admin/cve
1
0 Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Trending CVEs update 2026-09-27 23:09 🤖

Browse Source
This commit is contained in:
CVE-BOT committed 2026-09-27 23:09:53 +00:00
1 parent a64c0678d3
commit 1ce08012bc
10 files changed
+58 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+10 -10
View File
@@ -1,8 +1,8 @@
<div align="center">
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172878-83567-1211" alt="PoC Index" width="100%"></a>
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172879-83568-1211" alt="PoC Index" width="100%"></a>
[![last sync](https://img.shields.io/badge/last%20sync-27%20Sep%202026%2022%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609272207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C567-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609272207)](https://github.com/0xMarcio/pocindex/stargazers)
[![last sync](https://img.shields.io/badge/last%20sync-27%20Sep%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609272307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C568-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609272307)](https://github.com/0xMarcio/pocindex/stargazers)
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
@@ -12,23 +12,23 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
| 2⭐ | 1h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… |
| 2⭐ | 11h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) |
| 0⭐ | 12h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… |
| 0⭐ | 15h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… |
| 0⭐ | 20h ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE |
| 0⭐ | 22m ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… |
| 2⭐ | 2h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… |
| 2⭐ | 12h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) |
| 0⭐ | 13h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [Reproduce-CVE-2025-32433](https://github.com/X-Bulow/Reproduce-CVE-2025-32433) | Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3,… |
| 0⭐ | 16h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… |
| 0⭐ | 21h ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE |
| 0⭐ | 1d ago | [CVE-2026-13249](https://github.com/murrez/CVE-2026-13249) | Unauthenticated arbitrary file upload on Honeywell PD45 web admin (firmware F10.19.010040-before… |
| 0⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… |
| 1⭐ | 2d ago | [opace6-cve-2026-64560](https://github.com/Wangs-official/opace6-cve-2026-64560) | 针对 OnePlus Ace6 设备的 cve-2026-64560 复现 |
| 1⭐ | 2d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-59310-POC](https://github.com/ChinaRan0/CVE-2026-59310-POC) | CVE-2026-59310-POC 仅用于自测，请勿用于攻击 |
| 1⭐ | 2d ago | [CVE-2026-14281](https://github.com/murrez/CVE-2026-14281) | Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST… |
## Trending in 2026
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
| 7⭐ | 11h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
| 6⭐ | 12h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
| 7⭐ | 12h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
| 6⭐ | 13h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
| 825⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC |
| 3⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-mikrotik-poc](https://github.com/gagaltotal/CVE-2026-mikrotik-poc) | CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH |
| 10⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 |
cves/2025/CVE-2025-56005.md
+2
View File
@@ -14,3 +14,5 @@ No PoCs from references.
#### Github
- https://github.com/tom025/ply_exploit_rejection
- https://github.com/gdfurr98/ply-cve-2025-56005-lab
- https://github.com/gdfurr98/ply-safepickle
cves/2026/CVE-2026-44011.md
+1
View File
@@ -19,3 +19,4 @@ No PoCs from references.
- https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce
- https://github.com/DENNISDGR/CVE-2026-44011-poc
- https://github.com/Cyberuser-hash/CVE-2026-44011-craft-rce-poc
- https://github.com/khush-613/CVE-2026-44011-poc
cves/2026/CVE-2026-71963.md
+1 -1
View File
@@ -15,4 +15,4 @@ Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote c
- https://www.manifold.security/blog/ai-coding-agents-git-hijack
#### Github
No PoCs found on GitHub currently.
- https://github.com/Boreas37/CVE-2026-71963-PoC
cves/2026/CVE-2026-88008.md
+20
View File
@@ -0,0 +1,20 @@
### [CVE-2026-88008](https://www.cve.org/CVERecord?id=CVE-2026-88008)
**Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization**
![](https://img.shields.io/static/v1?label=Vendor&message=traefik&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.11.26%2C%20%3C%202.11.57&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.2%2C%20%3C%203.7.13&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-444%3A%20Inconsistent%20Interpretation%20of%20HTTP%20Requests%20%28%27HTTP%20Request%2FResponse%20Smuggling%27%29&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
### Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend accepts h2c and returns 101 Switching Protocols, Traefik enters a raw tunnel and no longer applies routers, BasicAuth, ForwardAuth, IPAllowList, RateLimit, access logging, metrics, or tracing to later HTTP/2 requests, allowing an unauthenticated request through an unprotected route to reach protected paths on the same backend. This issue is fixed in 2.11.57 and 3.7.13.
### POC
#### Reference
No PoCs from references.
#### Github
- https://github.com/Boreas37/CVE-2026-88008-PoC
docs/hero.svg
+3 -3
View File
@@ -1,5 +1,5 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
role="img" aria-label="PoC Index, 83,567 CVEs with public proof-of-concept exploits">
role="img" aria-label="PoC Index, 83,568 CVEs with public proof-of-concept exploits">
<clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
<rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
<g clip-path="url(#card)" opacity="0.6"><g>
@@ -19,10 +19,10 @@
<text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>
<text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#e6edf3" letter-spacing="-0.5">172,878</text>
fill="#e6edf3" letter-spacing="-0.5">172,879</text>
<text x="620" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="840" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#2f81f7" letter-spacing="-0.5">83,567</text>
fill="#2f81f7" letter-spacing="-0.5">83,568</text>
<text x="840" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="1010" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#f85149" letter-spacing="-0.5">1,211</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 2.6 KiB

After

Width:  |  Height:  |  Size: 2.6 KiB

docs/social-card.svg
+2 -2
View File
@@ -20,10 +20,10 @@
<rect x="96" y="344" width="1088" height="1" fill="#30363d"/>
<text x="96" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#e6edf3" letter-spacing="-0.5">172,878</text>
fill="#e6edf3" letter-spacing="-0.5">172,879</text>
<text x="96" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="500" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#2f81f7" letter-spacing="-0.5">83,567</text>
fill="#2f81f7" letter-spacing="-0.5">83,568</text>
<text x="500" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="880" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#f85149" letter-spacing="-0.5">1,211</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 2.7 KiB

After

Width:  |  Height:  |  Size: 2.7 KiB

docs/stats.json
+2 -2
View File
@@ -1,5 +1,5 @@
{
"kev": 1211,
"total_cves": 172878,
"with_pocs": 83567
"total_cves": 172879,
"with_pocs": 83568
}
index/github.txt
+5
View File
@@ -26959,3 +26959,8 @@ CVE-2026-44011 - https://github.com/Cyberuser-hash/CVE-2026-44011-craft-rce-poc
CVE-2026-87902 - https://github.com/Maalfer/CVE-2026-87902-exploit
CVE-2026-88772 - https://github.com/murrez/CVE-2026-88772
CVE-2026-34990 - https://github.com/khush-613/CVE-2026-34990-poc
CVE-2025-56005 - https://github.com/gdfurr98/ply-cve-2025-56005-lab
CVE-2025-56005 - https://github.com/gdfurr98/ply-safepickle
CVE-2026-44011 - https://github.com/khush-613/CVE-2026-44011-poc
CVE-2026-71963 - https://github.com/Boreas37/CVE-2026-71963-PoC
CVE-2026-88008 - https://github.com/Boreas37/CVE-2026-88008-PoC
index/trending.json
+12 -12
View File
@@ -461,6 +461,18 @@
"cve": "CVE-2023-32315",
"kev": true
},
{
"year": 2025,
"stars": 0,
"name": "ply-cve-2025-56005-lab",
"url": "https://github.com/gdfurr98/ply-cve-2025-56005-lab",
"desc": "Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the debate about RCE notwithstanding here), and shows that ply-safepickle does block the exploit path.",
"pushed": "2026-09-27T22:47:26Z",
"created": "2026-09-27T22:49:37Z",
"cve": "CVE-2025-56005",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 2,
@@ -568,17 +580,5 @@
"cve": "CVE-2026-59310",
"kev": true,
"landed": true
},
{
"year": 2026,
"stars": 1,
"name": "CVE-2026-14281",
"url": "https://github.com/murrez/CVE-2026-14281",
"desc": "Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit).",
"pushed": "2026-09-25T07:44:05Z",
"created": "2026-09-25T07:43:43Z",
"cve": "CVE-2026-14281",
"kev": false,
"landed": true
}
]