CVE-2026-62000 to CVE-2026-62999

36 CVEs with public proof-of-concept exploits.

• CVE-2026-620591 PoCWordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
• CVE-2026-620621 PoCWordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
• CVE-2026-621791 PoCPraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
• CVE-2026-621831 PoCApache Syncope: User self-service privilege escalation
• CVE-2026-622391 PoCFlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
• CVE-2026-622401 PoCCrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
• CVE-2026-622421 PoCSpring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
• CVE-2026-622861 PoCDozzle label filters do not restrict container event and statistics streams
• CVE-2026-623141 PoCAnubis: Policy bypass via client controlled X-Original-URI header
• CVE-2026-623231 PoCCloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored
• CVE-2026-623241 PoCJodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
• CVE-2026-623251 PoCgoshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
• CVE-2026-623681 PoCSnipe-IT: Stored XSS via Custom Field name in asset-list column headers
• CVE-2026-623761 PoCVikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
• CVE-2026-623822 PoCsPasswordPusher before v2.9.6 Authentication Bypass via Null Comparison
• CVE-2026-623831 PoCnltk IPIPANCorpusReader Symlink Arbitrary File Read
• CVE-2026-623841 PoCNLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2
• CVE-2026-623851 PoCNLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
• CVE-2026-623881 PoCNLTK before 3.10.0 Insecure Default Configuration in pathsec.py
• CVE-2026-626691 PoCGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
• CVE-2026-626721 PoCGrav: Authenticated ReDoS via regex_replace in Twig Sandbox
• CVE-2026-626731 PoCGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
• CVE-2026-626841 PoCFile Browser: Share API exposes the password hash and bypass token
• CVE-2026-626851 PoCFile Browser: Colliding username normalization gives two users the same home directory
• CVE-2026-627354 PoCsWindows HTTP.sys Elevation of Privilege Vulnerability
• CVE-2026-627371 PoCWindows Kernel Elevation of Privilege Vulnerability
• CVE-2026-628431 PoCFile Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
• CVE-2026-628781 PoCWindows DNS Server Remote Code Execution Vulnerability
• CVE-2026-629111 PoCMicrosoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2026-629471 PoCOpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download
• CVE-2026-629821 PoCGlances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command…
• CVE-2026-629851 PoCrequest-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the…
• CVE-2026-629871 PoCFabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection…
• CVE-2026-629881 PoCFroxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
• CVE-2026-629941 PoCCoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
• CVE-2026-629981 PoCREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration