773 PoCs | 119 CISA KEV

tag

Cwe-862

MISP Core `deleteSelection` Broken Access Control — Bulk Deletion of Foreign Event Reports & Sharing Groups (CVE-2026-56423)

CVE-2026-56423 web Patched

CVE-2026-56423webHIGH 8.8Patched2026-07-27Joomla Helix Ultimate Framework — Unauthenticated Arbitrary File Deletion (CVE-2026-57830)

CVE-2026-57830 web Patched

CVE-2026-57830webCRITICAL 9.1Patched2026-07-27XWiki Unauthenticated XAR Import Leading to RCE — CVE-2026-33137

CVE-2026-33137 web Patched

CVE-2026-33137webCRITICAL 9.3Patched2026-07-05User Registration & Membership for WordPress — Unauthenticated Admin Approval Bypass (CVE-2026-6145)

CVE-2026-6145 web Unverified

CVE-2026-6145webMEDIUM 5.3Unverified2026-07-05JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)

CVE-2026-49048 (Advisory ID JOOMCCK-2026-001) web Unpatched

CVE-2026-49048webCRITICAL 8.7Unpatched2026-07-05Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)

CVE-2026-40776 / Patchstack PSID 85de025d71e7 web Patched

CVE-2026-40776 / Patchstack PSID 85de025d71e7webHIGH 7.5Patched2026-07-05Azuriom CMS Broken Access Control — Account Takeover via AzLink Server Token — CVE-2026-54415

CVE-2026-54415 web Patched

CVE-2026-54415webHIGH 3.1Patched2026-07-05AutoGPT Platform Chat Session IDOR / Session Hijack — CVE-2026-30950

CVE-2026-30950 (GHSA-q58p-v9r9-7gqj) web Patched

CVE-2026-30950webHIGH 7.1Patched2026-07-05