CVE-2026-120000 to CVE-2026-120999

58 CVEs with public proof-of-concept exploits.

• CVE-2026-1201891 PoCD-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow
• CVE-2026-1201901 PoCPostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting
• CVE-2026-1201911 PoCPresenton API missing authentication
• CVE-2026-1201921 PoCPresenton Desktop Authentication Middleware app_data information disclosure
• CVE-2026-1201951 PoCWAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
• CVE-2026-1201961 PoCWAVLINK WN579X3-D wapi.cgi port_forward os command injection
• CVE-2026-1201971 PoCWAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
• CVE-2026-1201981 PoCWAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
• CVE-2026-1202181 PoCTypemill SvgSanitizer.php saveImage cross site scripting
• CVE-2026-1202231 PoCOray Pugongying X5 Pro Session ID session.lua session_get random values
• CVE-2026-1202241 PoCOray Pugongying X5 Pro API Authorization run_async_task improper authorization
• CVE-2026-1202251 PoCOray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
• CVE-2026-1202271 PoCWAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
• CVE-2026-1202281 PoCWAVLINK WN553X1-B ioos Service sub_416D88 os command injection
• CVE-2026-1202291 PoCWAVLINK WN553X1-B ioos sub_416B50 os command injection
• CVE-2026-1202301 PoCWAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
• CVE-2026-1202311 PoCWAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
• CVE-2026-1202322 PoCsHorizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
• CVE-2026-1202331 PoCag-ui-protocol ag-ui HttpAgent http.ts information disclosure
• CVE-2026-1202341 PoCag-ui-protocol ag-ui HTTP Transport e.text resource consumption
• CVE-2026-1202351 PoCag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption
• CVE-2026-1202361 PoCag-ui-protocol ag-ui Transport Decoder input validation
• CVE-2026-1202371 PoCag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption
• CVE-2026-1202381 PoCWAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
• CVE-2026-1202391 PoCWAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
• CVE-2026-1202401 PoCWAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
• CVE-2026-1202411 PoCRuijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow
• CVE-2026-1202421 PoCRuijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting
• CVE-2026-1202761 PoCWAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
• CVE-2026-1202771 PoCWAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
• CVE-2026-1202781 PoCWAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication
• CVE-2026-1202791 PoCWAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
• CVE-2026-1202801 PoCWAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
• CVE-2026-1202811 PoCWAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
• CVE-2026-1202821 PoCWAVLINK WN536AX6-A protocol.csp host_black os command injection
• CVE-2026-1203181 PoCProduct Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
• CVE-2026-1203201 PoCjxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization
• CVE-2026-1203221 PoCTermix-SSH Termix transferToHost path traversal
• CVE-2026-1203241 PoCAklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal
• CVE-2026-1203251 PoCWebpro-nl Knip Workspace IssueFixer.ts writeFile path traversal
• CVE-2026-1203341 PoCdeepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal
• CVE-2026-1203351 PoCdeepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal
• CVE-2026-1203361 PoCVStarcam O-KAM Client DevDll_925.dll FUN_10003EA0 stack-based overflow
• CVE-2026-1203371 PoCVStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free
• CVE-2026-1203421 PoCmathurvishal CloudClassroom-PHP-Project viewquery.php sql injection
• CVE-2026-1203431 PoCmathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting
• CVE-2026-1203441 PoCWAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
• CVE-2026-1203451 PoCWAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
• CVE-2026-1203471 PoCdayrui XunRuiCMS Member View.php View sql injection
• CVE-2026-1203481 PoCdayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
• CVE-2026-1203491 PoCdayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection
• CVE-2026-1204281 PoCPandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
• CVE-2026-1204431 PoCGoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results
• CVE-2026-1204441 PoCGoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
• CVE-2026-1204471 PoCHotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
• CVE-2026-1204481 PoCDoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
• CVE-2026-1205031 PoCEchoHS GeekezBrowser Public API status information disclosure
• CVE-2026-1205971 PoCWelcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting