CVE-2026-81963
Highlighted 7.8 · HighLocal privilege escalation in the Windows Update Stack through link following
How our CVE-2020-0728 variant hunt led from a false CBS lead to a reproducible TrustedInstaller write and SYSTEM elevation.
Research · Advisories
Vulnerability register
This register links our public reports to vendor advisories. Each analysis states the vulnerable path, the conditions for exploitation, the fix and the limits of the available proof.
Vendors and projects
Software covered by our public research. Each logo links to the official website or project repository.
- InternLM · LMDeploy
- Wpmet · ShopEngine
- Microsoft
- ShapedPlugin · Easy Accordion
- LibreNMS
- FreeCAD
- News Kit Addons
- sooperset · MCP Atlassian
- Coolify · Coollabs
- OpenCTI · Filigran
- myCred
- Project MONAI
- aThemes
- BoomDevs · Prime Addons
- DbGate
- Royal Addons
- Dokploy
- Project Jupyter
- Dagster
- Chamilo
- Netgate · pfSense
- KubeAI
- Plunk
- pab1it0 · ADX MCP
- Zep · Graphiti
★Highlighted
Selected analyses
Cases where the exploitation path, a negative control or the patch changes how the issue should be prioritised.
CVE-2026-40864
Highlighted 5.4 · MediumXSRF bypass in JupyterHub through Sec-Fetch-Mode: no-cors requests
JupyterHub 4.1.0 to 5.4.4 skipped its XSRF check for any no-cors request, so a page on another origin could submit Hub forms for a logged-in user.
pfSense-SA-26_03.webgui
Highlighted 5.2 · MediumPfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
RRegister
Every advisory, by publication date.
One row per identifier. Filters combine: a severity, a class and a language, for instance.
Filter the register
Severity
Access
Vulnerability class
Domain
Language and package
28 vulnerabilities shown
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-33625 | LMDeploy | eval() of quant_dtype from the model quantization_configNo authentication | 8.8 High | |
| CVE-2026-85575 | ShopEngine (Elementor WooCommerce Builder) | Stored XSS through the product title heading tag | 6.4 Medium | |
| CVE-2026-68896 | Microsoft Windows | Absolute path traversal in the Windows Search component | 7.8 High | |
| CVE-2026-81963 | Microsoft Windows | Link following in the Windows Update Stack | 7.8 High | |
| CVE-2026-18988 | Easy Accordion | Stored XSS through accordionTitleTag in Easy Accordion | 6.4 Medium | |
| CVE-2026-84191 | LibreNMS | Stored XSS in VRF pages from SNMP dataNo authentication | 6.1 Medium | |
| CVE-2026-34398 | FreeCAD | eval() on .FCStd metadata in the BIM Project ManagerNo authentication | 7.8 High | |
| CVE-2026-34399 | FreeCAD | eval() on the SVG template Scale field in the BIM TechDraw pageNo authentication | 7.8 High | |
| CVE-2026-11390 | News Kit Addons for Elementor | Stored XSS through the Site Logo Title and Single Author Box tags in News Kit Addons | 6.4 Medium | |
| CVE-2026-77262 | MCP Atlassian | Path traversal in confluence_upload_attachmentNo authentication | 8.6 High | |
| CVE-2026-34049 | Coolify | Command injection through MongoDB collection names in database backups | 3.3 Low | |
| CVE-2026-35211 | OpenCTI | Painless script injection through the script filter operator | 6.5 Medium | |
| CVE-2026-8607 | myCred | Stored XSS through the wrap shortcode attribute in myCred | 6.4 Medium | |
| GHSA-wg9g-w2j2-8pgr | MONAI | Unsafe deserialisation in NumpyReaderNo authentication | 7.8 High | |
| CVE-2026-8613 | aThemes Addons for Elementor | Stored XSS through title_tag in aThemes Addons | 6.4 Medium | |
| CVE-2026-8677 | Prime Elementor Addons | Stored XSS through widget HTML tag settings in Prime Elementor Addons | 6.4 Medium | |
| CVE-2026-48017 | DbGate | Code injection in loadReader through functionName | 8.8 High | |
| CVE-2026-6504 | Royal Addons for Elementor | Stored XSS through title_tag in Royal Addons | 6.4 Medium | |
| CVE-2026-45662 | Dokploy | Command injection through registryUrl in docker logout | 8.8 High | |
| CVE-2026-40864 | JupyterHub | XSRF bypass for no-cors requestsNo authentication | 5.4 Medium | |
| CVE-2026-41490 | Dagster | SQL injection through dynamic partition keys in database I/O managers | 8.3 High | |
| CVE-2026-34160 | Chamilo LMS | Unauthenticated SSRF through PENS package and callback URLsNo authentication | 8.6 High | |
| CVE-2026-33715 | Chamilo LMS | Unauthenticated SSRF and mail relay through test_mailerNo authentication | 7.2 High | |
| pfSense-SA-26_03.webgui | Netgate pfSense | Stored XSS in diag_arp.php via an ISC DHCP hostnameNo authentication | 5.2 Medium | |
| CVE-2026-34940 | KubeAI | Command injection through the Model URL in the Ollama startup probe | 8.7 High | |
| CVE-2026-34975 | Plunk | CRLF injection in raw MIME headers | 8.5 High | |
| CVE-2026-33980 | Azure Data Explorer MCP Server | KQL injection through table_name in three metadata tools | 8.3 High | |
| CVE-2026-32247 | Graphiti | Cypher injection through SearchFilters.node_labels | 8.1 High |
No vulnerability matches these filters.
AWrite-ups
The write-ups, from bug to fix.
The analyses separate demonstrated behavior from deployment-dependent impact and explain what the patch changes.
CVE-2026-33625
8.8 · HighCode execution in LMDeploy through eval() of a model’s quant_dtype
A crafted quantization_config in a Hugging Face model made LMDeploy pass quant_dtype to eval(), so loading the model ran the attacker’s Python code.
CVE-2026-85575
6.4 · MediumStored XSS in ShopEngine through the product title heading tag
Our Author-role PoC confirmed stored XSS in ShopEngine 4.8.9, from Elementor storage to execution in a visitor’s browser.
CVE-2026-68896
7.8 · HighLocal privilege escalation in the Windows Search component
Our Windows Search investigation, from the multi-session catalogue gate to a verified SYSTEM delete and a carefully bounded code-execution chain.
CVE-2026-81963
Highlighted 7.8 · HighLocal privilege escalation in the Windows Update Stack through link following
How our CVE-2020-0728 variant hunt led from a false CBS lead to a reproducible TrustedInstaller write and SYSTEM elevation.
CVE-2026-6504 +5
6.4 · MediumSix stored XSS in WordPress plugins: when a tag name becomes an attack vector
Variant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
CVE-2026-84191
6.1 · MediumStored XSS in LibreNMS through SNMP-sourced VRF names and descriptions
LibreNMS rendered VRF names, descriptions and route distinguishers polled over SNMP without escaping, so a rogue device could run script in an operator’s browser.
CVE-2026-34398, CVE-2026-34399
7.8 · HighCode execution through eval() in the FreeCAD BIM workbench
Two eval() calls in the FreeCAD BIM workbench ran Python read from project and drawing templates, so loading a crafted template executed attacker code.
CVE-2026-77262
8.6 · HighArbitrary file read in MCP Atlassian through confluence_upload_attachment
MCP Atlassian opened any file_path passed to its Confluence upload tool, so a caller could read host files and push them out as attachments.
CVE-2026-34049
3.3 · LowCommand injection in Coolify MongoDB backups, an incomplete fix of CVE-2025-66209
The CVE-2025-66209 fix escaped database names in Coolify backups but not MongoDB collection names, which still reached a root shell on the server.
CVE-2026-35211
6.5 · MediumPainless script injection in OpenCTI through the GraphQL script filter operator
Any OpenCTI user with the KNOWLEDGE capability could send raw Painless scripts to Elasticsearch through a public filter operator and exhaust the cluster.
GHSA-wg9g-w2j2-8pgr
7.8 · HighCode execution in MONAI through pickled NumPy files read by NumpyReader
MONAI’s NumpyReader loaded .npy and .npz files with allow_pickle=True, so a poisoned file in a medical imaging dataset ran code on load.
CVE-2026-48017
8.8 · HighRemote code execution in DbGate through the loadReader endpoint
Any authenticated DbGate user could inject JavaScript into a script the server forks, then escape the require = null sandbox with process.binding.
CVE-2026-45662
8.8 · HighCommand injection in Dokploy through the registry URL on docker logout
Dokploy escaped the registry URL for docker login but not for docker logout, so deleting a crafted registry ran shell commands on the host.
CVE-2026-40864
Highlighted 5.4 · MediumXSRF bypass in JupyterHub through Sec-Fetch-Mode: no-cors requests
JupyterHub 4.1.0 to 5.4.4 skipped its XSRF check for any no-cors request, so a page on another origin could submit Hub forms for a logged-in user.
CVE-2026-41490
8.3 · HighSQL injection in Dagster database I/O managers through dynamic partition keys
Dagster’s DuckDB, Snowflake, BigQuery and DeltaLake I/O managers copied dynamic partition keys into SQL, so adding a partition was enough to inject queries.
CVE-2026-33715
7.2 · HighUnauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
CVE-2026-34160
8.6 · HighUnauthenticated SSRF in the Chamilo LMS PENS plugin through package and callback URLs
The PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
pfSense-SA-26_03.webgui
Highlighted 5.2 · MediumPfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
CVE-2026-34940
8.7 · HighOS command injection in KubeAI through the Ollama startup probe
A user allowed to create KubeAI Model resources could run shell commands inside model pods by adding metacharacters to the model URL.
CVE-2026-34975
8.5 · HighEmail header injection in Plunk through raw MIME construction in SESService
Plunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.
CVE-2026-33980
8.3 · HighKQL injection in Azure Data Explorer MCP Server through table_name
Three metadata tools of adx-mcp-server pasted table_name into KQL, letting an agent run arbitrary queries without going through execute_query.
CVE-2026-32247
8.1 · HighCypher injection in Graphiti through search filter node labels
Graphiti pasted search filter node labels into raw Cypher, allowing a caller to bypass group filtering; writes depend on the database route and permissions.
TIndex
Browse by topic.
Vulnerability class
- Code execution 06
- Command injection 03
- Code injection 04
- SQL injection 01
- Query injection (Cypher, KQL, Painless) 03
- SSRF 02
- File read 01
- XSS 04
- CSRF 01
- CRLF injection 01
- Deserialisation 01
- Privilege escalation 02
- Path traversal 01
- Link following 01
- Missing authentication 02
- Incomplete fix 02
- Variant analysis 03
Domain
MMethod
How we disclose.
- 01
Private report
The report goes through the vendor’s channel, usually a private GitHub security advisory, with a minimal proof of concept.
- 02
Fix
We check the fixed version and any limits of the patch before recommending an action.
- 03
Advisory and identifier
The vendor or coordinator publishes an advisory; it may carry a CVE, GHSA or vendor-specific identifier.
- 04
Public write-up
We publish an analysis bounded by the available evidence, withholding private mechanics where necessary.
Vendor, need to reach us about an advisory? Write to security@rootzero.eu