From 124c391c27186fffc33a8a41fa9f0da73423091a Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Thu, 24 Sep 2026 00:09:20 +0000 Subject: [PATCH] Trending CVEs update 2026-09-24 00:09 :robot: --- README.md | 20 ++++++++--------- index/trending.json | 52 ++++++++++++++++++++++----------------------- 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/README.md b/README.md index c75ed36f1b5..2f74d235619 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-23%20Sep%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609232307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C331-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C205-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609232307)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-24%20Sep%202026%2000%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609240007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C331-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C205-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609240007)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,25 +12,25 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 20h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 0⭐ | 5h ago | [CVE-2026-87902](https://github.com/bhideki/CVE-2026-87902) | CVE-2026-87902: PoC for WordPress's critical path traversal | +| 0⭐ | 21h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | | 2⭐ | 1d ago | [CVE-2026-23921](https://github.com/qucklecrabik/CVE-2026-23921) | This repository contains a proof-of-concept (PoC) exploit for CVE-2026-23921 | | 2⭐ | 1d ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… | +| 0⭐ | 2d ago | [CVE-2026-77812](https://github.com/Wh02m1/CVE-2026-77812) | DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID - Proof of Concept for… | | 1⭐ | 2d ago | [CVE-2025-6325_CVE-2025-6327](https://github.com/JohenLastGen-JLG/CVE-2025-6325_CVE-2025-6327) | CVE-2025-6325 + CVE-2025-6327 - King Addons for Elementor <= 51.1.36 DUAL EXPLOIT PoC (Unauthenticated… | | 2⭐ | 2d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. | | 0⭐ | 4d ago | [CVE-2026-84434](https://github.com/murrez/CVE-2026-84434) | PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File… | | 2⭐ | 4d ago | [CVE-2026-89274](https://github.com/murrez/CVE-2026-89274) | PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe… | | 1⭐ | 4d ago | [Flowise-RCE-CVE-2025-59528](https://github.com/arensballiu/Flowise-RCE-CVE-2025-59528) | Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability… | -| 1⭐ | 4d ago | [Flowise-CVE-2025-58434-PasswordReset](https://github.com/arensballiu/Flowise-CVE-2025-58434-PasswordReset) | Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password… | -| 0⭐ | 5d ago | [CVE-2025-20260](https://github.com/keyuraghao/CVE-2025-20260) | First public PoC for CVE-2025-20260 (CVSS 9.8) - a ClamAV PDF-scanning buffer overflow, with core-dump… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 7⭐ | 4h ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress | -| 5⭐ | 4h ago | [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console | +| 8⭐ | 5h ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress | +| 5⭐ | 5h ago | [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console | | 24⭐ | 1d ago | [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… | -| 19⭐ | 1d ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | +| 21⭐ | 1d ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 8⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | | 22⭐ | 2d ago | [CVE-2026-43786](https://github.com/Malwation/CVE-2026-43786) | Proof of concept for CVE-2026-43786, a local privilege escalation vulnerability in macOS CoreServices that… | @@ -53,11 +53,11 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | | 7⭐ | 6d ago | KEV [CVE-2025-32432-exploit-by-P34NUT](https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT) | Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail | -| 3⭐ | 26d ago | KEV [CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 3⭐ | 27d ago | KEV [CVE-2025-3248-Langflow-RCE](https://github.com/hideki233/CVE-2025-3248-Langflow-RCE) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | | 7⭐ | 27d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 6⭐ | 34d ago | KEV [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… | | 3⭐ | 36d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 | -| 20⭐ | 43d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | +| 20⭐ | 44d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | | 6⭐ | 48d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 7⭐ | 52d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 64d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | @@ -67,7 +67,7 @@ | 7⭐ | 77d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 83d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | | 3⭐ | 83d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | -| 4⭐ | 87d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | +| 4⭐ | 88d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… |
2024, 2023 diff --git a/index/trending.json b/index/trending.json index 0868be767fd..e0db8565ad1 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 7, + "stars": 8, "name": "CVE-2026-87902", "url": "https://github.com/vulpecuna/CVE-2026-87902", "desc": "Unauthenticated RCE on Wordpress", @@ -34,7 +34,7 @@ }, { "year": 2026, - "stars": 19, + "stars": 21, "name": "cve-2026-87902-poc", "url": "https://github.com/ressl/cve-2026-87902-poc", "desc": "PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab", @@ -472,6 +472,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-87902", + "url": "https://github.com/bhideki/CVE-2026-87902", + "desc": "CVE-2026-87902: PoC for WordPress's critical path traversal", + "pushed": "2026-09-23T18:30:11Z", + "created": "2026-09-23T17:59:41Z", + "cve": "CVE-2026-87902", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 0, @@ -508,6 +520,18 @@ "kev": false, "landed": true }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-77812", + "url": "https://github.com/Wh02m1/CVE-2026-77812", + "desc": "DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID - Proof of Concept for CVE-2026-77812.", + "pushed": "2026-09-21T11:50:49Z", + "created": "2026-09-20T20:33:14Z", + "cve": "CVE-2026-77812", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 1, @@ -567,29 +591,5 @@ "cve": "CVE-2025-59528", "kev": false, "landed": true - }, - { - "year": 2025, - "stars": 1, - "name": "Flowise-CVE-2025-58434-PasswordReset", - "url": "https://github.com/arensballiu/Flowise-CVE-2025-58434-PasswordReset", - "desc": "Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password without prior authentication. Includes a proof-of-concept script and mitigation guidelines.", - "pushed": "2026-09-19T19:41:07Z", - "created": "2026-04-15T12:40:16Z", - "cve": "CVE-2025-58434", - "kev": false, - "landed": true - }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-20260", - "url": "https://github.com/keyuraghao/CVE-2025-20260", - "desc": "First public PoC for CVE-2025-20260 (CVSS 9.8) - a ClamAV PDF-scanning buffer overflow, with core-dump analysis.", - "pushed": "2026-09-18T18:51:39Z", - "created": "2025-11-13T00:24:05Z", - "cve": "CVE-2025-20260", - "kev": false, - "landed": true } ]