CVE-2026-109000 to CVE-2026-109999

55 CVEs with public proof-of-concept exploits.

• CVE-2026-1091061 PoCPolaris Office App Document Intake com.infraware.service.m.n.a path traversal
• CVE-2026-1091101 PoCWavlink WL-WN592AX6 wmapd system os command injection
• CVE-2026-1091141 PoCAdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication
• CVE-2026-1091151 PoCAdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection
• CVE-2026-1091161 PoCAdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
• CVE-2026-1091431 PoCcalcom cal.com/cal.diy Credentials delete credentials.delete privileges management
• CVE-2026-1091451 PoCUser Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
• CVE-2026-1091571 PoCTRENDnet TEW-432BRP formTcpipSetup stack-based overflow
• CVE-2026-1091641 PoCTDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
• CVE-2026-1091651 PoCTDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create
• CVE-2026-1091661 PoClamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
• CVE-2026-1091671 PoCTDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save
• CVE-2026-1091681 PoClamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
• CVE-2026-1091711 PoCyshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check
• CVE-2026-1091721 PoCyshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint
• CVE-2026-1091731 PoCyshop-crm through 2.1.3 Missing Authorization via invoice check endpoint
• CVE-2026-1091741 PoCMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
• CVE-2026-1091751 PoCMoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
• CVE-2026-1091761 PoCMoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
• CVE-2026-1091771 PoCMoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
• CVE-2026-1091781 PoCjshERP through 3.6 Missing Authorization via /log Audit Endpoints
• CVE-2026-1091791 PoCjshERP through 3.6 Missing Authorization via /log/list and /log/info
• CVE-2026-1091801 PoCjshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
• CVE-2026-1091811 PoCjshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
• CVE-2026-1091821 PoCjshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
• CVE-2026-1091831 PoCjshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
• CVE-2026-1091841 PoCjshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
• CVE-2026-1091851 PoCjshERP through 3.6 Privilege Escalation via PUT /user/updateUser
• CVE-2026-1091861 PoCjshERP through 3.6 Mass Assignment via PUT /user/update
• CVE-2026-1091871 PoCjshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
• CVE-2026-1091881 PoCjshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
• CVE-2026-1093911 PoCSquare Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
• CVE-2026-1093921 PoCPimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
• CVE-2026-1094091 PoCHBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
• CVE-2026-1094251 PoCTink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
• CVE-2026-1095191 PoCYouTransfer Template Rendering template path traversal
• CVE-2026-1095211 PoCgirishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection
• CVE-2026-1095221 PoCgirishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection
• CVE-2026-1095231 PoCgirishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
• CVE-2026-1095241 PoCgirishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
• CVE-2026-1095251 PoCgirishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
• CVE-2026-1095261 PoCHBAI-Ltd Toonflow-app exportData Endpoint information disclosure
• CVE-2026-1095701 PoCFire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
• CVE-2026-1095711 PoCFire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
• CVE-2026-1096051 PoCSourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
• CVE-2026-1096061 PoCSourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection
• CVE-2026-1096071 PoCSourceCodester Online Exam System Login Endpoint loginExe.php sql injection
• CVE-2026-1096201 PoCSourceCodester Online Reviewer System index.php prepare sql injection
• CVE-2026-1098271 PoCGPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
• CVE-2026-1098281 PoClibsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
• CVE-2026-1099301 PoCMAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
• CVE-2026-1099371 PoCOtter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
• CVE-2026-1099661 PoCyt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
• CVE-2026-1099671 PoCyt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
• CVE-2026-1099821 PoCMB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration