CVE-2026-73000 to CVE-2026-73999

81 CVEs with public proof-of-concept exploits.

• CVE-2026-730301 PoCunearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape
• CVE-2026-730331 PoCSucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
• CVE-2026-730342 PoCsDB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header
• CVE-2026-730371 PoCNext AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
• CVE-2026-730721 PoCVim: Heap Buffer Overflow when Loading a Spell File
• CVE-2026-730861 PoCnanoid: Integer Overflow or Wraparound
• CVE-2026-730871 PoCDozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
• CVE-2026-732282 PoCsDjango REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies…
• CVE-2026-732291 PoCDjango REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
• CVE-2026-732311 PoCFaker: helpers.fake exploitable into arbritary code execution
• CVE-2026-732471 PoCKestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
• CVE-2026-732621 PoCProwler: Stored XSS in HTML reports through unescaped cloud resource tags
• CVE-2026-732922 PoCsSemaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
• CVE-2026-732931 PoCSemaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
• CVE-2026-732961 PoCMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
• CVE-2026-733001 PoCBudibase: SQL Injection via `multipleStatements: true`
• CVE-2026-733011 PoCBudibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
• CVE-2026-733021 PoCBudibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
• CVE-2026-733031 PoCBudibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
• CVE-2026-733041 PoCBudibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
• CVE-2026-733051 PoCBudibase: Privilege escalation via public role assignment API missing app-level authorization
• CVE-2026-733071 PoCBudibase: SSRF via bare fetch() in uploadUrl during AI table generation
• CVE-2026-733081 PoCBudibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
• CVE-2026-733091 PoCXenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
• CVE-2026-733101 PoCXenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
• CVE-2026-733111 PoCXenForo < 2.3.13 OAuth2 Authorization Code Reuse
• CVE-2026-733121 PoCXenForo < 2.3.13 Refresh Token Replay via Expired Access Token
• CVE-2026-733131 PoCXenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
• CVE-2026-733141 PoCXenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
• CVE-2026-733151 PoCXenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
• CVE-2026-733161 PoCXenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
• CVE-2026-733171 PoCXenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher
• CVE-2026-733181 PoCXenForo < 2.3.13 Missing Authorization via force-agreement Controller
• CVE-2026-733191 PoCXenForo < 2.3.13 XSS via Dynamic Redirect Handler
• CVE-2026-733201 PoCXenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint
• CVE-2026-733211 PoCXenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser
• CVE-2026-734061 PoCBudibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
• CVE-2026-734091 PoCBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
• CVE-2026-734101 PoCBudibase: SSRF via DNS rebinding in the REST datasource integration
• CVE-2026-734241 PoCAstro: Unauthenticated path override in the @astrojs/vercel ISR function
• CVE-2026-734251 PoC@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
• CVE-2026-734291 PoCRussh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
• CVE-2026-734811 PoCphpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
• CVE-2026-734821 PoCphpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php
• CVE-2026-734871 PoCFlowise before 3.1.3 Prompt Injection RCE via CSV Agent
• CVE-2026-734981 PoCMCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment
• CVE-2026-735021 PoCkin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has…
• CVE-2026-735051 PoCOh My Posh: Arbitrary command execution via template injection in the path segment
• CVE-2026-735061 PoCOh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
• CVE-2026-735091 PoCOpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
• CVE-2026-735141 PoCPostGIS address_standardizer Out-of-Bounds Write via standardize_address()
• CVE-2026-735151 PoCPostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
• CVE-2026-735191 PoCWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
• CVE-2026-735561 PoCvLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574
• CVE-2026-735611 PoCHub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
• CVE-2026-735641 PoCfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
• CVE-2026-735661 PoCnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
• CVE-2026-735681 PoCpy-libp2p: yamux connection DoS via oversized data frame
• CVE-2026-7357010 PoCsKEVA remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is…
• CVE-2026-736051 PoCSiYuan before v3.7.4 Path Traversal via getUniqueFilename
• CVE-2026-736071 PoCSiYuan before v3.7.4 Information Disclosure via getOutlineStorage
• CVE-2026-736091 PoCSiYuan before v3.7.4 Information Disclosure via getBookmarkLabels
• CVE-2026-736331 PoCApache Struts: Unbounded read of a JSON request body
• CVE-2026-736471 PoCQuasar Framework: Prototype pollution in Quasar extend() utility
• CVE-2026-736501 PoCSVGO: removeScripts plugin leaves some executable scripts intact
• CVE-2026-736511 PoCTypeORM: migration:generate template-literal code injection
• CVE-2026-736541 PoCTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
• CVE-2026-736701 PoCCMS Admin SQL Injection via db_data.php table_name Parameter
• CVE-2026-736711 PoCSaurus CMS Unauthenticated Open Redirect via logout url parameter
• CVE-2026-736731 PoCNetis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication
• CVE-2026-736782 PoCsMindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
• CVE-2026-736791 PoCImpressCMS Authenticated RCE via PHP Custom Tag eval()
• CVE-2026-736931 PoCFileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
• CVE-2026-736941 PoCFileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition
• CVE-2026-736981 PoCFileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action
• CVE-2026-736991 PoCFileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
• CVE-2026-738451 PoCCKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
• CVE-2026-738461 PoCCKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
• CVE-2026-738471 PoCEmlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
• CVE-2026-738581 PoCSolspace Freeform: Limited Twig template injection via submitted field values
• CVE-2026-739741 PoClinuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)