CVE-2026-83000 to CVE-2026-83999

30 CVEs with public proof-of-concept exploits.

• CVE-2026-835321 PoCCustom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
• CVE-2026-835331 PoCWP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
• CVE-2026-835371 PoCWP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment
• CVE-2026-835411 PoCSina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
• CVE-2026-835431 PoCGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint
• CVE-2026-835441 PoCGreenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute
• CVE-2026-835451 PoCCoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
• CVE-2026-835461 PoCCoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute
• CVE-2026-835471 PoCXpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
• CVE-2026-835483 PoCsKEVA Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A…
• CVE-2026-835491 PoCKEVPost-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been…
• CVE-2026-835551 PoCEmail Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification
• CVE-2026-835571 PoCjackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
• CVE-2026-835601 PoCNew User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
• CVE-2026-836031 PoCNetdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
• CVE-2026-836051 PoCxmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
• CVE-2026-836061 PoCxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
• CVE-2026-836071 PoCxmldom: Element name injection via createElement() bypasses requireWellFormed
• CVE-2026-836081 PoCxmldom: DocType `name` Injection Bypasses requireWellFormed
• CVE-2026-836101 PoCxmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
• CVE-2026-836121 PoCxmldom: HTML raw-text closing-tag case mismatch causes output amplification
• CVE-2026-836131 PoCxmldom: Quadratic-time attribute deduplication
• CVE-2026-836141 PoCxmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
• CVE-2026-836151 PoCxmldom: Quadratic-memory consumption
• CVE-2026-836161 PoCxmldom: Processing Instruction Target Injection Bypasses requireWellFormed
• CVE-2026-836171 PoCxmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
• CVE-2026-836181 PoCxmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
• CVE-2026-836271 PoCHummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in…
• CVE-2026-837441 PoCinvoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery
• CVE-2026-839911 PoCWindows Cloud Files Mini Filter Driver Tampering Vulnerability