CVE-2026-52000 to CVE-2026-52999

63 CVEs with public proof-of-concept exploits.

• CVE-2026-521021 PoCAn OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary…
• CVE-2026-521991 PoCAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component
• CVE-2026-522001 PoCAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management…
• CVE-2026-523071 PoCAn authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers…
• CVE-2026-523711 PoCA Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to…
• CVE-2026-524801 PoCAn issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service
• CVE-2026-524811 PoCAn issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions()…
• CVE-2026-525331 PoCAn issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
• CVE-2026-526561 PoCAn issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute…
• CVE-2026-526801 PoCApache Kyuubi: REST batch multipart upload path traversal allows controlled file write
• CVE-2026-527151 PoCWordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability
• CVE-2026-527261 PoCDulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via…
• CVE-2026-527631 PoCYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
• CVE-2026-527661 PoCYesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
• CVE-2026-527671 PoCYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
• CVE-2026-527691 PoCYesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
• CVE-2026-527701 PoCImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki
• CVE-2026-527711 PoCYesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
• CVE-2026-527721 PoCYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts —…
• CVE-2026-527732 PoCsReflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki
• CVE-2026-527742 PoCsReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki
• CVE-2026-527761 PoCTrestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
• CVE-2026-527771 PoCYesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize
• CVE-2026-527921 PoCAlgernon: Server-side script source disclosure on Windows via NTFS filename
• CVE-2026-527981 PoCGogs: Stored XSS in `.ipynb` Preview
• CVE-2026-527991 PoCGogs: Missing Authorization in Attachment Download
• CVE-2026-528001 PoCGogs: CSRF Leading to Organization Owner Takeover
• CVE-2026-528021 PoCGogs: Open Redirect via redirect_to in Gogs
• CVE-2026-528041 PoCGogs: Privilege Escalation via Collaboration Access Mode Validation
• CVE-2026-528051 PoCGogs: Migration Redirect Bypass Leads to Internal Repository Theft
• CVE-2026-528064 PoCsGogs: RCE via git rebase --exec argument injection in pull request merge
• CVE-2026-528101 PoCGogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion
• CVE-2026-528131 PoCGogs: Path Traversal in organization name results in RCE through Git hooks
• CVE-2026-528141 PoCGogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
• CVE-2026-528153 PoCsGogs: Unauthenticated Organization Teams Information Disclosure via API
• CVE-2026-528161 PoCGogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
• CVE-2026-528171 PoCLinuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation
• CVE-2026-528242 PoCsKimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
• CVE-2026-528301 PoCfast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
• CVE-2026-528311 PoCNuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
• CVE-2026-528322 PoCsNuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
• CVE-2026-528371 PoCEasy!Appointments has unauthenticated customer PII disclosure on booking reschedule page
• CVE-2026-528381 PoCEasy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS
• CVE-2026-528391 PoCEasy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass
• CVE-2026-528401 PoCEasy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
• CVE-2026-528411 PoCEasy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
• CVE-2026-528441 PoCCaddy: Windows `file_server` path authorization bypass via encoded backslash
• CVE-2026-528451 PoCCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`
• CVE-2026-528461 PoCCaddy: stripHTML template function bypass
• CVE-2026-528541 PoCmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function
• CVE-2026-528561 PoCWings: Maliciously crafted packet during SFTP connection handshake causes denial of service
• CVE-2026-528781 PoCKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain
• CVE-2026-528791 PoCKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS
• CVE-2026-528801 PoCKlever-Go: REST API slow-header connection exhaustion via Gin Engine.Run
• CVE-2026-528851 PoCNotepad++ TOCTOU: HMAC Checks Disk, Executes from Memory
• CVE-2026-528861 PoCNotepad++: session.xml backupFilePath starts_with Bypass
• CVE-2026-528872 PoCsNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
• CVE-2026-528881 PoCNocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
• CVE-2026-529103 PoCsbpf: Free reuseport cBPF prog after RCU grace period.
• CVE-2026-529231 PoCipc: limit next_id allocation to the valid ID range
• CVE-2026-529241 PoCsctp: purge outqueue on stale COOKIE-ECHO handling
• CVE-2026-529431 PoCnet: skbuff: fix missing zerocopy reference in pskb_carve helpers
• CVE-2026-529931 PoCtipc: fix double-free in tipc_buf_append()