CVE-2026-110000 to CVE-2026-110999

72 CVEs with public proof-of-concept exploits.

• CVE-2026-1100121 PoCSalon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
• CVE-2026-1100131 PoCSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
• CVE-2026-1100141 PoCSalon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
• CVE-2026-1100151 PoCSalon Booking System < 10.31.9 - Administrator Account Creation via CSRF
• CVE-2026-1100261 PoCTasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
• CVE-2026-1100291 PoCSqueeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
• CVE-2026-1100311 PoCSalon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key
• CVE-2026-1100321 PoCSalon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
• CVE-2026-1100331 PoCSalon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'
• CVE-2026-1100351 PoCSalon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
• CVE-2026-1100391 PoCSmush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
• CVE-2026-1100691 PoCModern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
• CVE-2026-1100701 PoCModern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
• CVE-2026-1101351 PoCOTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force
• CVE-2026-1101791 PoCaffiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
• CVE-2026-1101911 PoCProduct Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
• CVE-2026-1104471 PoCCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in…
• CVE-2026-1105271 PoCWP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
• CVE-2026-1105361 PoCD-Link DIR-868L HNAP CGI cgibin system os command injection
• CVE-2026-1105921 PoCBottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
• CVE-2026-1105931 PoCBottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
• CVE-2026-1105941 PoCBottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
• CVE-2026-1105951 PoCBottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
• CVE-2026-1106321 PoCReport One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
• CVE-2026-1106331 PoCMyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
• CVE-2026-1106541 PoClibzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
• CVE-2026-1106551 PoCminiupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
• CVE-2026-1106561 PoCminiupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
• CVE-2026-1106571 PoCKhronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label
• CVE-2026-1106581 PoCSofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
• CVE-2026-1106591 PoCELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
• CVE-2026-1106601 PoCvgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
• CVE-2026-1106611 PoCCGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
• CVE-2026-1106681 PoCcemtan sar2html sar2html.py index sql injection
• CVE-2026-1106691 PoCcemtan sar2html sar2html.py deleteAll missing authentication
• CVE-2026-1106941 PoCOAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bounds
• CVE-2026-1106951 PoCturboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow
• CVE-2026-1106961 PoCitsmeravitejak Online-Examination-System dbtables.sql information disclosure
• CVE-2026-1106981 PoCPraat Model Loader whisper.cpp whisper_model_load out-of-bounds write
• CVE-2026-1107121 PoClibsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info
• CVE-2026-1107131 PoClibsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders
• CVE-2026-1107141 PoClibsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
• CVE-2026-1107151 PoCMuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
• CVE-2026-1107161 PoCunshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table
• CVE-2026-1107171 PoCJanus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
• CVE-2026-1107181 PoCTurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
• CVE-2026-1107191 PoCPortkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
• CVE-2026-1107631 PoClamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
• CVE-2026-1107641 PoCAstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download
• CVE-2026-1107651 PoCFlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
• CVE-2026-1107661 PoCColanode Server through 0.4.7 Path Traversal via Avatar Download Route
• CVE-2026-1107671 PoCGitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion
• CVE-2026-1107681 PoCholaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
• CVE-2026-1107691 PoCholaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors
• CVE-2026-1107701 PoCDatabasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
• CVE-2026-1107711 PoCShopizer through 3.2.5 Authorization Bypass via Product Review customerId
• CVE-2026-1107721 PoCSure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update
• CVE-2026-1107731 PoCGrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
• CVE-2026-1107741 PoCBlinko through 1.8.8 Private Attachment Read via /api/file Route
• CVE-2026-1107751 PoCNexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
• CVE-2026-1108071 PoCsgl-project SGLang generate Endpoint io_struct.py denial of service
• CVE-2026-1108091 PoCsgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
• CVE-2026-1108101 PoCggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
• CVE-2026-1108761 PoCAdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files
• CVE-2026-1108771 PoCAdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load
• CVE-2026-1108781 PoCAureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
• CVE-2026-1108961 PoCWordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability
• CVE-2026-1109122 PoCsIn DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate…
• CVE-2026-1109571 PoCWavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection
• CVE-2026-1109582 PoCsWavlink WN530HG4B api.cgi heap-based overflow
• CVE-2026-1109761 PoCAI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
• CVE-2026-1109811 PoCWP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter