CVE-2026-66000 to CVE-2026-66999

36 CVEs with public proof-of-concept exploits.

• CVE-2026-660041 PoCBlenderMCP Path Traversal via download_polyhaven_asset API
• CVE-2026-660051 PoCJan Local API Server CORS Origin Reflection via 0.0.0.0 Binding
• CVE-2026-660061 PoClakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
• CVE-2026-660071 PoCDatasets Path Traversal via Unsanitized file_name Metadata
• CVE-2026-660121 PoCSiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
• CVE-2026-660271 PoCSuna < 0.9.102 Broken Access Control via Message Queue API
• CVE-2026-660281 PoCEkushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email
• CVE-2026-660291 PoCEkushey Project Manager CRM 5.0 Stored XSS via Client Name Field
• CVE-2026-660301 PoCEkushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
• CVE-2026-660311 PoCEkushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
• CVE-2026-660501 PoCNitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server
• CVE-2026-660667 PoCsAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
• CVE-2026-663731 PoCRedis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE…
• CVE-2026-663841 PoCKEVAuthenticated users may write data outside the intended Docker cache path
• CVE-2026-664471 PoCWordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability
• CVE-2026-664611 PoCWordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability
• CVE-2026-664911 PoCJoomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3
• CVE-2026-664921 PoCJoomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3
• CVE-2026-664931 PoCJoomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3
• CVE-2026-667292 PoCsfacil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser
• CVE-2026-667302 PoCsfacil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser
• CVE-2026-667312 PoCsfacil.io 0.7.5 - 0.7.6 HTTP/1.1 Chunked Transfer Encoding Parser Crash DoS
• CVE-2026-667461 PoCRouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
• CVE-2026-667471 PoCENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
• CVE-2026-667483 PoCsCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
• CVE-2026-667501 PoCLet's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
• CVE-2026-667511 PoCLet's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
• CVE-2026-667521 PoCtiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
• CVE-2026-667531 PoCtiny-http 0.12.0 HTTP Response Splitting via Header Injection
• CVE-2026-667541 PoCRouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
• CVE-2026-668043 PoCsMicrosoft Windows Cross Device Service Elevation of Privilege Vulnerability
• CVE-2026-669061 PoCApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without…
• CVE-2026-669071 PoCApache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without…
• CVE-2026-669081 PoCApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud…
• CVE-2026-669161 PoCJoomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0
• CVE-2026-669171 PoCJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0