CVE-2026-50000 to CVE-2026-50999

52 CVEs with public proof-of-concept exploits.

• CVE-2026-500061 PoCAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
• CVE-2026-500112 PoCsNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array length
• CVE-2026-500131 PoCHoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
• CVE-2026-500161 PoCpnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
• CVE-2026-500181 PoCHoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
• CVE-2026-500231 PoCyt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
• CVE-2026-500271 PoCmcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete
• CVE-2026-500291 PoCjs-toml has silent type confusion via falsy-primitive duplicate-key bypass
• CVE-2026-501051 PoCRSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
• CVE-2026-501251 PoCMKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
• CVE-2026-501311 PoCFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
• CVE-2026-501361 PoCBudibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials
• CVE-2026-501371 PoCBudibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored…
• CVE-2026-501381 PoCgoshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
• CVE-2026-501431 PoCActor MCP path authority injection leaks Apify token
• CVE-2026-501461 PoCAstro: Reflected XSS via unescaped slot name
• CVE-2026-501511 PoCoras-go: credential forwarding via unvalidated Location header in blob upload
• CVE-2026-501581 PoCyutu: Arbitrary File Write via MCP `caption-download` Tool
• CVE-2026-501602 PoCsMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
• CVE-2026-501621 PoCoras-go: file store write outside workingDir via symlink traversal
• CVE-2026-501631 PoCoras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction
• CVE-2026-501791 PoCActual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
• CVE-2026-501801 PoCLangroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read
• CVE-2026-501811 PoCLangroid: Path traversal in the file tools allows read/write outside configured current directory
• CVE-2026-501821 PoCAVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination
• CVE-2026-501831 PoCWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
• CVE-2026-501851 PoCRustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
• CVE-2026-501921 PoCKerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without…
• CVE-2026-501971 PoCSkipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
• CVE-2026-502293 PoCsApache Tomcat: XSS in number guess example
• CVE-2026-502301 PoCLyrion Music Server 9.2.0 Reflected XSS via server.log
• CVE-2026-502871 PoCMissing Authentication for Critical Function in @agenticmail/mcp
• CVE-2026-502891 PoCsysteminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
• CVE-2026-503211 PoCWindows USB Driver Elevation of Privilege Vulnerability
• CVE-2026-503381 PoCAzure Spring Apps Elevation of Privilege Vulnerability
• CVE-2026-503431 PoCMicrosoft Install Service Elevation of Privilege Vulnerability
• CVE-2026-503691 PoCWindows Remote Desktop Services Elevation of Privilege Vulnerability
• CVE-2026-504161 PoCWin32k Information Disclosure Vulnerability
• CVE-2026-504541 PoCWindows User Interface Core Elevation of Privilege Vulnerability
• CVE-2026-505071 PoCWindows BitLocker Security Feature Bypass Vulnerability
• CVE-2026-505224 PoCsKEVMicrosoft SharePoint Remote Code Execution Vulnerability
• CVE-2026-505521 PoCKoel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail
• CVE-2026-505531 PoCNote Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
• CVE-2026-505541 PoCNote Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
• CVE-2026-505581 PoCPenelope unsafe tar extraction allows arbitrary local file write via crafted session archive
• CVE-2026-505661 PoCFission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation
• CVE-2026-505731 PoCpnpm: Unsafe default behavior breaks integrity check
• CVE-2026-506563 PoCsMicrosoft Defender Elevation of Privilege Vulnerability
• CVE-2026-507514 PoCsKEVUser Authentication Bypass in VPN Remote Access and Mobile Access
• CVE-2026-508891 PoCAn input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending a…
• CVE-2026-509791 PoCA command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated…
• CVE-2026-509801 PoCCross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to…