CVE-2026-81000 to CVE-2026-81999

93 CVEs with public proof-of-concept exploits.

• CVE-2026-810003 PoCsnet: tun: bound receive headroom
• CVE-2026-810211 PoCSupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure
• CVE-2026-810221 PoCSupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak
• CVE-2026-810261 PoCMasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
• CVE-2026-810901 PoCGpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
• CVE-2026-811531 PoCRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
• CVE-2026-811541 PoCRobo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
• CVE-2026-811551 PoCRobo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
• CVE-2026-811561 PoCRobo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
• CVE-2026-811941 PoCMasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
• CVE-2026-811951 PoCMasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route
• CVE-2026-811961 PoCMasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
• CVE-2026-811971 PoCMasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
• CVE-2026-811981 PoCMasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR
• CVE-2026-811992 PoCsMasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
• CVE-2026-812001 PoCMasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
• CVE-2026-812021 PoCitsourcecode Payroll System CRUD Operation ajax.php delete missing authentication
• CVE-2026-812031 PoCSourceCodester Simple Online Food Ordering System ajax.php login2 sql injection
• CVE-2026-812941 PoCWordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
• CVE-2026-813301 PoCSoftish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information
• CVE-2026-813381 PoCMasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
• CVE-2026-813391 PoCMasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
• CVE-2026-813401 PoCMasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
• CVE-2026-813421 PoCMasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
• CVE-2026-813431 PoCFrontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
• CVE-2026-813441 PoCFrontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection
• CVE-2026-813461 PoCFrontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion
• CVE-2026-813471 PoCFrontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal
• CVE-2026-813481 PoCMy Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap
• CVE-2026-814021 PoCDS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
• CVE-2026-814041 PoCIPGP Visitors Origin < 1.6 - Reflected XSS
• CVE-2026-814201 PoCTcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter
• CVE-2026-814211 PoCddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery
• CVE-2026-814231 PoCAccept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler
• CVE-2026-814241 PoCAccept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
• CVE-2026-814261 PoCWC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
• CVE-2026-814271 PoCWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
• CVE-2026-814281 PoCWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR
• CVE-2026-814291 PoCExport & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
• CVE-2026-814311 PoCRegistration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
• CVE-2026-814321 PoCJetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
• CVE-2026-814851 PoCdanielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal
• CVE-2026-814861 PoCbsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal
• CVE-2026-814911 PoCboxpositron with-context-mcp index.ts project_folder path traversal
• CVE-2026-815051 PoCConvoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
• CVE-2026-815601 PoCblackms aistack Static File server.ts path traversal
• CVE-2026-815621 PoCAlexGladkov claude-in-mobile client.ts execSync os command injection
• CVE-2026-815711 PoCBrave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter
• CVE-2026-815783 PoCsKEVPaperCut MF/NG: Authentication Bypass
• CVE-2026-815831 PoCTheme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
• CVE-2026-816482 PoCsCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
• CVE-2026-816491 PoCFundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure
• CVE-2026-816501 PoCNextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
• CVE-2026-816511 PoCNextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
• CVE-2026-816521 PoCNextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
• CVE-2026-816531 PoCNextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
• CVE-2026-816541 PoCNextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
• CVE-2026-816551 PoCAd Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
• CVE-2026-816601 PoCGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field
• CVE-2026-817221 PoCnltk PorterStemmer before 3.10.3 Quadratic-time DoS
• CVE-2026-817231 PoCNLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
• CVE-2026-817241 PoCNLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
• CVE-2026-817251 PoCNLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
• CVE-2026-817261 PoCNLTK through 3.10.3 Path Traversal via Model-Artifact APIs
• CVE-2026-817271 PoCNLTK before 3.10.3 Hardlink File Overwrite via downloader
• CVE-2026-817371 PoCFAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
• CVE-2026-817391 PoCPaytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
• CVE-2026-817401 PoCPaytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
• CVE-2026-817411 PoCGroundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter
• CVE-2026-817421 PoCBE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
• CVE-2026-817661 PoCReally Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
• CVE-2026-817802 PoCsWordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
• CVE-2026-818071 PoCSimple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
• CVE-2026-818091 PoCPaytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
• CVE-2026-818101 PoCAll-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure
• CVE-2026-818331 PoCRooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection
• CVE-2026-818341 PoCRooCodeInc Roo-Code README File ExecaTerminalProcess code injection
• CVE-2026-818351 PoCRooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection
• CVE-2026-818361 PoCRooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission
• CVE-2026-818371 PoCRooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal
• CVE-2026-818391 PoCIncorrect Authorization in GitLab
• CVE-2026-818451 PoCarben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal
• CVE-2026-818471 PoCMAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal
• CVE-2026-818691 PoCOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
• CVE-2026-818701 PoCOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
• CVE-2026-818711 PoCOpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
• CVE-2026-818721 PoCOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
• CVE-2026-818751 PoCHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
• CVE-2026-818761 PoCHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
• CVE-2026-818891 PoCelFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
• CVE-2026-818901 PoCelFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
• CVE-2026-818911 PoCelFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
• CVE-2026-819341 PoCRedis TLS pending-data list use-after-free