From 66a8c7d36bf99668018d89d8b573ba7b0551aeaf Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Mon, 31 Aug 2026 22:09:53 +0000 Subject: [PATCH] Trending CVEs update 2026-08-31 22:09 :robot: --- README.md | 56 +++++++++++++++++++++++++-------------------------- trending.json | 10 ++++----- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index bcd01bd0275..fdf64761102 100644 --- a/README.md +++ b/README.md @@ -7,26 +7,26 @@ | Stars | Updated | Name | Description | | --- | --- | --- | --- | -| 79⭐ | 5 days ago | [CVE-2026-75604-poc](https://github.com/rafabd1/CVE-2026-75604-poc) | CVE-2026-75604 Next.js Windows RCE poc | -| 152⭐ | 9 days ago | [CVE-2026-62911](https://github.com/hypnguyen1209/CVE-2026-62911) | POC pre-auth RCE on Exchange | -| 53⭐ | 9 days ago | [CVE-2026-64638-PoC-XSS2Shell-](https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-) | XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template | +| 80⭐ | 5 days ago | [CVE-2026-75604-poc](https://github.com/rafabd1/CVE-2026-75604-poc) | CVE-2026-75604 Next.js Windows RCE poc | +| 153⭐ | 9 days ago | [CVE-2026-62911](https://github.com/hypnguyen1209/CVE-2026-62911) | POC pre-auth RCE on Exchange | +| 53⭐ | 10 days ago | [CVE-2026-64638-PoC-XSS2Shell-](https://github.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-) | XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template | | 37⭐ | 10 days ago | [CVE-2026-18963-Exploit](https://github.com/Snizi/CVE-2026-18963-Exploit) | Exploit for KeyCloak CVE-2026-18963 | -| 410⭐ | 10 days ago | [CVE-2026-9830](https://github.com/opaxial/CVE-2026-9830) | CVE-2026-9830 Proof of Concept | +| 406⭐ | 11 days ago | [CVE-2026-9830](https://github.com/opaxial/CVE-2026-9830) | CVE-2026-9830 Proof of Concept | | 531⭐ | 11 days ago | [cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool | | 824⭐ | 11 days ago | [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | -| 60⭐ | 16 days ago | [watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452) | CVE-2026-8452 PreAuth RCE | +| 60⭐ | 17 days ago | [watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452) | CVE-2026-8452 PreAuth RCE | | 24⭐ | 18 days ago | [CVE-2026-66804-CrossDevice-Service-EoP](https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP) | CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM | -| 33⭐ | 18 days ago | [CVE-2026-68138](https://github.com/aramosf/CVE-2026-68138) | CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC | +| 33⭐ | 19 days ago | [CVE-2026-68138](https://github.com/aramosf/CVE-2026-68138) | CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC | | 19⭐ | 24 days ago | [CVE-2026-63077](https://github.com/sfewer-r7/CVE-2026-63077) | Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077) | | 58⭐ | 25 days ago | [CVE-2026-55040](https://github.com/sfewer-r7/CVE-2026-55040) | Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040) | -| 53⭐ | 27 days ago | [CVE-2026-64560-Analysis](https://github.com/villager1314/CVE-2026-64560-Analysis) | | +| 53⭐ | 28 days ago | [CVE-2026-64560-Analysis](https://github.com/villager1314/CVE-2026-64560-Analysis) | | | 17⭐ | 28 days ago | [CVE-2026-60004-POC](https://github.com/imbas007/CVE-2026-60004-POC) | CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8) | -| 80⭐ | 32 days ago | [CVE-2026-43499-Poc-Analysis](https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis) | Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only. | +| 81⭐ | 32 days ago | [CVE-2026-43499-Poc-Analysis](https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis) | Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only. | | 23⭐ | 32 days ago | [CVE-2026-66066-POC](https://github.com/Zer0SumGam3/CVE-2026-66066-POC) | PoC for CVE-2026-66066 in Ruby on Rails | -| 11⭐ | 33 days ago | [CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232) | A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token. | -| 325⭐ | 34 days ago | [CVE-2026-54121](https://github.com/aniqfakhrul/CVE-2026-54121) | Certighost POC | +| 11⭐ | 34 days ago | [CVE-2026-16232](https://github.com/sfewer-r7/CVE-2026-16232) | A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token. | +| 325⭐ | 35 days ago | [CVE-2026-54121](https://github.com/aniqfakhrul/CVE-2026-54121) | Certighost POC | | 35⭐ | 35 days ago | [CVE-2026-42533](https://github.com/imbas007/CVE-2026-42533) | nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04. | -| 27⭐ | 35 days ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP servers, certificate abuse, PKINIT hash extraction. Features: detect safe check, exploit full multi-threaded. 🛡️ CVSS 8.8 High - Use Ethically, Stay Legal. 🔒 | +| 27⭐ | 36 days ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | 👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP servers, certificate abuse, PKINIT hash extraction. Features: detect safe check, exploit full multi-threaded. 🛡️ CVSS 8.8 High - Use Ethically, Stay Legal. 🔒 | ## 2025 @@ -35,22 +35,22 @@ | Stars | Updated | Name | Description | | --- | --- | --- | --- | -| 5⭐ | 4 days ago | [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | | +| 6⭐ | 4 days ago | [vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | | | 4⭐ | 11 days ago | [cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables SELinux, spawns root shell | | 20⭐ | 20 days ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W | -| 6⭐ | 24 days ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | +| 6⭐ | 25 days ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 6⭐ | 29 days ago | [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices | -| 4⭐ | 40 days ago | [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | +| 4⭐ | 41 days ago | [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | | 4⭐ | 43 days ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | -| 5⭐ | 44 days ago | [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | +| 5⭐ | 45 days ago | [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 54 days ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls. | -| 4⭐ | 59 days ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M (signed XML) file decoding function. | -| 3⭐ | 59 days ago | [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | +| 4⭐ | 60 days ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M (signed XML) file decoding function. | +| 3⭐ | 60 days ago | [CVE-2025-57819](https://github.com/K3ysTr0K3R/CVE-2025-57819) | CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE) | | 4⭐ | 64 days ago | [CVE-2025-69212-PoC](https://github.com/tohib09/CVE-2025-69212-PoC) | | -| 5⭐ | 66 days ago | [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 | +| 5⭐ | 67 days ago | [CVE-2025-8110](https://github.com/joaquinrrr/CVE-2025-8110) | PoC exploit for CVE-2025-8110 | | 14⭐ | 80 days ago | [vulnerable-nextjs-14-CVE-2025-29927](https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927) | | -| 13⭐ | 85 days ago | [FreePBX-CVE-2025-57819-RCE](https://github.com/0xEhab/FreePBX-CVE-2025-57819-RCE) | | -| 7⭐ | 85 days ago | [CVE-2025-57819-poc](https://github.com/b4sh2/CVE-2025-57819-poc) | CVE-2025-57819 -> rce | +| 13⭐ | 86 days ago | [FreePBX-CVE-2025-57819-RCE](https://github.com/0xEhab/FreePBX-CVE-2025-57819-RCE) | | +| 7⭐ | 86 days ago | [CVE-2025-57819-poc](https://github.com/b4sh2/CVE-2025-57819-poc) | CVE-2025-57819 -> rce | ## 2024 @@ -59,13 +59,13 @@ | Stars | Updated | Name | Description | | --- | --- | --- | --- | -| 16⭐ | 14 days ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | +| 16⭐ | 15 days ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | | 3⭐ | 16 days ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | -| 3⭐ | 32 days ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 — unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport | +| 3⭐ | 33 days ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 — unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport | | 31⭐ | 64 days ago | [CVE-2024-24919-Bulk-Scanner](https://github.com/ifconfig-me/CVE-2024-24919-Bulk-Scanner) | CVE-2024-24919 [Check Point Security Gateway Information Disclosure] | | 3⭐ | 71 days ago | [CVE-2024-36991](https://github.com/0xFZin/CVE-2024-36991) | Exploit for CVE-2024-36991 , written by me, enumerates a handfull of things, not all, cause not needed. | | 7⭐ | 80 days ago | [CVE-2024-27983-nodejs-http2](https://github.com/lirantal/CVE-2024-27983-nodejs-http2) | CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (`server-nossl.js`) based on CVE-2024-27983 which exploits a continuation flood vulnerability in HTTP2 servers. | -| 4⭐ | 85 days ago | [CVE-2024-1065](https://github.com/kuzeyardabulut/CVE-2024-1065) | Page Cache Exploit for CVE-2024-1065 | +| 4⭐ | 86 days ago | [CVE-2024-1065](https://github.com/kuzeyardabulut/CVE-2024-1065) | Page Cache Exploit for CVE-2024-1065 | ## 2023 @@ -75,10 +75,10 @@ | Stars | Updated | Name | Description | | --- | --- | --- | --- | | 3⭐ | 35 days ago | [CVE-2023-52076-PoC](https://github.com/Groppoxx/CVE-2023-52076-PoC) | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only. | -| 5⭐ | 39 days ago | [CVE-2023-36003](https://github.com/johnnygreeme/CVE-2023-36003) | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. | -| 3⭐ | 54 days ago | [cve-2023-4911-exploit-optimized](https://github.com/jarpex/cve-2023-4911-exploit-optimized) | Pure C exploit for CVE-2023-4911 (Looney Tunables) — x86_64 & aarch64 implementations. Multi-processing brute-forcing, dynamic calibration, integrated ELF parser. | -| 15⭐ | 56 days ago | [CVE-2023-32315-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT) | A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass | -| 6⭐ | 72 days ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | +| 5⭐ | 40 days ago | [CVE-2023-36003](https://github.com/johnnygreeme/CVE-2023-36003) | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. | +| 3⭐ | 55 days ago | [cve-2023-4911-exploit-optimized](https://github.com/jarpex/cve-2023-4911-exploit-optimized) | Pure C exploit for CVE-2023-4911 (Looney Tunables) — x86_64 & aarch64 implementations. Multi-processing brute-forcing, dynamic calibration, integrated ELF parser. | +| 15⭐ | 57 days ago | [CVE-2023-32315-EXPLOIT](https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT) | A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass | +| 6⭐ | 73 days ago | [CVE-2023-6019](https://github.com/joaquinrrr/CVE-2023-6019) | PoC exploit for CVE-2023-6019 - Remote Code Execution via unauthenticated Ray Dashboard Jobs API. | ## 2022 @@ -87,4 +87,4 @@ | Stars | Updated | Name | Description | | --- | --- | --- | --- | -| 6⭐ | 74 days ago | [NimbusPWN-CVE-2022-29799-29800](https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800) | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. | \ No newline at end of file +| 6⭐ | 75 days ago | [NimbusPWN-CVE-2022-29799-29800](https://github.com/joshuavanderpoll/NimbusPWN-CVE-2022-29799-29800) | NimbusPwn (CVE-2022-29799/29800) local privilege escalation PoC in C. | \ No newline at end of file diff --git a/trending.json b/trending.json index 866e7896210..a4aa1af3081 100644 --- a/trending.json +++ b/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 79, + "stars": 80, "name": "CVE-2026-75604-poc", "url": "https://github.com/rafabd1/CVE-2026-75604-poc", "desc": "CVE-2026-75604 Next.js Windows RCE poc", @@ -10,7 +10,7 @@ }, { "year": 2026, - "stars": 152, + "stars": 153, "name": "CVE-2026-62911", "url": "https://github.com/hypnguyen1209/CVE-2026-62911", "desc": "POC pre-auth RCE on Exchange", @@ -37,7 +37,7 @@ }, { "year": 2026, - "stars": 410, + "stars": 406, "name": "CVE-2026-9830", "url": "https://github.com/opaxial/CVE-2026-9830", "desc": "CVE-2026-9830 Proof of Concept", @@ -127,7 +127,7 @@ }, { "year": 2026, - "stars": 80, + "stars": 81, "name": "CVE-2026-43499-Poc-Analysis", "url": "https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis", "desc": "Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.", @@ -181,7 +181,7 @@ }, { "year": 2025, - "stars": 5, + "stars": 6, "name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479", "url": "https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479", "desc": "",