CVE-2026-115000 to CVE-2026-115999

56 CVEs with public proof-of-concept exploits.

• CVE-2026-1151831 PoCQi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
• CVE-2026-1152141 PoCDatawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
• CVE-2026-1152231 PoCSmart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
• CVE-2026-1152241 PoCSmart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
• CVE-2026-1152251 PoCSmart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
• CVE-2026-1152451 PoCChat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
• CVE-2026-1152461 PoCsubhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
• CVE-2026-1152471 PoCsubhajitkhan online-clinic-management-system patientregistration.php missing encryption
• CVE-2026-1152481 PoCsubhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
• CVE-2026-1152491 PoCsubhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation
• CVE-2026-1152511 PoCDuplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
• CVE-2026-1152551 PoCWP Roster < 2.35 - Unauthenticated Roster Member Deletion
• CVE-2026-1152591 PoCPhoto Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
• CVE-2026-1152771 PoCWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
• CVE-2026-1152811 PoCRecipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
• CVE-2026-1152821 PoCRecipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
• CVE-2026-1152991 PoCContact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
• CVE-2026-1153001 PoCContact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
• CVE-2026-1153011 PoCContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
• CVE-2026-1153021 PoCContact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
• CVE-2026-1153031 PoCContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
• CVE-2026-1154491 PoCLibslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
• CVE-2026-1155041 PoCCFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
• CVE-2026-1155051 PoClibsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum
• CVE-2026-1155061 PoClibexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
• CVE-2026-1155221 PoCCross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python
• CVE-2026-1155341 PoCgedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
• CVE-2026-1155351 PoCgedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
• CVE-2026-1155361 PoCgedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting
• CVE-2026-1155371 PoCgedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
• CVE-2026-11556011 PoCsPublic proof-of-concept links are available. Official CVE details are pending.
• CVE-2026-1155861 PoCvirtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it…
• CVE-2026-1157301 PoCi18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
• CVE-2026-1157741 PoCTwisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
• CVE-2026-1157961 PoCTenda F6 Web Management cross-site request forgery
• CVE-2026-1157971 PoCTenda F6 Web Management cleartext transmission
• CVE-2026-1158001 PoCUbiquitousLearning mllm Convertor __init__.py load_model path traversal
• CVE-2026-1158011 PoCKakao khaiii JSON Config File Linear.cpp open out-of-bounds
• CVE-2026-1158021 PoCInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
• CVE-2026-1158861 PoCMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
• CVE-2026-1158871 PoCgraphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
• CVE-2026-1158931 PoCWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
• CVE-2026-1159051 PoCzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…
• CVE-2026-1159061 PoCzip: AES Entry HMAC Authentication Bypass on Premature EOF
• CVE-2026-1159071 PoCzip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
• CVE-2026-1159081 PoCzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense…
• CVE-2026-1159091 PoCzip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
• CVE-2026-1159101 PoCPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the…
• CVE-2026-1159241 PoCRembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
• CVE-2026-1159261 PoCPublic proof-of-concept links are available. Official CVE details are pending.
• CVE-2026-1159691 PoCTravisun Opptrix Schedule API setup command injection
• CVE-2026-1159701 PoCTravisun Opptrix Import Endpoint import code injection
• CVE-2026-1159711 PoCTravisun Opptrix preParsing handler webhook Buffer.concat denial of service
• CVE-2026-1159811 PoCphpIPAM index.php cross site scripting
• CVE-2026-1159821 PoCphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
• CVE-2026-1159971 PoCpig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection