CVE-2026-56000 to CVE-2026-56999

64 CVEs with public proof-of-concept exploits.

• CVE-2026-560081 PoCWordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability
• CVE-2026-560781 PoCPraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor
• CVE-2026-560961 PoCInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
• CVE-2026-560991 PoCOpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input
• CVE-2026-561001 PoCSpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
• CVE-2026-561011 PoCOpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
• CVE-2026-561091 PoCALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c
• CVE-2026-561112 PoCsMarlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler
• CVE-2026-561151 PoCBootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass
• CVE-2026-561214 PoCsFeast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization
• CVE-2026-561221 PoCWinstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths
• CVE-2026-561292 PoCsGeneric IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access…
• CVE-2026-561391 PoCApache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in…
• CVE-2026-561642 PoCsKEVMicrosoft SharePoint Server Elevation of Privilege Vulnerability
• CVE-2026-562651 PoCCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
• CVE-2026-562702 PoCsFlowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
• CVE-2026-562741 PoCFlowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
• CVE-2026-562907 PoCsKEVJoomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
• CVE-2026-562916 PoCsKEVJoomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
• CVE-2026-562921 PoCJoomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
• CVE-2026-563411 PoCAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
• CVE-2026-563461 PoCAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
• CVE-2026-563811 PoCCraft CMS - Stored XSS via User Group Name in User Permissions Page
• CVE-2026-563821 PoCCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
• CVE-2026-563831 PoCCraft CMS - Stored XSS in Table Field via Row Heading Column Type
• CVE-2026-563971 PoCSiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README
• CVE-2026-564231 PoCMISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints
• CVE-2026-564431 PoCToken public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
• CVE-2026-566571 PoCGitea SSH Key Parser Denial of Service
• CVE-2026-566751 PoC9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
• CVE-2026-566761 PoC9router: Image prefetch DNS rebinding allows SSRF to internal services
• CVE-2026-566781 PoC9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
• CVE-2026-566791 PoC9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
• CVE-2026-566811 PoC9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
• CVE-2026-566821 PoC9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
• CVE-2026-567011 PoCGrav - XML External Entity Injection via SVG Upload
• CVE-2026-567052 PoCsAdminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
• CVE-2026-567181 PoCAJCloud AJY IPC Firmware Path Traversal via jdbhttpd
• CVE-2026-567361 PoCphpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
• CVE-2026-567371 PoCphpMyFAQ's two-factor authentication login bypasses the password factor
• CVE-2026-567381 PoCphpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
• CVE-2026-567661 PoCHydra - Stack Buffer Overflow in NTLM Authentication Handler
• CVE-2026-567691 PoCHuly Platform - Server-Side Request Forgery via /import Endpoint
• CVE-2026-567701 PoClibais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID
• CVE-2026-567741 PoCKanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
• CVE-2026-567791 PoCMaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
• CVE-2026-567822 PoCsGorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
• CVE-2026-567861 PoCRTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message
• CVE-2026-567871 PoCRTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
• CVE-2026-567881 PoCRTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
• CVE-2026-567891 PoCRTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count
• CVE-2026-567901 PoCCANBoat - Off-by-One Global Buffer Overflow in searchForPgn()
• CVE-2026-568181 PoCNetty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
• CVE-2026-568191 PoCNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
• CVE-2026-568201 PoCNetty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
• CVE-2026-568211 PoCNetty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
• CVE-2026-568251 PoCShopper: Missing authorization on product removal actions in CollectionProducts component
• CVE-2026-568261 PoCShopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete…
• CVE-2026-568271 PoCShopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility…
• CVE-2026-568291 PoCShopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
• CVE-2026-568301 PoCShopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization
• CVE-2026-568311 PoCShopper: Negative discount values accepted and propagated through order calculation pipeline
• CVE-2026-568481 PoCA flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is…
• CVE-2026-568761 PoCextract-zip unvalidated symlink path traversal