CVE-2026-84000 to CVE-2026-84999

124 CVEs with public proof-of-concept exploits.

• CVE-2026-840211 PoCBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
• CVE-2026-840221 PoCBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
• CVE-2026-840231 PoCBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
• CVE-2026-840241 PoCBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
• CVE-2026-840251 PoCBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via…
• CVE-2026-840261 PoCDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
• CVE-2026-840271 PoCDirectorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
• CVE-2026-840281 PoCBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
• CVE-2026-840431 PoCePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass
• CVE-2026-840441 PoCRestaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN
• CVE-2026-840451 PoCE-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart
• CVE-2026-840461 PoCDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
• CVE-2026-840471 PoCAlbum Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
• CVE-2026-840661 PoCDirectorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
• CVE-2026-840681 PoCQuentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter
• CVE-2026-840691 PoCWebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php
• CVE-2026-840881 PoCXpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget
• CVE-2026-840911 PoCSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
• CVE-2026-840951 PoCWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
• CVE-2026-840961 PoCWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
• CVE-2026-840971 PoCWP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter
• CVE-2026-840981 PoCDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
• CVE-2026-840991 PoCIDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
• CVE-2026-841111 PoCChanjet CRM jxf_dump_table.php sql injection
• CVE-2026-841131 PoCQuentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter
• CVE-2026-841181 PoCUse-after-free in the JavaScript: GC component
• CVE-2026-841461 PoCXpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
• CVE-2026-841501 PoCDirectorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
• CVE-2026-841511 PoCThe Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
• CVE-2026-841531 PoCXinhu Rainrock RockOA index.php toaddval sql injection
• CVE-2026-841661 PoCHotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
• CVE-2026-841671 PoCHotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR
• CVE-2026-841681 PoCEasy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
• CVE-2026-841691 PoCUPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
• CVE-2026-841711 PoCWP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
• CVE-2026-842191 PoCKirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
• CVE-2026-842201 PoCKirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
• CVE-2026-842211 PoCKirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
• CVE-2026-842221 PoCKirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter
• CVE-2026-842231 PoCKirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
• CVE-2026-842241 PoCKirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
• CVE-2026-842251 PoCKirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
• CVE-2026-842511 PoCclick5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
• CVE-2026-842521 PoCclick5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
• CVE-2026-842531 PoCclick5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
• CVE-2026-842541 PoCclick5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
• CVE-2026-842581 PoCclick5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
• CVE-2026-842591 PoCclick5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
• CVE-2026-842601 PoCclick5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
• CVE-2026-842611 PoCclick5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
• CVE-2026-842841 PoCIncorrect Authorization in GitLab
• CVE-2026-842871 PoCNousResearch hermes-agent Session Chat api_server.py denial of service
• CVE-2026-842881 PoCNousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service
• CVE-2026-842891 PoCNousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
• CVE-2026-843121 PoCNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
• CVE-2026-843161 PoCNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive…
• CVE-2026-843171 PoCNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
• CVE-2026-843181 PoCNginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
• CVE-2026-843201 PoCNginx UI: Auto backup name allows path traversal outside validated storage path
• CVE-2026-843611 PoCComposer: Perforce source URL permits P4PORT `rsh:` command execution
• CVE-2026-843711 PoCApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
• CVE-2026-843721 PoCPredis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
• CVE-2026-843881 PoCA improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM…
• CVE-2026-844112 PoCsMikroTik RouterOS Integer Underflow
• CVE-2026-844231 PoCCasdoor upload-resource API resource.go missing authentication
• CVE-2026-844251 PoCzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
• CVE-2026-844271 PoCzhayujie CowAgent Bash Tool bash.py denial of service
• CVE-2026-844301 PoCgouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
• CVE-2026-844311 PoCAirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal
• CVE-2026-844342 PoCsGravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field
• CVE-2026-844371 PoCOpenCart Autocomplete Workflow address.php cross site scripting
• CVE-2026-844381 PoCOpenCart Autocomplete Workflow edit.php cross site scripting
• CVE-2026-844411 PoCPiwigo Image Derivative i.php path traversal
• CVE-2026-844421 PoCMapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal
• CVE-2026-845201 PoCA buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able…
• CVE-2026-845431 PoCAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia…
• CVE-2026-845681 PoCA path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS…
• CVE-2026-846001 PoCAn authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27…
• CVE-2026-846451 PoCIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level…
• CVE-2026-846962 PoCsPhison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands
• CVE-2026-847341 PoCMindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
• CVE-2026-847371 PoCFreeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter
• CVE-2026-847381 PoCAF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE
• CVE-2026-847391 PoCImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
• CVE-2026-847401 PoCThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
• CVE-2026-847411 PoCThe Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API
• CVE-2026-847421 PoCThe Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API
• CVE-2026-847431 PoCThe Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes
• CVE-2026-847441 PoCWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
• CVE-2026-847451 PoCThe Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
• CVE-2026-847501 PoCUltimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field
• CVE-2026-847531 PoCWordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
• CVE-2026-848291 PoCOptimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
• CVE-2026-848331 PoCntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption
• CVE-2026-848391 PoCtsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication
• CVE-2026-848401 PoCtsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication
• CVE-2026-848411 PoCtsi-coop tsi-dpdp-cms client-side enforcement of server-side security
• CVE-2026-848521 PoCReader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal
• CVE-2026-848561 PoCrowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service
• CVE-2026-848571 PoCsigoden aichat API Endpoint serve.rs memory allocation
• CVE-2026-848851 PoCsimular-ai Agent-S CodeAgent code_agent.py denial of service
• CVE-2026-848861 PoCsimular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
• CVE-2026-848871 PoCsimular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
• CVE-2026-848881 PoCRightNow-AI OpenFang tool_runner.rs shell_exec memory allocation
• CVE-2026-848961 PoCKing Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
• CVE-2026-848981 PoCEventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
• CVE-2026-848991 PoCVikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
• CVE-2026-849011 PoCEventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
• CVE-2026-849021 PoCKing Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
• CVE-2026-849031 PoCKing Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
• CVE-2026-849041 PoCKing Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
• CVE-2026-849051 PoCEventin < 4.1.24 - Contributor+ User Creation via Speaker Creation
• CVE-2026-849061 PoCEventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
• CVE-2026-849071 PoCEventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint
• CVE-2026-849261 PoCEmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
• CVE-2026-849271 PoCEmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
• CVE-2026-849301 PoCCatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute
• CVE-2026-849311 PoCJoli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute
• CVE-2026-849341 PoCJCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
• CVE-2026-849351 PoCHT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings
• CVE-2026-849361 PoCEmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
• CVE-2026-849371 PoCYT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
• CVE-2026-849921 PoCmd-editor-v3: XSS via fenced-code language rendering bypass
• CVE-2026-849971 PoCreact/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU