CVE-2026-113000 to CVE-2026-113999

84 CVEs with public proof-of-concept exploits.

• CVE-2026-1133561 PoCDokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
• CVE-2026-1133581 PoCLavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
• CVE-2026-1133781 PoCmcollina mcp-ripgrep Advanced Search Tool index.ts os command injection
• CVE-2026-1133851 PoCLeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
• CVE-2026-1133881 PoCopensource-socialnetwork Cache Settings dynamic.php input code injection
• CVE-2026-1133891 PoCDrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
• CVE-2026-1133901 PoCDrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
• CVE-2026-1133911 PoCDrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
• CVE-2026-1133921 PoCDrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
• CVE-2026-1133931 PoCDrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
• CVE-2026-1133941 PoCDrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
• CVE-2026-1133951 PoCDrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
• CVE-2026-1133961 PoCDrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
• CVE-2026-1133971 PoCDrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
• CVE-2026-1134111 PoCNerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme
• CVE-2026-1134661 PoCMinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
• CVE-2026-1134681 PoCBroken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
• CVE-2026-1134721 PoCDepicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
• CVE-2026-1134851 PoCMedia Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
• CVE-2026-1134861 PoCMedia Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
• CVE-2026-1134871 PoCGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute
• CVE-2026-1134881 PoCGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
• CVE-2026-1134891 PoCGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
• CVE-2026-1134901 PoCGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
• CVE-2026-1134911 PoCGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
• CVE-2026-1134921 PoCGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
• CVE-2026-1134931 PoCGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
• CVE-2026-1134941 PoCGeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
• CVE-2026-1134991 PoCLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
• CVE-2026-1135001 PoCLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
• CVE-2026-1135011 PoCLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
• CVE-2026-1135051 PoCaaPanel Download Endpoint v2.py send_file path traversal
• CVE-2026-1135061 PoCaaPanel File Manager common.py ExecShell os command injection
• CVE-2026-1135071 PoCaaPanel common.py GetClientIp access control
• CVE-2026-1136051 PoCStirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
• CVE-2026-1136061 PoCStirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
• CVE-2026-1136161 PoCLogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
• CVE-2026-1136171 PoCAutomated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
• CVE-2026-1136432 PoCsEspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
• CVE-2026-1136501 PoCApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not…
• CVE-2026-1136521 PoCApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
• CVE-2026-1136541 PoCApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
• CVE-2026-1136551 PoCApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
• CVE-2026-1136561 PoCApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
• CVE-2026-1136571 PoCApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
• CVE-2026-1136581 PoCApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
• CVE-2026-1136591 PoCApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
• CVE-2026-1136601 PoCApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
• CVE-2026-1136611 PoCApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
• CVE-2026-1136641 PoCApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
• CVE-2026-1136651 PoCApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
• CVE-2026-1136661 PoCApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of…
• CVE-2026-1136711 PoCApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
• CVE-2026-1136731 PoCGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
• CVE-2026-1136741 PoCGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
• CVE-2026-1137121 PoCCachet has Stored XSS in Incident Component
• CVE-2026-1137131 PoCvirtualenv: Temporary app-data can leave dangling seed package links
• CVE-2026-1137141 PoCvirtualenv: Downloaded wheel selection and caching precede verification
• CVE-2026-1137151 PoCvirtualenv: Venv configuration readback can reinterpret path boundaries
• CVE-2026-1137161 PoCvirtualenv: Builtin creation follows linked environment directories
• CVE-2026-1137171 PoCvirtualenv: Pip seeding with download omits wheel digest verification
• CVE-2026-1137181 PoCvirtualenv: Xonsh activation literals depend on the script decoding codec
• CVE-2026-1137191 PoCvirtualenv: Seed replacement does not contain metadata deletion paths
• CVE-2026-1137201 PoCvirtualenv: Seeded files retain permissions from an older cache
• CVE-2026-1137211 PoCvirtualenv: Generated files can follow existing destination links
• CVE-2026-1137221 PoCvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
• CVE-2026-1137231 PoCvirtualenv: Bash prompt values can change meaning under older compatibility modes
• CVE-2026-1137241 PoCvirtualenv: Deletion recovery can change a symlink target's mode
• CVE-2026-1137251 PoCvirtualenv bash activate runs commands from an environment name with a backslash before $
• CVE-2026-1137301 PoCOGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
• CVE-2026-1137311 PoCdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
• CVE-2026-1137351 PoCD-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials
• CVE-2026-1137361 PoCD-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
• CVE-2026-1137371 PoCR6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal
• CVE-2026-1137381 PoCR6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal
• CVE-2026-1137401 PoCitsourcecode Online Cake Ordering System deletecustomer.php sql injection
• CVE-2026-1137411 PoCitsourcecode Online Cake Ordering System 404.php cross site scripting
• CVE-2026-1137431 PoCTenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal
• CVE-2026-1137441 PoCTenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
• CVE-2026-1137921 PoCpypdf: Possible infinite loop in PdfWriter.find_outline_item
• CVE-2026-1137991 PoCSlack Morphism verifier errors disclose valid HMACs in the logs
• CVE-2026-1138021 PoCWavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
• CVE-2026-1138131 PoCPayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
• CVE-2026-1138721 PoCmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown