CVE Analysis

2026

• CVE-2026-11780: Quiz and Survey Master Stored XSS via question_title 🐈
• CVE-2026-18501: UsersWP Badge Widget Stored XSS via Variable Substitution 🐈
• CVE-2026-66066: KindaRails2Shell Unauthenticated RCE chain
• CVE-2026-15156: Essential Addons for Elementor Global Reading Progress Stored XSS 🐈
• CVE-2026-15155: Essential Addons for Elementor Email Header Injection to Account Takeover 🐈
• CVE-2026-9145: Contact Form Entries Arbitrary File Copy to File Read 🐈
• CVE-2026-55793: Craft CMS Stored XSS to Account Takeover 🐈
• CVE-2026-55790: Craft CMS DOM XSS via GitHub Issue Title 🐈
• HedgeDoc 2 Stored XSS via Slideshow Reveal Background Iframe 🐈
• CVE-2026-53943: Ghost CMS Unauthenticated Cache-Poisoning XSS 🐈
• CVE-2026-9829: Photo Gallery Compact Album Second-Order Blind SQL Injection 🐈
• CVE-2026-52806: Gogs RCE via Argument Injection 🐈
• CVE-2026-20182: Cisco Catalyst SD-WAN Authentication Bypass 🐈
• CVE-2026-4610: ProfileGrid Stored XSS via Private Messages 🐈
• CVE-2026-4609: ProfileGrid Arbitrary Group Joining 🐈
• CVE-2026-4608: ProfileGrid rid SQL Injection 🐈
• CVE-2026-6127: Elementor REST API Stored XSS 🐈
• CVE-2026-3612: Wavlink Command Injection
• CVE-2026-20127: Cisco Catalyst SD-WAN Authentication Bypass
• CVE-2024-4040: CrushFTP Template Injection

2025

• CVE-2025-31344: giflib Heap-based Buffer Overflow
• CVE-2025-24813: Tomcat DefaultServlet Partial PUT
• CVE-2025-54376: Hoverfly WebSocket Auth Bypass

Bold entries are vulnerabilities I discovered and reported 🐈