CVE-2026-94000 to CVE-2026-94999

102 CVEs with public proof-of-concept exploits.

• CVE-2026-940031 PoCComfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
• CVE-2026-940151 PoCSourceCodester Drug Recommendation System edit_user.php sql injection
• CVE-2026-940161 PoCSourceCodester Drug Recommendation System add_symptom cross site scripting
• CVE-2026-940282 PoCsmealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
• CVE-2026-940301 PoCSerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflow
• CVE-2026-940311 PoC0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection
• CVE-2026-940321 PoCitsourcecode Leave Management System index.php sql injection
• CVE-2026-940331 PoCSourceCodester Drug Recommendation System User Management add_user cross site scripting
• CVE-2026-940341 PoCSourceCodester Drug Recommendation System Password Change change_password cross site scripting
• CVE-2026-940351 PoCSourceCodester Drug Recommendation System index.php cross site scripting
• CVE-2026-940362 PoCsD-Link DIR-X1860/DIR-X1860Z routerd ubus access control
• CVE-2026-940371 PoC00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal
• CVE-2026-940381 PoCNonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
• CVE-2026-940391 PoCvas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
• CVE-2026-940401 PoCvas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
• CVE-2026-940411 PoCAdithyaYelloju Restaurant-Management-System add_menu.php sql injection
• CVE-2026-940421 PoCAdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection
• CVE-2026-940441 PoC03-lovepreetSingh MCP route.ts create_file path traversal
• CVE-2026-940451 PoCnewbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
• CVE-2026-940461 PoC0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal
• CVE-2026-940471 PoCsamanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management
• CVE-2026-940481 PoCCodeAstro QR Code Attendance Management System UserController.php save privileges management
• CVE-2026-940491 PoC06ketan slideshot renderer.ts render_slides path traversal
• CVE-2026-940511 PoC0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery
• CVE-2026-940891 PoCD-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
• CVE-2026-940911 PoCpiskvorky gensim Model Loader utils.py load deserialization
• CVE-2026-940921 PoCdmlc dgl utils.py _read_torch_data deserialization
• CVE-2026-940941 PoCOpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
• CVE-2026-940952 PoCsNetcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
• CVE-2026-940961 PoCNetcore NBR200V2 LAN IP Configuration network_tools command injection
• CVE-2026-940971 PoCNetcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
• CVE-2026-940981 PoCNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
• CVE-2026-940991 PoCNetcore NBR200V2 Backup Restore restore.cgi command injection
• CVE-2026-941001 PoCNetcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
• CVE-2026-941011 PoCNetcore NBR200V2 routerd vlan_load_form_uci buffer overflow
• CVE-2026-941021 PoCWuzhiCMS Login index.php redirect
• CVE-2026-941031 PoCRooCMS Frontend Rendering site_pagePHP.php eval code injection
• CVE-2026-941091 PoCopenEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
• CVE-2026-941101 PoCQCMS Content Detail Controllers.php self_Tmp sql injection
• CVE-2026-941272 PoCsKEVBIG-IP APM OAuth vulnerability
• CVE-2026-941281 PoCBioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
• CVE-2026-941291 PoCBioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
• CVE-2026-941301 PoCJoomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3
• CVE-2026-941321 PoCJoomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension <…
• CVE-2026-941341 PoCApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
• CVE-2026-941381 PoCChengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection
• CVE-2026-941391 PoCChengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection
• CVE-2026-941431 PoCdrogonframework drogon ORM Mapper Mapper.h orderBy sql injection
• CVE-2026-941441 PoCdrogonframework drogon ORM Criteria.cc makeCriteria sql injection
• CVE-2026-941451 PoCxuxueli xxl-job Task Management JobInfoController.java cross site scripting
• CVE-2026-941491 PoCOmega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
• CVE-2026-941501 PoCOmega Solution HRM OS SVG File Upload view cross site scripting
• CVE-2026-941511 PoCOmega Solution HRM OS Role Permission API permission missing authentication
• CVE-2026-941521 PoCOmega Solution FBP Fulfillment by People User Profile API user authorization
• CVE-2026-942101 PoCHyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
• CVE-2026-942111 PoCHyve5 Leantime Project Dashboard show.blade.php cross site scripting
• CVE-2026-942141 PoCST Engineering iDirect iDX/Evo iDX Location Header redirect
• CVE-2026-942161 PoCST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting
• CVE-2026-942351 PoCSimple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
• CVE-2026-942381 PoCLoco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter
• CVE-2026-942391 PoCLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration
• CVE-2026-942441 PoCWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
• CVE-2026-942451 PoCWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
• CVE-2026-942461 PoCWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
• CVE-2026-942541 PoCSellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter
• CVE-2026-942561 PoCSMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
• CVE-2026-942571 PoCSMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
• CVE-2026-942581 PoCSMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions
• CVE-2026-942601 PoCSifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
• CVE-2026-942611 PoCSifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
• CVE-2026-942701 PoCDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
• CVE-2026-942711 PoCDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
• CVE-2026-942741 PoCYayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
• CVE-2026-942751 PoCTrack Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
• CVE-2026-942781 PoCFile Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
• CVE-2026-942971 PoCMedia Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
• CVE-2026-942981 PoCBuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
• CVE-2026-942991 PoCelegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
• CVE-2026-943601 PoCPaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks
• CVE-2026-944111 PoCjshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
• CVE-2026-944121 PoCjshERP through 3.6 Authorization Bypass via resetPwd
• CVE-2026-944131 PoCjshERP through 3.6 Password Hash Disclosure via /user/info
• CVE-2026-944141 PoCjshERP through 3.6 Missing Authorization via updateBtnStr
• CVE-2026-944261 PoCxuxueli xxl-job insert cross site scripting
• CVE-2026-944881 PoCTelegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in…
• CVE-2026-944921 PoCYonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
• CVE-2026-944931 PoCGigatech PDV5701 WebSocket Service index.html missing authentication
• CVE-2026-944941 PoCjshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
• CVE-2026-944951 PoCjshERP through 3.6 Missing Authorization via systemConfig
• CVE-2026-944961 PoCjshERP through 3.6 Privilege Escalation via Role Management
• CVE-2026-944971 PoCjshERP through 3.6 Unauthorized Access via by-id Endpoints
• CVE-2026-945011 PoCjshERP through 3.6 Privilege Escalation via userBusiness CRUD
• CVE-2026-945031 PoCWordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
• CVE-2026-945321 PoClamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
• CVE-2026-945331 PoClamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
• CVE-2026-945341 PoClamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
• CVE-2026-945351 PoClamp-cloud through 5.10.0 Unauthorized Notification Deletion
• CVE-2026-945361 PoClamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
• CVE-2026-945401 PoCDesktopSMS 1.11.0 Unauthorized Access via Local Service
• CVE-2026-945411 PoCWPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
• CVE-2026-945454 PoCsSatori-generated SVG has improper escaping
• CVE-2026-946091 PoCauthentik: Privilege Escalation to Superuser via Group Hierarchy