CVE-2026-40500

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.

Published

Apr 15, 2026

Last Modified

Jul 9, 2026

Status

Rejected

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40494SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40495FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-40496FreeScout is a free self-hosted help desk and shared mailbox…9.1
• CVE-2026-40497FreeScout is a free self-hosted help desk and shared mailbox…8.1
• CVE-2026-40498FreeScout is a free self-hosted help desk and shared mailbox…9.8
• CVE-2026-40499radare2 prior to version 6.1.4 contains a command injection …7.8
• CVE-2026-40501Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit…8.8
• CVE-2026-40502OpenHarness prior to commit dd1d235 contains a command injec…8.8
• CVE-2026-40503OpenHarness prior to commit dd1d235 contains a path traversa…7.1
• CVE-2026-40504Creolabs Gravity before 0.9.6 contains a heap buffer overflo…9.8
• CVE-2026-40505MuPDF before 1.27 contains an ANSI injection vulnerability i…4.8
• CVE-2026-4051IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0…7.2