE-2026-1073771 PoCdatamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
• CVE-2026-1073781 PoCCairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
• CVE-2026-1073791 PoCenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
• CVE-2026-1073801 PoCenshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
• CVE-2026-1073811 PoCsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
• CVE-2026-1073871 PoCmusic-metadata: Uncontrolled memory allocation in APEv2 parser
• CVE-2026-1073881 PoCmusic-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
• CVE-2026-1073911 PoCmusic-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
• CVE-2026-1073921 PoCmusic-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
• CVE-2026-1074061 PoCMemory overflow vulnerability leading to Remote Code Execution or Denial of Service
• CVE-2026-1074491 PoClinuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application…
• CVE-2026-1074501 PoCIn Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend…
• CVE-2026-1075071 PoCSquadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit
• CVE-2026-1075081 PoCUltimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
• CVE-2026-1075941 PoCFile Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
• CVE-2026-1076401 PoCIntegrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API
• CVE-2026-1076941 PoCDokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint
• CVE-2026-1076951 PoCFFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
• CVE-2026-1076961 PoCFFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
• CVE-2026-1077071 PoCIntego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction
• CVE-2026-1077171 PoCBanks: User-controlled prompt input can be parsed as privileged chat messages
• CVE-2026-1077201 PoCfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
• CVE-2026-1077221 PoCfast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
• CVE-2026-1077231 PoCfast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
• CVE-2026-1077241 PoCfast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
• CVE-2026-1077911 PoCWP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment
• CVE-2026-1078062 PoCsNginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
• CVE-2026-1078081 PoCNginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
• CVE-2026-1078121 PoCNginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
• CVE-2026-1078211 PoCMariaDB: insufficient validation of binary frm data when opening a table
• CVE-2026-1078251 PoCOWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http…
• CVE-2026-1078261 PoCOWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)
• CVE-2026-1078331 PoCOWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion
• CVE-2026-1078341 PoCOWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor
• CVE-2026-1078391 PoCageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service