CVE-2026-88000 to CVE-2026-88999

66 CVEs with public proof-of-concept exploits.

• CVE-2026-880001 PoCOpen WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
• CVE-2026-880011 PoCOpen WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
• CVE-2026-880021 PoCOpen WebUI: Any authenticated user can hang the server via a cyclic chat message history
• CVE-2026-880041 PoCTraefik entrypoint header-name sanitization bypassed via request trailers
• CVE-2026-880071 PoCTraefik HTTP/3 Backend NTLM Connection Reuse
• CVE-2026-880081 PoCTraefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
• CVE-2026-880091 PoCTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and…
• CVE-2026-880101 PoCTraefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
• CVE-2026-880111 PoCTraefik: ForwardAuth identity spoofing via dot-form header alias
• CVE-2026-880121 PoCTraefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
• CVE-2026-880141 PoCrclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
• CVE-2026-880151 PoCrclone local: crafted Range request against a translated symlink panics (DoS)
• CVE-2026-880171 PoCrclone: FTP cross-session auth-proxy backend confusion
• CVE-2026-880181 PoCrclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
• CVE-2026-880441 PoCrclone: RC per-server auth-proxy bypass
• CVE-2026-880561 PoCAngular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
• CVE-2026-880581 PoCAngular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
• CVE-2026-880601 PoCAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
• CVE-2026-880621 PoCOmniRoute ACP Custom-Agent Remote Code Execution (RCE)
• CVE-2026-887551 PoCZ.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace…
• CVE-2026-887641 PoCSimple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
• CVE-2026-887651 PoCImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
• CVE-2026-887715 PoCsKEVA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute…
• CVE-2026-887724 PoCsKEVMemory overflow vulnerability leading to Remote Code Execution or Denial of Service
• CVE-2026-887821 PoCKubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute
• CVE-2026-887831 PoCKubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
• CVE-2026-887851 PoCSimple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String
• CVE-2026-887881 PoCText Styler <= 1.1.1 - Contributor+ Stored XSS
• CVE-2026-887891 PoCApache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
• CVE-2026-887911 PoCSafe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
• CVE-2026-887921 PoCDictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
• CVE-2026-887931 PoCYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
• CVE-2026-887951 PoCwpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
• CVE-2026-887971 PoCVayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
• CVE-2026-887981 PoCReally Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
• CVE-2026-888021 PoCMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
• CVE-2026-888241 PoCMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
• CVE-2026-888251 PoCiGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
• CVE-2026-888261 PoCSmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
• CVE-2026-888271 PoCDisable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords
• CVE-2026-888281 PoCBlacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords
• CVE-2026-888431 PoCMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
• CVE-2026-888441 PoCMasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
• CVE-2026-888451 PoCMasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
• CVE-2026-888461 PoCMasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
• CVE-2026-888471 PoCMasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation
• CVE-2026-888481 PoCMasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass
• CVE-2026-888541 PoCJoomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
• CVE-2026-888771 PoCTraefik v3.7.0 Authentication Bypass via from-to-www-redirect
• CVE-2026-888981 PoCAppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
• CVE-2026-888991 PoCknowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
• CVE-2026-889031 PoCTopcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
• CVE-2026-889041 PoCPuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
• CVE-2026-889051 PoCKeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
• CVE-2026-889101 PoCKBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR
• CVE-2026-889121 PoCrtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
• CVE-2026-889261 PoCVikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
• CVE-2026-889271 PoCrtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
• CVE-2026-889291 PoCSale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
• CVE-2026-889301 PoCSocial Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
• CVE-2026-889311 PoCSocial Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
• CVE-2026-889931 PoCAll Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
• CVE-2026-889941 PoCAll Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
• CVE-2026-889951 PoCBookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check
• CVE-2026-889972 PoCsJSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
• CVE-2026-889981 PoCTickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN