Trending CVEs update 2026-09-24 05:09 🤖

2026-10-27 16:51:03 +00:00 · 2026-09-24 05:09:22 +00:00
1 parent fb7e5f89d6
commit 4bf60f9672
@@ -2,7 +2,7 @@

 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=172643-83333-1205" alt="PoC Index" width="100%"></a>

-[![last sync](https://img.shields.io/badge/last%20sync-24%20Sep%202026%2004%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609240407)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C333-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C205-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609240407)](https://github.com/0xMarcio/pocindex/stargazers)
+[![last sync](https://img.shields.io/badge/last%20sync-24%20Sep%202026%2005%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609240507)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C333-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C205-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609240507)](https://github.com/0xMarcio/pocindex/stargazers)

 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>

@@ -12,23 +12,24 @@

 | Stars | Updated | Repository | Description |
 | --- | --- | --- | --- |
-| 0⭐ | 9h ago | [CVE-2026-87902](https://github.com/bhideki/CVE-2026-87902) | CVE-2026-87902: PoC for WordPress's critical path traversal |
+| 0⭐ | 10h ago | [CVE-2026-87902](https://github.com/bhideki/CVE-2026-87902) | CVE-2026-87902: PoC for WordPress's critical path traversal |
 | 0⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… |
 | 2⭐ | 1d ago | [ghostlock-cve-2026-43499](https://github.com/gitchw/ghostlock-cve-2026-43499) | CVE-2026-43499 (GhostLock) - Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting… |
-| 0⭐ | 2d ago | [CVE-2026-77812](https://github.com/Wh02m1/CVE-2026-77812) | DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID - Proof of Concept for… |
 | 1⭐ | 2d ago | [CVE-2025-6325_CVE-2025-6327](https://github.com/JohenLastGen-JLG/CVE-2025-6325_CVE-2025-6327) | CVE-2025-6325 + CVE-2025-6327 - King Addons for Elementor <= 51.1.36 DUAL EXPLOIT PoC (Unauthenticated… |
 | 2⭐ | 3d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. |
 | 0⭐ | 4d ago | [CVE-2026-84434](https://github.com/murrez/CVE-2026-84434) | PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File… |
 | 2⭐ | 4d ago | [CVE-2026-89274](https://github.com/murrez/CVE-2026-89274) | PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe… |
 | 1⭐ | 4d ago | [Flowise-RCE-CVE-2025-59528](https://github.com/arensballiu/Flowise-RCE-CVE-2025-59528) | Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability… |
 | 1⭐ | 4d ago | [Flowise-CVE-2025-58434-PasswordReset](https://github.com/arensballiu/Flowise-CVE-2025-58434-PasswordReset) | Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password… |
+| 0⭐ | 5d ago | [CVE-2025-20260](https://github.com/keyuraghao/CVE-2025-20260) | First public PoC for CVE-2025-20260 (CVSS 9.8) - a ClamAV PDF-scanning buffer overflow, with core-dump… |

 ## Trending in 2026

 | Stars | Updated | Repository | Description |
 | --- | --- | --- | --- |
-| 8⭐ | 9h ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress |
-| 5⭐ | 9h ago | [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console |
+| 3⭐ | 2h ago | [CVE-2026-84543](https://github.com/petermalone/CVE-2026-84543) | Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability |
+| 8⭐ | 10h ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress |
+| 5⭐ | 10h ago | [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console |
 | 25⭐ | 1d ago | [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… |
 | 3⭐ | 1d ago | [CVE-2026-23921](https://github.com/qucklecrabik/CVE-2026-23921) | This repository contains a proof-of-concept (PoC) exploit for CVE-2026-23921 |
 | 26⭐ | 1d ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… |
@@ -45,8 +46,7 @@
 | 3⭐ | 7d ago | [CVE-2026-55781-poc](https://github.com/yzy0okrkv1hngo0r/CVE-2026-55781-poc) | Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field. |
 | 16⭐ | 7d ago | [CVE-2026-83991-writeup-and-poc](https://github.com/karollooool/CVE-2026-83991-writeup-and-poc) | CVE-2026-83991: Windows Cloud Files access-check bypass |
 | 5⭐ | 7d ago | [CVE-2026-12793](https://github.com/murrez/CVE-2026-12793) | CVE-2026-12793 PoC - JetFormBuilder ≤3.6.2 unauth Register User / admin account creation |
-| 4⭐ | 8d ago | [POC-AIOWPM-CVE-2026-19949](https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949) | PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=… |
-| 3⭐ | 8d ago | [CVE-2026-12944](https://github.com/cflowsec/CVE-2026-12944) | Langflow 1.10.0 urllib SSRF POC |
+| 3⭐ | 7d ago | [POC-CVE-2026-49975](https://github.com/naheeju/POC-CVE-2026-49975) | Security research PoC for CVE-2026-49975: HTTP/2 HPACK compression bomb + flow-control hold DoS in Apache… |

 ## Trending in 2025

@@ -170,3 +170,4 @@ No PoCs from references.
 - https://github.com/LiamJ74/Root-My-Galaxy-Payloads
 - https://github.com/MKE84/neo8-ghostlock-adaptation
 - https://github.com/pyyyc/honor-6.12.38-43499-research
+- https://github.com/wonjj6768/Lenovo-TB365FC-GhostLock-CVE-2026-43499
@@ -26834,3 +26834,4 @@ CVE-2026-63030 - https://github.com/fl0ydsec/CVE-2026-63030
 CVE-2026-94504 - https://github.com/cflowsec/cve-2026-94504
 CVE-2026-84543 - https://github.com/petermalone/CVE-2026-84543
 CVE-2026-43499 - https://github.com/pyyyc/honor-6.12.38-43499-research
+CVE-2026-43499 - https://github.com/wonjj6768/Lenovo-TB365FC-GhostLock-CVE-2026-43499
@@ -1,4 +1,15 @@
 [
+ {
+  "year": 2026,
+  "stars": 3,
+  "name": "CVE-2026-84543",
+  "url": "https://github.com/petermalone/CVE-2026-84543",
+  "desc": "Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability",
+  "pushed": "2026-09-24T02:47:40Z",
+  "created": "2026-09-24T00:22:30Z",
+  "cve": "CVE-2026-84543",
+  "kev": false
+ },
 {
  "year": 2026,
  "stars": 8,
@@ -197,26 +208,15 @@
  "cve": "CVE-2026-12793",
  "kev": false
 },
- {
-  "year": 2026,
-  "stars": 4,
-  "name": "POC-AIOWPM-CVE-2026-19949",
-  "url": "https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949",
-  "desc": "PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.",
-  "pushed": "2026-09-15T19:20:24Z",
-  "created": "2026-09-08T09:25:28Z",
-  "cve": "CVE-2026-19949",
-  "kev": false
- },
 {
  "year": 2026,
  "stars": 3,
-  "name": "CVE-2026-12944",
-  "url": "https://github.com/cflowsec/CVE-2026-12944",
-  "desc": "Langflow 1.10.0 urllib SSRF POC",
-  "pushed": "2026-09-15T17:25:47Z",
-  "created": "2026-09-15T17:23:04Z",
-  "cve": "CVE-2026-12944",
+  "name": "POC-CVE-2026-49975",
+  "url": "https://github.com/naheeju/POC-CVE-2026-49975",
+  "desc": "Security research PoC for CVE-2026-49975: HTTP/2 HPACK compression bomb + flow-control hold DoS in Apache mod_http2",
+  "pushed": "2026-09-16T07:28:35Z",
+  "created": "2026-09-16T07:21:14Z",
+  "cve": "CVE-2026-49975",
  "kev": false
 },
 {
@@ -508,18 +508,6 @@
  "kev": false,
  "landed": true
 },
- {
-  "year": 2026,
-  "stars": 0,
-  "name": "CVE-2026-77812",
-  "url": "https://github.com/Wh02m1/CVE-2026-77812",
-  "desc": "DJI Drone Cleartext Bluetooth Transmission of Wi-Fi PSK and Session UUID - Proof of Concept for CVE-2026-77812.",
-  "pushed": "2026-09-21T11:50:49Z",
-  "created": "2026-09-20T20:33:14Z",
-  "cve": "CVE-2026-77812",
-  "kev": false,
-  "landed": true
- },
 {
  "year": 2025,
  "stars": 1,
@@ -591,5 +579,17 @@
  "cve": "CVE-2025-58434",
  "kev": false,
  "landed": true
+ },
+ {
+  "year": 2025,
+  "stars": 0,
+  "name": "CVE-2025-20260",
+  "url": "https://github.com/keyuraghao/CVE-2025-20260",
+  "desc": "First public PoC for CVE-2025-20260 (CVSS 9.8) - a ClamAV PDF-scanning buffer overflow, with core-dump analysis.",
+  "pushed": "2026-09-18T18:51:39Z",
+  "created": "2025-11-13T00:24:05Z",
+  "cve": "CVE-2025-20260",
+  "kev": false,
+  "landed": true
 }
 ]