CVE-2026-74000 to CVE-2026-74999

30 CVEs with public proof-of-concept exploits.

• CVE-2026-742321 PoCZbtlink MQWrt yunmgrd Cloud C2 Implant
• CVE-2026-742331 PoCZbtlink MQWrt infosrvd Command Injection
• CVE-2026-742391 PoCXenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
• CVE-2026-742511 PoCJoomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
• CVE-2026-742521 PoCJoomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
• CVE-2026-744693 PoCssctp: prevent peer transport count overflow
• CVE-2026-745801 PoCvhost: reset the vring metadata cache on vring reconfiguration
• CVE-2026-745861 PoCsctp: clear new_transport when removing a peer
• CVE-2026-748021 PoCSiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
• CVE-2026-748421 PoCKira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery
• CVE-2026-748431 PoCWavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow
• CVE-2026-748511 PoCPods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback
• CVE-2026-748531 PoCPods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback
• CVE-2026-749201 PoCDocument Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
• CVE-2026-749231 PoCDocument Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons
• CVE-2026-749251 PoCMultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
• CVE-2026-749261 PoCMultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint
• CVE-2026-749271 PoCMultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint
• CVE-2026-749281 PoCWP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes
• CVE-2026-749291 PoCWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
• CVE-2026-749301 PoCWP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
• CVE-2026-749321 PoCWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning
• CVE-2026-749331 PoCGenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
• CVE-2026-749361 PoCUse-after-free in the JavaScript: WebAssembly component
• CVE-2026-749391 PoCPrivilege escalation in the DOM: Navigation component
• CVE-2026-749431 PoCUse-after-free in the Graphics: ImageLib component
• CVE-2026-749451 PoCInformation disclosure in the Graphics: Text component
• CVE-2026-749701 PoCSite isolation issue in the Graphics component
• CVE-2026-749911 PoCWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
• CVE-2026-749921 PoCKirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload