CVE-2026-70000 to CVE-2026-70999

27 CVEs with public proof-of-concept exploits.

• CVE-2026-703761 PoCPluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
• CVE-2026-704261 PoCIn Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and…
• CVE-2026-704631 PoCrsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
• CVE-2026-704701 PoCFlowise: Pyodide validator Unicode homoglyph bypass leads to RCE
• CVE-2026-704721 PoCFlowise: Cross-workspace credential IDOR in openai-assistants-vector-store
• CVE-2026-704731 PoCFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
• CVE-2026-704751 PoCFlowise: Missing Authorization on Execution Update Endpoint
• CVE-2026-704761 PoCFlowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
• CVE-2026-704801 PoCOpen WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
• CVE-2026-704811 PoCOpen WebUI: Any member with write access to a standard channel can edit or delete other members' messages
• CVE-2026-704851 PoCOpen WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
• CVE-2026-704911 PoCOpen WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
• CVE-2026-704921 PoCOpen WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
• CVE-2026-704931 PoCOpen WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
• CVE-2026-705531 PoCMaxSite CMS Unauthenticated RCE via Install Endpoint
• CVE-2026-705561 PoCHubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration
• CVE-2026-706151 PoCboringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation
• CVE-2026-706161 PoCboringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint
• CVE-2026-706192 PoCsOdysseus Missing Admin Authorization via Embedding Endpoint Routes
• CVE-2026-706202 PoCsOdysseus SSRF via Embedding Endpoint Configuration
• CVE-2026-706221 PoCtar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()
• CVE-2026-706261 PoCNLTK before 3.9.4 Symlink Escape via CorpusReader
• CVE-2026-706361 PoCFlowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint
• CVE-2026-706371 PoCLightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
• CVE-2026-706381 PoCllama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
• CVE-2026-706661 PoCLemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
• CVE-2026-706671 PoCLemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for…