From 4effc8a7d9ef7611d6177ff932aa4fd4618341c4 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Mon, 28 Sep 2026 10:09:52 +0000 Subject: [PATCH] Trending CVEs update 2026-09-28 10:09 :robot: --- README.md | 24 ++++++++++++------------ cves/2026/CVE-2026-100721.md | 18 ++++++++++++++++++ cves/2026/CVE-2026-88772.md | 2 ++ docs/hero.svg | 6 +++--- docs/social-card.svg | 4 ++-- docs/stats.json | 4 ++-- index/github.txt | 2 ++ index/trending.json | 4 ++-- 8 files changed, 43 insertions(+), 21 deletions(-) create mode 100644 cves/2026/CVE-2026-100721.md diff --git a/README.md b/README.md index 624a484bb55..d08de0a1791 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2009%3A08%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609280908)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C627-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C214-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609280908)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-28%20Sep%202026%2010%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609281007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C628-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C214-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609281007)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,10 +12,10 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 1⭐ | 4h ago | [HTB-Pterodactyl-RCE-CVE-2025-49132](https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132) | This repo contains RCE exploit for Pterodactyl htb machine | -| 1⭐ | 6h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | -| 0⭐ | 10h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | -| 2⭐ | 22h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | +| 1⭐ | 5h ago | [HTB-Pterodactyl-RCE-CVE-2025-49132](https://github.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132) | This repo contains RCE exploit for Pterodactyl htb machine | +| 1⭐ | 7h ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | +| 0⭐ | 11h ago | [ply-cve-2025-56005-lab](https://github.com/gdfurr98/ply-cve-2025-56005-lab) | Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the… | +| 2⭐ | 23h ago | KEV [CVE-2025-21479-FX5P](https://github.com/diyiqiuye/CVE-2025-21479-FX5P) | Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | | 2⭐ | 1d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. | | 0⭐ | 1d ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | Tracking CVE-2025-39964, the Linux kernel AF_ALG concurrent-write race | | 0⭐ | 1d ago | [POC-CVE-2025-11201](https://github.com/rmhowe425/POC-CVE-2025-11201) | PoC for MLFlow unauth RCE | @@ -27,12 +27,12 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 5⭐ | 7h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | -| 6⭐ | 12h ago | [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | -| 28⭐ | 13h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | -| 13⭐ | 14h ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | -| 7⭐ | 22h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | -| 6⭐ | 23h ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | +| 5⭐ | 8h ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | +| 8⭐ | 13h ago | KEV [CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… | +| 28⭐ | 14h ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. | +| 13⭐ | 15h ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. | +| 7⭐ | 23h ago | KEV [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | +| 6⭐ | 1d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… | | 825⭐ | 1d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 1d ago | KEV [CVE-2026-mikrotik-poc](https://github.com/gagaltotal/CVE-2026-mikrotik-poc) | CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH | | 10⭐ | 1d ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | diff --git a/cves/2026/CVE-2026-100721.md b/cves/2026/CVE-2026-100721.md new file mode 100644 index 00000000000..e60cf661184 --- /dev/null +++ b/cves/2026/CVE-2026-100721.md @@ -0,0 +1,18 @@ +### [CVE-2026-100721](https://www.cve.org/CVERecord?id=CVE-2026-100721) +**vm2 before 3.12.2 Authorization Bypass via Custom Resolver** +![](https://img.shields.io/static/v1?label=Vendor&message=patriksimek&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=vm2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/murrez/CVE-2026-100721 diff --git a/cves/2026/CVE-2026-88772.md b/cves/2026/CVE-2026-88772.md index b74e6142904..b84d7e534c3 100644 --- a/cves/2026/CVE-2026-88772.md +++ b/cves/2026/CVE-2026-88772.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Gateway&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=CISA%20KEV&message=Known%20Exploited&color=red) ### Description @@ -19,3 +20,4 @@ No PoCs from references. #### Github - https://github.com/murrez/CVE-2026-88772 +- https://github.com/FollowerSeize/CVE-2026-88772-POC diff --git a/docs/hero.svg b/docs/hero.svg index 1d41fd1ba18..a8c483ca486 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,628 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,935 + fill="#e6edf3" letter-spacing="-0.5">172,936 CVES INDEXED83,627 + fill="#2f81f7" letter-spacing="-0.5">83,628 WITH POCS1,214 diff --git a/docs/social-card.svg b/docs/social-card.svg index 8b8a5eb0567..d0084f5fc16 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,935 + fill="#e6edf3" letter-spacing="-0.5">172,936 CVES INDEXED83,627 + fill="#2f81f7" letter-spacing="-0.5">83,628 WITH POCS1,214 diff --git a/docs/stats.json b/docs/stats.json index dfc4b96e24b..da87710af5d 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1214, - "total_cves": 172935, - "with_pocs": 83627 + "total_cves": 172936, + "with_pocs": 83628 } diff --git a/index/github.txt b/index/github.txt index 9f61d8b7ad1..af172b8d882 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26987,3 +26987,5 @@ CVE-2026-43284 - https://github.com/coey0814/DirtyFrag-Galaxy CVE-2026-82384 - https://github.com/murrez/CVE-2026-82384 CVE-2026-93958 - https://github.com/murrez/CVE-2026-93958 CVE-2026-6951 - https://github.com/EQSTLab/CVE-2026-6951 +CVE-2026-100721 - https://github.com/murrez/CVE-2026-100721 +CVE-2026-88772 - https://github.com/FollowerSeize/CVE-2026-88772-POC diff --git a/index/trending.json b/index/trending.json index aff230cfed4..5c051b72ba6 100644 --- a/index/trending.json +++ b/index/trending.json @@ -12,14 +12,14 @@ }, { "year": 2026, - "stars": 6, + "stars": 8, "name": "CVE-2026-88772", "url": "https://github.com/murrez/CVE-2026-88772", "desc": "CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772", "pushed": "2026-09-27T20:26:06Z", "created": "2026-09-27T20:24:56Z", "cve": "CVE-2026-88772", - "kev": false + "kev": true }, { "year": 2026,