CVE-2026-118000 to CVE-2026-118999
46 CVEs with public proof-of-concept exploits.
- CVE-2026-1180431 PoCBulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
- CVE-2026-1180711 PoCJoinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
- CVE-2026-1180721 PoCFraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting
- CVE-2026-1181001 PoCBuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
- CVE-2026-1181011 PoCBuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
- CVE-2026-1181291 PoCjeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication
- CVE-2026-1181651 PoCFirelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
- CVE-2026-1181681 PoCMapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure
- CVE-2026-1181841 PoCPremium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
- CVE-2026-1181851 PoCSecurity Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
- CVE-2026-1182382 PoCsCVE-2026-118238
- CVE-2026-1182571 PoCVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
- CVE-2026-1182581 PoCi18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
- CVE-2026-1182711 PoCa2ui-project a2ui data-context Resolver data-context.ts resource consumption
- CVE-2026-1182721 PoCa2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
- CVE-2026-1182731 PoCa2ui-project a2ui data-model.ts DataModel.set resource consumption
- CVE-2026-1182741 PoCa2ui-project a2ui Binder generic-binder.ts resource consumption
- CVE-2026-1182751 PoCa2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
- CVE-2026-1182761 PoCa2ui-project a2ui Parser expression_parser.ts formatString resource consumption
- CVE-2026-1183061 PoCMemory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code…
- CVE-2026-1183311 PoCImproper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary…
- CVE-2026-1184371 PoCBuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
- CVE-2026-1184381 PoCFirelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
- CVE-2026-1185771 PoCmaotoumao MusicFreeDesktop Request Forwarder server-side request forgery
- CVE-2026-1185781 PoCmaotoumao MusicFreeDesktop Request Forwarder information disclosure
- CVE-2026-1185791 PoCD-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
- CVE-2026-1185851 PoCconfiguroweb inventariobasico Add Product addlist.php cross site scripting
- CVE-2026-1186291 PoCAll-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
- CVE-2026-1186381 PoCMapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
- CVE-2026-1186501 PoCEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
- CVE-2026-1186521 PoCEcho: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
- CVE-2026-1186541 PoCEcho static file middleware route protection bypass via encoded dot-dot traversal
- CVE-2026-1186561 PoCEcho: Open Redirect via Control-Character Prefix Defeating sanitizeURI
- CVE-2026-1186571 PoCEcho: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
- CVE-2026-1186581 PoCEcho: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
- CVE-2026-1186601 PoCHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
- CVE-2026-1186611 PoCHappy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
- CVE-2026-1186641 PoCdecode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
- CVE-2026-1186651 PoCGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
- CVE-2026-1186661 PoCGraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
- CVE-2026-1186691 PoCOAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
- CVE-2026-1186891 PoCOvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length
- CVE-2026-1187631 PoC@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
- CVE-2026-1187721 PoCjoi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
- CVE-2026-1187731 PoCGlob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
- CVE-2026-1187821 PoCForge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count