CVE-2026-114000 to CVE-2026-114999

79 CVEs with public proof-of-concept exploits.

• CVE-2026-1140401 PoCDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
• CVE-2026-1140911 PoCTrigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
• CVE-2026-1141271 PoCAstro: Arbitrary CSS injection in Astro View Transitions
• CVE-2026-1141291 PoCstream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
• CVE-2026-1141361 PoCDjango REST framework: JSONParser applies an attacker-named codec to the request stream
• CVE-2026-1141371 PoCDjango REST framework: TokenProxy.delete() reports success and revokes nothing
• CVE-2026-1141381 PoCDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
• CVE-2026-1141401 PoCnbconvert: File write via path traversal in cell output filenames
• CVE-2026-1141411 PoCtoml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
• CVE-2026-1141421 PoCtoml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
• CVE-2026-1141431 PoCtoml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
• CVE-2026-1141481 PoCASP.NET Core Elevation of Privilege Vulnerability
• CVE-2026-1142421 PoCdhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
• CVE-2026-1142431 PoCdhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
• CVE-2026-1142451 PoCdhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
• CVE-2026-1142481 PoCdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication
• CVE-2026-1142491 PoCdhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
• CVE-2026-1142501 PoCitsourcecode Sales-and-Inventory-System cust_edit.php sql injection
• CVE-2026-1142511 PoCitsourcecode Sales-and-Inventory-System cust_del.php sql injection
• CVE-2026-1142521 PoCitsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
• CVE-2026-1142531 PoCoretnom23 file-management-system-php index.php include file inclusion
• CVE-2026-1142541 PoCoretnom23 file-management-system-php admin_class.php login sql injection
• CVE-2026-1142551 PoCoretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
• CVE-2026-1142561 PoCoretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
• CVE-2026-1142571 PoCoretnom23 file-management-system-php File Download download.php readfile sql injection
• CVE-2026-1142581 PoCoretnom23 file-management-system-php File Management files.php sql injection
• CVE-2026-1142591 PoCoretnom23 file-management-system-php admin_class.php save_files unrestricted upload
• CVE-2026-1142601 PoCoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
• CVE-2026-1142611 PoCMomoTommy file-management-system Files API FileController.php destroy missing authentication
• CVE-2026-1142621 PoCfile-management-system FileController.php store unrestricted upload
• CVE-2026-1142641 PoCProjectWorlds Advanced Library Management System edit_member.php sql injection
• CVE-2026-1142651 PoCProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
• CVE-2026-1142671 PoCSourceCodester Food Order Management System Admin Endpoint authorization
• CVE-2026-1142681 PoCTenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow
• CVE-2026-1142701 PoCGeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
• CVE-2026-1143741 PoCleomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
• CVE-2026-1143751 PoCleomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
• CVE-2026-1143761 PoCleomoon-studios wiki-go API editor.go SourceHandler path traversal
• CVE-2026-1143771 PoCleomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
• CVE-2026-1143781 PoCitsourcecode Online Cake Ordering System deleteproduct.php sql injection
• CVE-2026-1143801 PoCitsourcecode Online Cake Ordering System inserttrans.php sql injection
• CVE-2026-1143811 PoCitsourcecode Online Cake Ordering System orderdetail.php sql injection
• CVE-2026-1143821 PoCTOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
• CVE-2026-1143831 PoCTOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
• CVE-2026-1143841 PoCitsourcecode Online Cake Ordering System transactionsave.php sql injection
• CVE-2026-1143922 PoCsTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
• CVE-2026-1144002 PoCsTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
• CVE-2026-1144221 PoCEnable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
• CVE-2026-1144291 PoCWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
• CVE-2026-1144371 PoCChi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For
• CVE-2026-1144391 PoCoretnom23 php-travel-agency-system Session session.php missing authentication
• CVE-2026-1144401 PoCoretnom23 php-travel-agency-system delete.php sql injection
• CVE-2026-1144411 PoCoretnom23 php-travel-agency-system update.php sql injection
• CVE-2026-1144431 PoCSecurity by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code
• CVE-2026-1144441 PoCSecurity by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
• CVE-2026-1145011 PoCPillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
• CVE-2026-1145096 PoCsLaravel TokenGuard authentication bypass through non-string API credentials
• CVE-2026-1145741 PoCmassCodeIO massCode Local HTTP Service index.ts information disclosure
• CVE-2026-1145751 PoCTOTOLINK A950RG product.so UploadCustomModule command injection
• CVE-2026-1145761 PoCLinksys RE6250 Web Management strcmp random values
• CVE-2026-1145771 PoCoretnom23 php-travel-agency-system Insertion insert.php sql injection
• CVE-2026-1145952 PoCsInteger overflow or wraparound in EPICS Base
• CVE-2026-1146031 PoCOpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
• CVE-2026-1146041 PoCPublic proof-of-concept links are available. Official CVE details are pending.
• CVE-2026-1146101 PoCfpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
• CVE-2026-1146121 PoCLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
• CVE-2026-1146131 PoCMessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
• CVE-2026-1146141 PoCAuthlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
• CVE-2026-1146151 PoCAuthlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
• CVE-2026-1146161 PoCAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
• CVE-2026-1146171 PoCAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
• CVE-2026-1146181 PoCAuthlib: Default JWT bearer grant accepts assertions for the wrong audience
• CVE-2026-1146191 PoCAuthlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
• CVE-2026-1146201 PoCAuthlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
• CVE-2026-1146251 PoCKEVSecurity Advisory 0199
• CVE-2026-1147401 PoCWP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
• CVE-2026-1147411 PoCWP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
• CVE-2026-1147421 PoCWP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
• CVE-2026-1147431 PoCInstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings