CVE-2026-61000 to CVE-2026-61999

62 CVEs with public proof-of-concept exploits.

• CVE-2026-613431 PoCLibreBooking path traversal
• CVE-2026-614242 PoCsJoomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2
• CVE-2026-614281 PoCPraisonAI AgentMail before 4.6.78 Message Injection via Webhook
• CVE-2026-614291 PoCPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
• CVE-2026-614301 PoCPraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl
• CVE-2026-614311 PoCPraisonAI before 4.6.78 Path Traversal via ContextGatherer
• CVE-2026-614321 PoCPraisonAI FastContext before 1.6.78 Path Traversal
• CVE-2026-614331 PoCPraisonAI before 4.6.78 Code Injection via API deployment generator
• CVE-2026-614341 PoCPraisonAI before 4.6.78 Allowlist Bypass via find -exec
• CVE-2026-614351 PoCPraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing
• CVE-2026-614361 PoCPraisonAI before 4.6.78 Missing Webhook Signature Verification
• CVE-2026-614371 PoCPraisonAI before 1.6.78 Remote Code Execution via tools.py
• CVE-2026-614401 PoCPraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
• CVE-2026-614421 PoCPraisonAI Platform before 0.1.9 Authorization Bypass via PATCH
• CVE-2026-614451 PoCPraisonAI before 4.6.78 Arbitrary File Write and Command Execution
• CVE-2026-614471 PoCPraisonAI before 1.6.78 Remote Code Execution via CodeAgent
• CVE-2026-614491 PoCGrav before 2.0.2 Decompression Bomb via Forged ZIP Size
• CVE-2026-614592 PoCsMCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools
• CVE-2026-614601 PoCKrayin CRM Insecure Direct Object Reference via Controllers
• CVE-2026-614611 PoCDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text
• CVE-2026-614982 PoCsVitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php
• CVE-2026-615001 PoCRejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
• CVE-2026-615116 PoCsvBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
• CVE-2026-615141 PoCPuwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456
• CVE-2026-615151 PoCPuwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell
• CVE-2026-615161 PoCNetis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
• CVE-2026-615171 PoCNetis NX10 OS Command Injection via Ping Diagnostic Handler
• CVE-2026-615181 PoCISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
• CVE-2026-615231 PoCWebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
• CVE-2026-615241 PoCWebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation
• CVE-2026-615541 PoCemp3r0r has an unauthenticated HTTP Polling DoS
• CVE-2026-615561 PoCLiquidJS: An infinite loop vulnerability in `strip_html` filter
• CVE-2026-615591 PoC@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
• CVE-2026-615602 PoCs@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
• CVE-2026-615682 PoCs@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
• CVE-2026-616091 PoCPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
• CVE-2026-616121 PoC@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
• CVE-2026-616282 PoCsnginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
• CVE-2026-616291 PoCnginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
• CVE-2026-616321 PoCPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
• CVE-2026-616631 PoCdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
• CVE-2026-616721 PoCCapsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
• CVE-2026-616901 PoCGrav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
• CVE-2026-616951 PoCWire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
• CVE-2026-616991 PoCnebula-mesh: Certificate revocation is never enforced at the mesh
• CVE-2026-617322 PoCsDecepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
• CVE-2026-617362 PoCsLightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
• CVE-2026-617401 PoCLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
• CVE-2026-617421 PoCDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
• CVE-2026-617821 PoC@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
• CVE-2026-617881 PoC@bytebase/dbhub's read-only mode does not prevent database writes
• CVE-2026-617931 PoCNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
• CVE-2026-617941 PoCCapsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
• CVE-2026-617951 PoCCapsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook…
• CVE-2026-618081 PoCLightRAG: Missing Authentication for Critical API Functions in Default Configuration
• CVE-2026-618161 PoCzbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
• CVE-2026-618331 PoCzot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
• CVE-2026-618341 PoCscim-patch: Mutation of Inherited Built-in Method Objects
• CVE-2026-618421 PoCGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
• CVE-2026-618761 PoCLuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
• CVE-2026-619461 PoCWordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability
• CVE-2026-619791 PoCWordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability