CVE-2026-80000 to CVE-2026-80999

36 CVEs with public proof-of-concept exploits.

• CVE-2026-800491 PoCAirbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
• CVE-2026-800511 PoCgithub.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The…
• CVE-2026-800711 PoCUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator
• CVE-2026-800721 PoCUser Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters
• CVE-2026-800992 PoCsVarious Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
• CVE-2026-801121 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
• CVE-2026-801131 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL
• CVE-2026-801141 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys
• CVE-2026-801151 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL
• CVE-2026-801161 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL
• CVE-2026-801181 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL
• CVE-2026-801191 PoCPassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL
• CVE-2026-802141 PoCLibreNMS Virtualisation Discovery Module RCE
• CVE-2026-803111 PoCStripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR
• CVE-2026-803331 PoCSolace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
• CVE-2026-803381 PoCCMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
• CVE-2026-803391 PoCPayment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay
• CVE-2026-803401 PoCPayment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay
• CVE-2026-803411 PoCPayment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR
• CVE-2026-803421 PoCPayment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID
• CVE-2026-804284 PoCsILIAS PHP Object Injection via Shibboleth Logout
• CVE-2026-804371 PoCNinja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
• CVE-2026-804381 PoCNinja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
• CVE-2026-804391 PoCRedirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags
• CVE-2026-804401 PoCHustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders
• CVE-2026-804621 PoCPrivilege Escalation in Progress Chef Automate
• CVE-2026-804672 PoCsAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
• CVE-2026-804881 PoCWP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields
• CVE-2026-804911 PoCSAMO Forms <= 1.0.0 - Unauthenticated SQLi
• CVE-2026-804941 PoCYogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
• CVE-2026-805131 PoCwpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
• CVE-2026-805141 PoCwpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass
• CVE-2026-805171 PoCWP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload
• CVE-2026-805181 PoCWP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path
• CVE-2026-805212 PoCsaf_unix: Unlink scc_entry in unix_del_edge().
• CVE-2026-808443 PoCsxfrm: ah6: validate routing header segments_left