CVE-2026-40500

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.

Published

Apr 15, 2026

Last Modified

Jul 9, 2026

Status

Rejected

• CVE-2026-40494SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40495FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-40496FreeScout is a free self-hosted help desk and shared mailbox…9.1
• CVE-2026-40497FreeScout is a free self-hosted help desk and shared mailbox…8.1
• CVE-2026-40498FreeScout is a free self-hosted help desk and shared mailbox…9.8
• CVE-2026-40499radare2 prior to version 6.1.4 contains a command injection …7.8
• CVE-2026-40501Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit…8.8
• CVE-2026-40502OpenHarness prior to commit dd1d235 contains a command injec…8.8
• CVE-2026-40503OpenHarness prior to commit dd1d235 contains a path traversa…7.1
• CVE-2026-40504Creolabs Gravity before 0.9.6 contains a heap buffer overflo…9.8
• CVE-2026-40505MuPDF before 1.27 contains an ANSI injection vulnerability i…4.8
• CVE-2026-40506OpenEMR before 8.2.0 contains a path traversal vulnerability…6.5