From 1a87c8a630405d10354541f90e1c77efc8f658d5 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Tue, 15 Sep 2026 00:08:47 +0000 Subject: [PATCH] Trending CVEs update 2026-09-15 00:08 :robot: --- README.md | 26 +++++++++------------ index/trending.json | 55 ++++++++++++++++++--------------------------- 2 files changed, 32 insertions(+), 49 deletions(-) diff --git a/README.md b/README.md index 98c5c5dc1ca..75d6aa3110f 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-14%20Sep%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609142307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C661-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C196-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609142307)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-15%20Sep%202026%2000%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609150007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C661-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C196-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609150007)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,22 +12,22 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 12h ago | KEV [CVE-2025-32432](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432) | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.… | +| 0⭐ | 11h ago | KEV [CVE-2026-72898](https://github.com/34zY/CVE-2026-72898) | CVE-2026-72898 exploit | +| 0⭐ | 13h ago | KEV [CVE-2025-32432](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432) | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.… | | 0⭐ | 1d ago | [CVE-2025-24071](https://github.com/BardLaudian/CVE-2025-24071) | Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via… | | 0⭐ | 1d ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | | 2⭐ | 2d ago | [CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.](https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.) | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… | | 0⭐ | 2d ago | [CVE-2026-80099](https://github.com/Wayang1337/CVE-2026-80099) | Newfold plugins (wp-module-data <= 2.9.7) Unauthenticated | +| 0⭐ | 3d ago | KEV [CVE-2026-85706](https://github.com/solivaquaant/CVE-2026-85706) | PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read | | 5⭐ | 3d ago | KEV [CVE-2026-20805-PoC](https://github.com/ZeroDayEvil/CVE-2026-20805-PoC) | 🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information… | -| 0⭐ | 4d ago | KEV [CVE-2026-60137-and-CVE-2026-63030](https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030) | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the… | -| 0⭐ | 4d ago | [CVE-2025-27636-RCE-in-Apache-Camel](https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel) | CVE-2025-27636 PoC written in Python | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 17⭐ | 10h ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | -| 4⭐ | 16h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | -| 4⭐ | 17h ago | KEV [CVE-2026-73570](https://github.com/gabrielunknown/CVE-2026-73570) | Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc) | +| 17⭐ | 11h ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | +| 4⭐ | 17h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | +| 4⭐ | 18h ago | KEV [CVE-2026-73570](https://github.com/gabrielunknown/CVE-2026-73570) | Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc) | | 4⭐ | 2d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | | 4⭐ | 3d ago | [CVE-2026-89013](https://github.com/Faceless0x7/CVE-2026-89013) | CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated… | | 5⭐ | 3d ago | [CVE-2026-89012](https://github.com/Faceless0x7/CVE-2026-89012) | CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution… | @@ -53,7 +53,7 @@ | 7⭐ | 18d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… | | 4⭐ | 25d ago | KEV [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… | | 3⭐ | 27d ago | KEV [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 | -| 20⭐ | 34d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | +| 20⭐ | 35d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | | 6⭐ | 39d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 7⭐ | 43d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 55d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | @@ -62,11 +62,11 @@ | 7⭐ | 68d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 74d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | | 3⭐ | 74d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | -| 4⭐ | 78d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | +| 4⭐ | 79d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | | 5⭐ | 81d ago | KEV [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 |
-2024, 2023, 2022 +2024, 2023 ## Trending in 2024 @@ -87,12 +87,6 @@ | 15⭐ | 71d ago | KEV [CVE-2023-32315-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT) | A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass | | 6⭐ | 87d ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | -## Trending in 2022 - -| Stars | Updated | Repository | Description | -| --- | --- | --- | --- | -| 6⭐ | 89d ago | [NimbusPWN-CVE-2022-29799-29800](https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800) | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. | -
## Data diff --git a/index/trending.json b/index/trending.json index aff9b8796e5..1db7a90dfa3 100644 --- a/index/trending.json +++ b/index/trending.json @@ -473,15 +473,16 @@ "kev": false }, { - "year": 2022, - "stars": 6, - "name": "NimbusPWN-CVE-2022-29799-29800", - "url": "https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800", - "desc": "NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C.", - "pushed": "2026-06-17T20:06:02Z", - "created": "2026-06-17T19:44:47Z", - "cve": "CVE-2022-29799", - "kev": false + "year": 2026, + "stars": 0, + "name": "CVE-2026-72898", + "url": "https://github.com/34zY/CVE-2026-72898", + "desc": "CVE-2026-72898 exploit", + "pushed": "2026-09-14T12:18:22Z", + "created": "2026-09-14T09:54:14Z", + "cve": "CVE-2026-72898", + "kev": true, + "landed": true }, { "year": 2025, @@ -543,6 +544,18 @@ "kev": false, "landed": true }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-85706", + "url": "https://github.com/solivaquaant/CVE-2026-85706", + "desc": "PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read", + "pushed": "2026-09-11T19:47:08Z", + "created": "2026-09-11T15:58:53Z", + "cve": "CVE-2026-85706", + "kev": true, + "landed": true + }, { "year": 2026, "stars": 5, @@ -554,29 +567,5 @@ "cve": "CVE-2026-20805", "kev": true, "landed": true - }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-60137-and-CVE-2026-63030", - "url": "https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030", - "desc": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.", - "pushed": "2026-09-10T07:17:21Z", - "created": "2026-09-10T07:17:21Z", - "cve": "CVE-2026-60137", - "kev": true, - "landed": true - }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-27636-RCE-in-Apache-Camel", - "url": "https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel", - "desc": "CVE-2025-27636 PoC written in Python", - "pushed": "2026-09-10T00:02:34Z", - "created": "2026-09-10T00:00:24Z", - "cve": "CVE-2025-27636", - "kev": false, - "landed": true } ]