From 42ccba04f457c2232fa6f29e6170bdce776bb908 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sat, 26 Sep 2026 13:09:33 +0000 Subject: [PATCH] Trending CVEs update 2026-09-26 13:09 :robot: --- README.md | 16 ++++++++-------- cves/2026/CVE-2026-64560.md | 1 + cves/2026/CVE-2026-93485.md | 1 + index/github.txt | 2 ++ index/trending.json | 24 ++++++++++++------------ 5 files changed, 24 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 7fc22a647b5..4af2241a912 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-26%20Sep%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609261207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C529-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609261207)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-26%20Sep%202026%2013%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609261307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C529-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C211-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609261307)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,22 +12,22 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 1h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | -| 0⭐ | 8h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 2⭐ | 8h ago | KEV [CVE-2026-67279](https://github.com/HackSpeak/CVE-2026-67279) | MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for… | +| 0⭐ | 2h ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | +| 0⭐ | 9h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 2⭐ | 9h ago | KEV [CVE-2026-67279](https://github.com/HackSpeak/CVE-2026-67279) | MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for… | | 0⭐ | 1d ago | [CVE-2025-9974](https://github.com/HORKimhab/CVE-2025-9974) | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows… | | 1⭐ | 2d ago | [CVE-2025-7771](https://github.com/yulisec/CVE-2025-7771) | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write… | | 0⭐ | 2d ago | KEV [CVE-2026-87902](https://github.com/bhideki/CVE-2026-87902) | CVE-2026-87902: PoC for WordPress's critical path traversal | -| 0⭐ | 3d ago | KEV [CVE-2026-87902](https://github.com/zer0dayf/CVE-2026-87902) | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable… | | 2⭐ | 3d ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… | | 1⭐ | 5d ago | [CVE-2026-77812](https://github.com/Wh02m1/CVE-2026-77812) | DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID - Proof of Concept for… | | 1⭐ | 5d ago | [CVE-2025-6325_CVE-2025-6327](https://github.com/JohenLastGen-JLG/CVE-2025-6325_CVE-2025-6327) | CVE-2025-6325 + CVE-2025-6327 - King Addons for Elementor <= 51.1.36 DUAL EXPLOIT PoC (Unauthenticated… | +| 2⭐ | 5d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 4⭐ | 6h ago | [CVE-2026-43682](https://github.com/petermalone/CVE-2026-43682) | CVE-2026-43682: HFS+ B-tree kernel heap overflow in macOS | +| 4⭐ | 7h ago | [CVE-2026-43682](https://github.com/petermalone/CVE-2026-43682) | CVE-2026-43682: HFS+ B-tree kernel heap overflow in macOS | | 9⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | | 4⭐ | 1d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | | 14⭐ | 1d ago | [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) | 🔓 CVE-2026-0073 - Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) / Zero-click TLS type confusion to… | @@ -36,8 +36,8 @@ | 35⭐ | 2d ago | [CVE-2026-84543](https://github.com/petermalone/CVE-2026-84543) | Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability | | 9⭐ | 2d ago | KEV [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress | | 5⭐ | 2d ago | KEV [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console | -| 4⭐ | 2d ago | [CVE-2026-94129](https://github.com/lzty/CVE-2026-94129) | A POC for CVE-2026-94129 | -| 4⭐ | 2d ago | [CVE-2026-94128](https://github.com/lzty/CVE-2026-94128) | POC for CVE-2026-94128 | +| 4⭐ | 3d ago | [CVE-2026-94129](https://github.com/lzty/CVE-2026-94129) | A POC for CVE-2026-94129 | +| 4⭐ | 3d ago | [CVE-2026-94128](https://github.com/lzty/CVE-2026-94128) | POC for CVE-2026-94128 | | 32⭐ | 3d ago | KEV [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… | | 3⭐ | 3d ago | [CVE-2026-23921](https://github.com/qucklecrabik/CVE-2026-23921) | This repository contains a proof-of-concept (PoC) exploit for CVE-2026-23921 | | 31⭐ | 3d ago | KEV [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… | diff --git a/cves/2026/CVE-2026-64560.md b/cves/2026/CVE-2026-64560.md index b782ae466f1..decd89a6f22 100644 --- a/cves/2026/CVE-2026-64560.md +++ b/cves/2026/CVE-2026-64560.md @@ -125,3 +125,4 @@ No PoCs from references. - https://github.com/RMDycz/K80Pro-miro-CVE-2026-64560 - https://github.com/a23bc/op13-cve-2026-64560 - https://github.com/Wangs-official/opace6-cve-2026-64560 +- https://github.com/qingle009/opace6-cve-2026-64560 diff --git a/cves/2026/CVE-2026-93485.md b/cves/2026/CVE-2026-93485.md index e756ffe240c..b4f53e96cea 100644 --- a/cves/2026/CVE-2026-93485.md +++ b/cves/2026/CVE-2026-93485.md @@ -48,6 +48,7 @@ No PoCs from references. #### Github - https://github.com/0xBlackash/CVE-2026-93485 +- https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485 #### Nuclei - https://github.com/topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2026/CVE-2026-93485-wordpress-1984abee-a74c-48d7-874f-c4421243e5e5.yaml diff --git a/index/github.txt b/index/github.txt index aad48f3a658..836f50f3e5f 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26917,3 +26917,5 @@ CVE-2026-64600 - https://github.com/k4ntux/COWSlip CVE-2026-13249 - https://github.com/murrez/CVE-2026-13249 CVE-2026-29053 - https://github.com/K3ysTr0K3R/CVE-2026-29053 CVE-2026-43499 - https://github.com/CKwasd/zenfone9-ghostlock +CVE-2026-64560 - https://github.com/qingle009/opace6-cve-2026-64560 +CVE-2026-93485 - https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485 diff --git a/index/trending.json b/index/trending.json index 804febf4a55..e9b843b2bca 100644 --- a/index/trending.json +++ b/index/trending.json @@ -533,18 +533,6 @@ "kev": true, "landed": true }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-87902", - "url": "https://github.com/zer0dayf/CVE-2026-87902", - "desc": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", - "pushed": "2026-09-23T11:04:46Z", - "created": "2026-09-23T11:03:07Z", - "cve": "CVE-2026-87902", - "kev": true, - "landed": true - }, { "year": 2026, "stars": 2, @@ -580,5 +568,17 @@ "cve": "CVE-2025-6325", "kev": false, "landed": true + }, + { + "year": 2026, + "stars": 2, + "name": "CVE-2026-90817", + "url": "https://github.com/murrez/CVE-2026-90817", + "desc": "Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation.", + "pushed": "2026-09-21T04:06:54Z", + "created": "2026-09-21T04:05:26Z", + "cve": "CVE-2026-90817", + "kev": false, + "landed": true } ]