From 490b8ed65b61ebf2f0b510d7993243ef98408780 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sun, 13 Sep 2026 20:09:00 +0000 Subject: [PATCH] Trending CVEs update 2026-09-13 20:09 :robot: --- README.md | 20 ++++++++-------- cves/2025/CVE-2025-55182.md | 1 + cves/2026/CVE-2026-85706.md | 1 + index/github.txt | 2 ++ index/trending.json | 46 ++++++++++++++++++------------------- 5 files changed, 37 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index 9f157d6dee2..3f587b88507 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-13%20Sep%202026%2019%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609131907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C653-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C196-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609131907)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-13%20Sep%202026%2020%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609132007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C653-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C196-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609132007)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,21 +12,22 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 36m ago | [CVE-2025-24071](https://github.com/BardLaudian/CVE-2025-24071) | Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via… | -| 0⭐ | 7h ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | -| 0⭐ | 13h ago | [PoC-CVE-2025-24071](https://github.com/DAEMON-404/PoC-CVE-2025-24071) | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized… | +| 0⭐ | 1h ago | [CVE-2025-24071](https://github.com/BardLaudian/CVE-2025-24071) | Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via… | +| 0⭐ | 8h ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | +| 0⭐ | 14h ago | [PoC-CVE-2025-24071](https://github.com/DAEMON-404/PoC-CVE-2025-24071) | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized… | | 2⭐ | 1d ago | [CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.](https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.) | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… | -| 2⭐ | 1d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | | 0⭐ | 1d ago | [CVE-2026-80099](https://github.com/Wayang1337/CVE-2026-80099) | Newfold plugins (wp-module-data <= 2.9.7) Unauthenticated | | 5⭐ | 2d ago | KEV [CVE-2026-20805-PoC](https://github.com/ZeroDayEvil/CVE-2026-20805-PoC) | 🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information… | | 0⭐ | 3d ago | KEV [CVE-2026-60137-and-CVE-2026-63030](https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030) | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the… | | 0⭐ | 3d ago | [CVE-2025-27636-RCE-in-Apache-Camel](https://github.com/AC8999/CVE-2025-27636-RCE-in-Apache-Camel) | CVE-2025-27636 PoC written in Python | | 2⭐ | 4d ago | [CVE-2026-67401](https://github.com/axedos/CVE-2026-67401) | poc in python for CVE-2026-67401 | +| 0⭐ | 4d ago | [CVE-2026-73312](https://github.com/BomboBombone/CVE-2026-73312) | Sanitized XenForo write-up and proof of concept for CVE-2026-73312. | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | +| 3⭐ | 1d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | | 4⭐ | 1d ago | [CVE-2026-89013](https://github.com/Faceless0x7/CVE-2026-89013) | CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated… | | 5⭐ | 1d ago | [CVE-2026-89012](https://github.com/Faceless0x7/CVE-2026-89012) | CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution… | | 5⭐ | 2d ago | KEV [CVE-2026-85706](https://github.com/mhtsec/CVE-2026-85706) | GitLab CE/EE unauthenticated path traversal (CVE-2026-85706) - PoC | @@ -46,7 +47,6 @@ | 4⭐ | 10d ago | [CVE-2026-62735](https://github.com/HackSpeak/CVE-2026-62735) | Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM… | | 3⭐ | 11d ago | [cve-2026-47627](https://github.com/AneKazek/cve-2026-47627) | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path… | | 12⭐ | 11d ago | KEV [CVE-2026-19490](https://github.com/TarPeg007/CVE-2026-19490) | NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause… | -| 4⭐ | 12d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | ## Trending in 2025 @@ -63,7 +63,7 @@ | 5⭐ | 58d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 67d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 72d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | -| 3⭐ | 72d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | +| 3⭐ | 73d ago | KEV [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | | 4⭐ | 77d ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and… | | 5⭐ | 80d ago | KEV [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 | @@ -84,16 +84,16 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | | 3⭐ | 48d ago | [CVE-2023-52076-PoC](https://github.com/Groppoxx/CVE-2023-52076-PoC) | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… | -| 6⭐ | 52d ago | [CVE-2023-36003](https://github.com/johnnygreeme/CVE-2023-36003) | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. | +| 6⭐ | 53d ago | [CVE-2023-36003](https://github.com/johnnygreeme/CVE-2023-36003) | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. | | 3⭐ | 67d ago | KEV [cve-2023-4911-exploit-optimized](https://github.com/jarpex/cve-2023-4911-exploit-optimized) | Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… | | 15⭐ | 70d ago | KEV [CVE-2023-32315-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT) | A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass | -| 6⭐ | 85d ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | +| 6⭐ | 86d ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | ## Trending in 2022 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 6⭐ | 87d ago | [NimbusPWN-CVE-2022-29799-29800](https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800) | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. | +| 6⭐ | 88d ago | [NimbusPWN-CVE-2022-29799-29800](https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800) | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. | diff --git a/cves/2025/CVE-2025-55182.md b/cves/2025/CVE-2025-55182.md index 21ec16835d8..a9397116d89 100644 --- a/cves/2025/CVE-2025-55182.md +++ b/cves/2025/CVE-2025-55182.md @@ -340,6 +340,7 @@ A pre-authentication remote code execution vulnerability exists in React Server - https://github.com/ChrisBarack/cve-2025-55182 - https://github.com/xemoneattacker/POC - https://github.com/r3vpwnx/CVE-2025-55182 +- https://github.com/r00tVen0m/react2shell-exploit #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml diff --git a/cves/2026/CVE-2026-85706.md b/cves/2026/CVE-2026-85706.md index a388bde446a..e693781da49 100644 --- a/cves/2026/CVE-2026-85706.md +++ b/cves/2026/CVE-2026-85706.md @@ -26,3 +26,4 @@ GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 - https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab - https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc - https://github.com/brigadeops32/CVE-2026-85706 +- https://github.com/plur1bu5/gitread diff --git a/index/github.txt b/index/github.txt index a1698b4ce4d..f93ea986b11 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26621,3 +26621,5 @@ CVE-2026-90781 - https://github.com/HarshRajSinghania/CVE-2026-90781-alsa-lib-oo CVE-2026-85706 - https://github.com/brigadeops32/CVE-2026-85706 CVE-2025-24071 - https://github.com/BardLaudian/CVE-2025-24071 CVE-2026-42536 - https://github.com/erberkan/CVE-2026-42536-PoC +CVE-2025-55182 - https://github.com/r00tVen0m/react2shell-exploit +CVE-2026-85706 - https://github.com/plur1bu5/gitread diff --git a/index/trending.json b/index/trending.json index 253d2a4a594..06c43f5ceb4 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,4 +1,15 @@ [ + { + "year": 2026, + "stars": 3, + "name": "CVE-2026-78006-POC", + "url": "https://github.com/DeadExpl0it/CVE-2026-78006-POC", + "desc": "POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution", + "pushed": "2026-09-12T11:40:55Z", + "created": "2026-09-12T11:19:47Z", + "cve": "CVE-2026-78006", + "kev": false + }, { "year": 2026, "stars": 4, @@ -208,17 +219,6 @@ "cve": "CVE-2026-19490", "kev": true }, - { - "year": 2026, - "stars": 4, - "name": "CVE-2026-18963", - "url": "https://github.com/EQSTLab/CVE-2026-18963", - "desc": "Keycloak reset-credentials flow bypass", - "pushed": "2026-09-01T10:47:41Z", - "created": "2026-09-01T09:08:39Z", - "cve": "CVE-2026-18963", - "kev": false - }, { "year": 2025, "stars": 7, @@ -531,18 +531,6 @@ "kev": false, "landed": true }, - { - "year": 2026, - "stars": 2, - "name": "CVE-2026-78006-POC", - "url": "https://github.com/DeadExpl0it/CVE-2026-78006-POC", - "desc": "POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution", - "pushed": "2026-09-12T11:40:55Z", - "created": "2026-09-12T11:19:47Z", - "cve": "CVE-2026-78006", - "kev": false, - "landed": true - }, { "year": 2026, "stars": 0, @@ -602,5 +590,17 @@ "cve": "CVE-2026-67401", "kev": false, "landed": true + }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-73312", + "url": "https://github.com/BomboBombone/CVE-2026-73312", + "desc": "Sanitized XenForo write-up and proof of concept for CVE-2026-73312.", + "pushed": "2026-09-08T23:52:54Z", + "created": "2026-09-08T16:35:14Z", + "cve": "CVE-2026-73312", + "kev": false, + "landed": true } ]