CVE-2026-72000 to CVE-2026-72999

50 CVEs with public proof-of-concept exploits.

• CVE-2026-720011 PoCPangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
• CVE-2026-720181 PoCdibs: loopback: validate offset and size in move_data()
• CVE-2026-725301 PoCKEVA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X…
• CVE-2026-725501 PoCFriendica Friendica - SQL Injection
• CVE-2026-726951 PoCGrav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
• CVE-2026-726971 PoCGrav CMS before 2.0.16 Path Traversal via media_directory
• CVE-2026-726981 PoCGrav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass
• CVE-2026-727011 PoCGrav CMS before 2.0.16 Timing Attack via verifyNonce
• CVE-2026-727021 PoCGrav CMS before 2.0.16 Origin Validation Bypass via Referer
• CVE-2026-727031 PoCRocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
• CVE-2026-727041 PoCRocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport
• CVE-2026-727051 PoCRocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument
• CVE-2026-727082 PoCsSPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html
• CVE-2026-727092 PoCsSPIP < 4.4.18 Missing Authorization via ecrire/action/
• CVE-2026-727102 PoCsSPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection
• CVE-2026-727111 PoCLean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable
• CVE-2026-727141 PoCRocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
• CVE-2026-727411 PoCRainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access
• CVE-2026-727431 PoCSQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html
• CVE-2026-727441 PoCNuxt before 4.5.1 Information Disclosure via Chrome DevTools
• CVE-2026-727771 PoCNext AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
• CVE-2026-727781 PoCCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
• CVE-2026-727811 PoCCraft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
• CVE-2026-727881 PoCSiYuan before v3.7.4 Information Disclosure via UILayout Filter
• CVE-2026-727891 PoCSiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
• CVE-2026-727901 PoCSiYuan before v3.7.4 Information Disclosure via getNotebookInfo
• CVE-2026-727921 PoCSiYuan before v3.7.4 Information Disclosure via Tag API
• CVE-2026-727931 PoCSiYuan before v3.7.4 Information Disclosure via /api/system/getConf
• CVE-2026-727941 PoCsiyuan before v3.7.4 Session Cookie Key Disclosure via getConf
• CVE-2026-727951 PoCSiYuan before v3.7.4 Information Disclosure via Embed Block
• CVE-2026-727961 PoCSiYuan before v3.7.4 Access Control Bypass via Static Routes
• CVE-2026-727971 PoCSiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus
• CVE-2026-727981 PoCSiYuan before v3.7.4 Information Disclosure via renderAttributeView
• CVE-2026-727991 PoCSiYuan before v3.7.4 Information Disclosure via Path Resolution
• CVE-2026-728001 PoCSiYuan before v3.7.4 Information Disclosure via Unfiltered API
• CVE-2026-728011 PoCSiYuan before v3.7.4 Information Disclosure via Encryption Key Material
• CVE-2026-728021 PoCSiYuan before v3.7.4 Information Disclosure via resolveAssetPath
• CVE-2026-728031 PoCSiYuan before v3.7.4 Information Disclosure via getBlockAttrs
• CVE-2026-728041 PoCSiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
• CVE-2026-728051 PoCSiYuan before v3.7.4 Information Disclosure via Block Endpoints
• CVE-2026-728071 PoCSiYuan before v3.7.4 SQL Injection via queryBlocks template
• CVE-2026-728081 PoCSiYuan before v3.7.4 Information Disclosure via getFileAnnotation
• CVE-2026-728101 PoCSiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
• CVE-2026-728111 PoCSiYuan before v3.7.4 SQL Injection via backlink search
• CVE-2026-728121 PoCSiYuan before v3.7.4 Missing Authorization via refreshBacklink
• CVE-2026-728151 PoCgo-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
• CVE-2026-728191 PoCGrav CMS before 2.0.13 Remote Code Execution via ZIP Upload
• CVE-2026-728321 PoCGrav before 2.0.12 Stored XSS via quoted-attribute bypass
• CVE-2026-728442 PoCsLean 4 Kernel Type Checking Bypass via Mismatched Structure Projections
• CVE-2026-728988 PoCsKEVMetabase SQL injection via password reset endpoint