CVE-2026-87000 to CVE-2026-87999

83 CVEs with public proof-of-concept exploits.

• CVE-2026-870131 PoCOpen WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
• CVE-2026-870171 PoCOpen WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
• CVE-2026-870671 PoCForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
• CVE-2026-870681 PoCForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
• CVE-2026-870691 PoCForminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
• CVE-2026-870701 PoCForminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
• CVE-2026-870711 PoCForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
• CVE-2026-870741 PoCForminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
• CVE-2026-874912 PoCsKEVOut of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox…
• CVE-2026-875751 PoCIncorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to…
• CVE-2026-876061 PoCMissing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer…
• CVE-2026-877191 PoCDeserialization of Untrusted Data in GitLab
• CVE-2026-877591 PoCAdd User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
• CVE-2026-877601 PoCWeb Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
• CVE-2026-877611 PoCAdwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
• CVE-2026-877621 PoCAdwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
• CVE-2026-877641 PoCBuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
• CVE-2026-877671 PoCWP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url
• CVE-2026-877701 PoCPrice Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
• CVE-2026-877711 PoCProduct Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read
• CVE-2026-877741 PoCTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week
• CVE-2026-877751 PoCTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell
• CVE-2026-877771 PoCHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
• CVE-2026-877801 PoCLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
• CVE-2026-877811 PoCLTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter
• CVE-2026-877821 PoCKoinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator
• CVE-2026-877861 PoCDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
• CVE-2026-877961 PoCMulti Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
• CVE-2026-877971 PoCClient Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note
• CVE-2026-878171 PoCGitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
• CVE-2026-878191 PoCGitPython before 3.1.60 Denial of Service via ReDoS
• CVE-2026-878201 PoCCyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
• CVE-2026-878281 PoCSeraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update
• CVE-2026-878291 PoCCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting
• CVE-2026-878311 PoCCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field
• CVE-2026-878361 PoCComments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
• CVE-2026-878391 PoCTripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
• CVE-2026-878401 PoCTripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
• CVE-2026-878411 PoCUnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook
• CVE-2026-878421 PoCZonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
• CVE-2026-878431 PoCTrust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page
• CVE-2026-878441 PoCProduct Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
• CVE-2026-878461 PoCShipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
• CVE-2026-878481 PoCMPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
• CVE-2026-878541 PoCSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
• CVE-2026-878601 PoCSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF
• CVE-2026-878881 PoCYayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
• CVE-2026-878911 PoCRox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
• CVE-2026-878921 PoCRox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
• CVE-2026-878941 PoCRox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
• CVE-2026-878961 PoCRox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
• CVE-2026-8790220 PoCsKEVAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside…
• CVE-2026-879071 PoCRox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
• CVE-2026-879151 PoCPopup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
• CVE-2026-879161 PoCWPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
• CVE-2026-879181 PoCWPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
• CVE-2026-879191 PoCProduct XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
• CVE-2026-879211 PoCRizwan17 inventory-management-system manage.php update_record sql injection
• CVE-2026-879221 PoCRizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication
• CVE-2026-879231 PoCRizwan17 inventory-management-system List DBOperation.php cross site scripting
• CVE-2026-879241 PoCRizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication
• CVE-2026-879251 PoCRizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection
• CVE-2026-879261 PoCRizwan17 inventory-management-system Login Page index.php cross site scripting
• CVE-2026-879271 PoCMaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
• CVE-2026-879281 PoCMaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
• CVE-2026-879291 PoCMaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
• CVE-2026-879302 PoCsMaxSite CMS through 109.6 PHP Object Injection via ci_session
• CVE-2026-879331 PoCDaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
• CVE-2026-879591 PoCWPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update
• CVE-2026-879631 PoCYo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
• CVE-2026-879651 PoCEasy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
• CVE-2026-879661 PoCEasy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
• CVE-2026-879681 PoCProduct Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
• CVE-2026-879701 PoCIf-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
• CVE-2026-879711 PoCIf-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter
• CVE-2026-879731 PoCIf-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
• CVE-2026-879741 PoCAsaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
• CVE-2026-879781 PoCPaymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback
• CVE-2026-879791 PoCPaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook
• CVE-2026-879811 PoCPaymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions
• CVE-2026-879941 PoCOpen WebUI: Channel members can overwrite another member's message via the chat completions endpoint
• CVE-2026-879981 PoCOpen WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
• CVE-2026-879991 PoCOpen WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch