From 7cca587d9836c2461cdf431ec00d52710aa21753 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Fri, 25 Sep 2026 05:09:05 +0000 Subject: [PATCH] Trending CVEs update 2026-09-25 05:09 :robot: --- README.md | 16 ++++++++-------- cves/2025/CVE-2025-9974.md | 2 +- cves/2026/CVE-2026-49881.md | 1 + docs/hero.svg | 4 ++-- docs/social-card.svg | 2 +- docs/stats.json | 2 +- index/github.txt | 2 ++ index/trending.json | 24 ++++++++++++------------ 8 files changed, 28 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 01716049ca6..c954c37390a 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-25%20Sep%202026%2004%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609250407)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C421-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C206-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609250407)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-25%20Sep%202026%2005%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609250507)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C422-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C206-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609250507)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,7 +12,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 1⭐ | 20h ago | [CVE-2025-7771](https://github.com/yulisec/CVE-2025-7771) | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write… | +| 0⭐ | 51m ago | [CVE-2025-9974](https://github.com/HORKimhab/CVE-2025-9974) | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows… | +| 1⭐ | 21h ago | [CVE-2025-7771](https://github.com/yulisec/CVE-2025-7771) | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write… | | 0⭐ | 1d ago | [CVE-2026-87902](https://github.com/bhideki/CVE-2026-87902) | CVE-2026-87902: PoC for WordPress's critical path traversal | | 0⭐ | 1d ago | [CVE-2026-87902](https://github.com/zer0dayf/CVE-2026-87902) | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable… | | 0⭐ | 2d ago | KEV [CVE-2025-39964](https://github.com/suominen/CVE-2025-39964) | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent… | @@ -21,16 +22,15 @@ | 2⭐ | 4d ago | [CVE-2026-90817](https://github.com/murrez/CVE-2026-90817) | Unauth REDCap RCE (CVE-2026-90817) mass check PoC - requires public survey hash for full validation. | | 0⭐ | 5d ago | [CVE-2026-84434](https://github.com/murrez/CVE-2026-84434) | PoC for CVE-2026-84434: unauthenticated arbitrary file upload in Gravity Forms ≤3.1.0.4 via hidden File… | | 2⭐ | 5d ago | [CVE-2026-89274](https://github.com/murrez/CVE-2026-89274) | PoC for CVE-2026-89274: unauthenticated arbitrary shortcode execution in WP Recipe Maker ≤10.8.1 via recipe… | -| 1⭐ | 5d ago | [Flowise-RCE-CVE-2025-59528](https://github.com/arensballiu/Flowise-RCE-CVE-2025-59528) | Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 14⭐ | 4h ago | [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) | 🔓 CVE-2026-0073 - Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) / Zero-click TLS type confusion to… | -| 3⭐ | 8h ago | KEV [watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127](https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127) | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious… | -| 9⭐ | 13h ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | -| 4⭐ | 23h ago | [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | +| 14⭐ | 5h ago | [CVE-2026-0073-PoC-Exploit](https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit) | 🔓 CVE-2026-0073 - Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) / Zero-click TLS type confusion to… | +| 3⭐ | 9h ago | KEV [watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127](https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127) | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious… | +| 9⭐ | 14h ago | [CVE-2026-78306](https://github.com/Wh02m1/CVE-2026-78306) | DJI Drone DUML Command Injection over Bluetooth - Proof of Concept for CVE-2026-78306 | +| 4⭐ | 1d ago | [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… | | 24⭐ | 1d ago | [CVE-2026-84543](https://github.com/petermalone/CVE-2026-84543) | Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability | | 9⭐ | 1d ago | [CVE-2026-87902](https://github.com/vulpecuna/CVE-2026-87902) | Unauthenticated RCE on Wordpress | | 5⭐ | 1d ago | [CVE_2026_87902](https://github.com/oliveiralimajr/CVE_2026_87902) | Exploit pycve_2026_87902_scanner.py /tmp/local.txt --console | diff --git a/cves/2025/CVE-2025-9974.md b/cves/2025/CVE-2025-9974.md index 46d339b5897..38b29e9e935 100644 --- a/cves/2025/CVE-2025-9974.md +++ b/cves/2025/CVE-2025-9974.md @@ -15,4 +15,4 @@ The unified WEBUI application of the ONT/Beacon device contains an input handlin No PoCs from references. #### Github -No PoCs found on GitHub currently. +- https://github.com/HORKimhab/CVE-2025-9974 diff --git a/cves/2026/CVE-2026-49881.md b/cves/2026/CVE-2026-49881.md index ac3b8e51d56..e5dd08eb648 100644 --- a/cves/2026/CVE-2026-49881.md +++ b/cves/2026/CVE-2026-49881.md @@ -15,3 +15,4 @@ No PoCs from references. #### Github - https://github.com/Supersonic/TLPE +- https://github.com/AbelDuan/O3 diff --git a/docs/hero.svg b/docs/hero.svg index 0f3a885bf8d..78828e04b07 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 83,422 CVEs with public proof-of-concept exploits"> @@ -22,7 +22,7 @@ fill="#e6edf3" letter-spacing="-0.5">172,730 CVES INDEXED83,421 + fill="#2f81f7" letter-spacing="-0.5">83,422 WITH POCS1,206 diff --git a/docs/social-card.svg b/docs/social-card.svg index 3f3d05eb5e1..6da358fd05a 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -23,7 +23,7 @@ fill="#e6edf3" letter-spacing="-0.5">172,730 CVES INDEXED83,421 + fill="#2f81f7" letter-spacing="-0.5">83,422 WITH POCS1,206 diff --git a/docs/stats.json b/docs/stats.json index 30e45b8ff63..2e7e7503aeb 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1206, "total_cves": 172730, - "with_pocs": 83421 + "with_pocs": 83422 } diff --git a/index/github.txt b/index/github.txt index 285b615481a..36ada8d6bc6 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26847,3 +26847,5 @@ CVE-2026-72001 - https://github.com/BiiTts/CVE-2026-72001-Pangolin-Cross-Org-Aut CVE-2026-94127 - https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127 CVE-2026-87902 - https://github.com/khellwan/CVE-2026-87902_PoC CVE-2026-43499 - https://github.com/AthBe1337/CVE-2026-43499-poc +CVE-2025-9974 - https://github.com/HORKimhab/CVE-2025-9974 +CVE-2026-49881 - https://github.com/AbelDuan/O3 diff --git a/index/trending.json b/index/trending.json index 9477968c10a..e2f659cee49 100644 --- a/index/trending.json +++ b/index/trending.json @@ -472,6 +472,18 @@ "cve": "CVE-2023-32315", "kev": true }, + { + "year": 2025, + "stars": 0, + "name": "CVE-2025-9974", + "url": "https://github.com/HORKimhab/CVE-2025-9974", + "desc": "The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitrary commands on the underlying ONT/Beacon operating system, potentially impacting the confidentiality, integrity, and availability of the device.", + "pushed": "2026-09-25T04:17:44Z", + "created": "2026-09-25T04:09:16Z", + "cve": "CVE-2025-9974", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 1, @@ -579,17 +591,5 @@ "cve": "CVE-2026-89274", "kev": false, "landed": true - }, - { - "year": 2025, - "stars": 1, - "name": "Flowise-RCE-CVE-2025-59528", - "url": "https://github.com/arensballiu/Flowise-RCE-CVE-2025-59528", - "desc": "Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability in the /api/v1/node-load-method/customMCP endpoint to execute arbitrary system commands via Node.js child_process.execSync(). Includes full PoC script and remediation steps.", - "pushed": "2026-09-19T19:44:25Z", - "created": "2026-04-15T12:47:25Z", - "cve": "CVE-2025-59528", - "kev": false, - "landed": true } ]