admin/cve
1
0 Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Trending CVEs update 2026-10-02 09:09 🤖

Browse Source
This commit is contained in:
CVE-BOT committed 2026-10-02 09:09:35 +00:00
1 parent 27974ff367
commit 7236112dad
8 files changed
+69 -12
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+5 -5
View File
@@ -1,8 +1,8 @@
<div align="center">
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=173234-83929-1219" alt="PoC Index" width="100%"></a>
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=173237-83932-1219" alt="PoC Index" width="100%"></a>
[![last sync](https://img.shields.io/badge/last%20sync-02%20Oct%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610020807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C929-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610020807)](https://github.com/0xMarcio/pocindex/stargazers)
[![last sync](https://img.shields.io/badge/last%20sync-02%20Oct%202026%2009%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610020907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C932-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610020907)](https://github.com/0xMarcio/pocindex/stargazers)
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
@@ -12,8 +12,8 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
| 0⭐ | 13h ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 |
| 0⭐ | 22h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
| 0⭐ | 14h ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 |
| 0⭐ | 23h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
| 1⭐ | 1d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell |
| 0⭐ | 1d ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
| 1⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
@@ -46,7 +46,7 @@
| 3⭐ | 4d ago | [CVE-2026-48842](https://github.com/4minx/CVE-2026-48842) | CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi |
| 10⭐ | 4d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
| 10⭐ | 4d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
| 4⭐ | 4d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. |
| 4⭐ | 5d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. |
## Trending in 2025
cves/2026/CVE-2026-100520.md
+18
View File
@@ -0,0 +1,18 @@
### [CVE-2026-100520](https://www.cve.org/CVERecord?id=CVE-2026-100520)
**Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint**
![](https://img.shields.io/static/v1?label=Vendor&message=crivion&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Laranode&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)
### Description
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
### POC
#### Reference
No PoCs from references.
#### Github
- https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal
cves/2026/CVE-2026-104051.md
+18
View File
@@ -0,0 +1,18 @@
### [CVE-2026-104051](https://www.cve.org/CVERecord?id=CVE-2026-104051)
**PictShare < 3.7.1 Sensitive Information Disclosure via info API**
![](https://img.shields.io/static/v1?label=Vendor&message=HaschekSolutions&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=pictshare&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.0.0&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficiently%20Protected%20Credentials&color=brightgreen)
### Description
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the delete_code via the info API and then invoke the delete API to permanently delete arbitrary files, while also exposing uploader IP, User Agent, remote port, and SHA-1 hash, resulting in loss of content integrity, availability, and uploader privacy.
### POC
#### Reference
No PoCs from references.
#### Github
- https://github.com/wvllxe/CVE-2026-104051-pictshare-info-disclosure
cves/2026/CVE-2026-104356.md
+18
View File
@@ -0,0 +1,18 @@
### [CVE-2026-104356](https://www.cve.org/CVERecord?id=CVE-2026-104356)
**PictShare < 3.7.1 Predictable Delete Code via rand()**
![](https://img.shields.io/static/v1?label=Vendor&message=HaschekSolutions&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=pictshare&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.0.0&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Cryptographically%20Weak%20Pseudo-Random%20Number%20Generator%20%28PRNG%29&color=brightgreen)
### Description
PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.
### POC
#### Reference
No PoCs from references.
#### Github
- https://github.com/wvllxe/CVE-2026-104356-pictshare-weak-delete-code
docs/hero.svg
+3 -3
View File
@@ -1,5 +1,5 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="180" viewBox="0 0 1200 180"
role="img" aria-label="PoC Index, 83,929 CVEs with public proof-of-concept exploits">
role="img" aria-label="PoC Index, 83,932 CVEs with public proof-of-concept exploits">
<clipPath id="card"><rect x="1" y="1" width="1198" height="178" rx="12"/></clipPath>
<rect x="0.5" y="0.5" width="1199" height="179" rx="12" fill="#0d1117" stroke="#30363d"/>
<g clip-path="url(#card)" opacity="0.6"><g>
@@ -19,10 +19,10 @@
<text x="56" y="132" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="15" fill="#2f81f7">pocindex.io</text>
<text x="620" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#e6edf3" letter-spacing="-0.5">173,234</text>
fill="#e6edf3" letter-spacing="-0.5">173,237</text>
<text x="620" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="840" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#2f81f7" letter-spacing="-0.5">83,929</text>
fill="#2f81f7" letter-spacing="-0.5">83,932</text>
<text x="840" y="117" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="12"
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="1010" y="96" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="34" font-weight="700"
fill="#f85149" letter-spacing="-0.5">1,219</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 2.6 KiB

After

Width:  |  Height:  |  Size: 2.6 KiB

docs/social-card.svg
+2 -2
View File
@@ -20,10 +20,10 @@
<rect x="96" y="344" width="1088" height="1" fill="#30363d"/>
<text x="96" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#e6edf3" letter-spacing="-0.5">173,234</text>
fill="#e6edf3" letter-spacing="-0.5">173,237</text>
<text x="96" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
fill="#6e7681" letter-spacing="1.6">CVES INDEXED</text><text x="500" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#2f81f7" letter-spacing="-0.5">83,929</text>
fill="#2f81f7" letter-spacing="-0.5">83,932</text>
<text x="500" y="459" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="16"
fill="#6e7681" letter-spacing="1.6">WITH POCS</text><text x="880" y="430" font-family="ui-monospace,SFMono-Regular,Menlo,Consolas,monospace" font-size="46" font-weight="700"
fill="#f85149" letter-spacing="-0.5">1,219</text>
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 2.7 KiB

After

Width:  |  Height:  |  Size: 2.7 KiB

docs/stats.json
+2 -2
View File
@@ -1,5 +1,5 @@
{
"kev": 1219,
"total_cves": 173234,
"with_pocs": 83929
"total_cves": 173237,
"with_pocs": 83932
}
index/github.txt
+3
View File
@@ -27104,3 +27104,6 @@ CVE-2026-14378 - https://github.com/murrez/CVE-2026-14378
CVE-2026-19660 - https://github.com/murrez/CVE-2026-19660
CVE-2017-9841 - https://github.com/CheLover86/CVE-2017-9841
CVE-2026-64560 - https://github.com/Meniben/redmi14c-pond-cve-2026-64560
CVE-2026-100520 - https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal
CVE-2026-104051 - https://github.com/wvllxe/CVE-2026-104051-pictshare-info-disclosure
CVE-2026-104356 - https://github.com/wvllxe/CVE-2026-104356-pictshare-weak-delete-code