diff --git a/README.md b/README.md
index e6568d8198d..f071c114ef8 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
-

+

-[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
+[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)

@@ -31,7 +31,7 @@
| 15⭐ | 2d ago |

[CVE-2026-39987](https://github.com/Th3Purge/CVE-2026-39987) | Marimo Pre Authentication RCE |
| 824⭐ | 3d ago |

[CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC |
| 532⭐ | 3d ago |

[cve-2026-41940-PoC](https://github.com/lanicer/cve-2026-41940-PoC) | A cPanel and WHM authentication bypassing tool |
-| 33⭐ | 4d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) |
+| 34⭐ | 4d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) |
| 4⭐ | 5d ago |

[CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via… |
| 11⭐ | 6d ago | [xiaomi15-dada-cve-2026-64560](https://github.com/quyicheng03-boop/xiaomi15-dada-cve-2026-64560) | Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8 |
| 6⭐ | 6d ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… |
@@ -55,7 +55,7 @@
| 4⭐ | 22d ago |

[cve-2025-21479_iqooneo8](https://github.com/Qingizi7/cve-2025-21479_iqooneo8) | Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… |
| 3⭐ | 24d ago |

[vivo_iqoo_neo_9_root_research_on_CVE-2025-21479](https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479) | iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 |
| 19⭐ | 31d ago | [CVE-2025-7771](https://github.com/enessakircolak/CVE-2025-7771) | ThrottleStop.sys Arbitrary Physical Memory R/W |
-| 6⭐ | 35d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 |
+| 6⭐ | 36d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 |
| 7⭐ | 40d ago |

[SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… |
| 4⭐ | 51d ago |

[CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell |
| 4⭐ | 54d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads |
diff --git a/cves/2026/CVE-2026-15253.md b/cves/2026/CVE-2026-15253.md
index 5ca0dd96f02..c0c35b9432f 100644
--- a/cves/2026/CVE-2026-15253.md
+++ b/cves/2026/CVE-2026-15253.md
@@ -14,4 +14,4 @@ The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and esca
- https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/
#### Github
-No PoCs found on GitHub currently.
+- https://github.com/testardou/CVE-2026-15253
diff --git a/cves/2026/CVE-2026-65540.md b/cves/2026/CVE-2026-65540.md
new file mode 100644
index 00000000000..452705bf188
--- /dev/null
+++ b/cves/2026/CVE-2026-65540.md
@@ -0,0 +1,18 @@
+### [CVE-2026-65540](https://www.cve.org/CVERecord?id=CVE-2026-65540)
+**WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability**
+
+
+
+
+
+### Description
+
+Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/testardou/CVE-2026-65540
diff --git a/cves/2026/CVE-2026-78224.md b/cves/2026/CVE-2026-78224.md
new file mode 100644
index 00000000000..df063ecefbd
--- /dev/null
+++ b/cves/2026/CVE-2026-78224.md
@@ -0,0 +1,18 @@
+### [CVE-2026-78224](https://www.cve.org/CVERecord?id=CVE-2026-78224)
+**NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference**
+
+
+
+
+
+### Description
+
+The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/abhinavagarwal07/mirth-connect-security-poc
diff --git a/cves/2026/CVE-2026-82578.md b/cves/2026/CVE-2026-82578.md
new file mode 100644
index 00000000000..3c61de7125d
--- /dev/null
+++ b/cves/2026/CVE-2026-82578.md
@@ -0,0 +1,18 @@
+### [CVE-2026-82578](https://www.cve.org/CVERecord?id=CVE-2026-82578)
+**NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference**
+
+
+
+
+
+### Description
+
+When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/abhinavagarwal07/mirth-connect-security-poc
diff --git a/cves/2026/CVE-2026-82583.md b/cves/2026/CVE-2026-82583.md
new file mode 100644
index 00000000000..578dcbcfa0e
--- /dev/null
+++ b/cves/2026/CVE-2026-82583.md
@@ -0,0 +1,18 @@
+### [CVE-2026-82583](https://www.cve.org/CVERecord?id=CVE-2026-82583)
+**NextGen Healthcare Mirth Connect SQL Injection**
+
+
+
+
+
+### Description
+
+NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/abhinavagarwal07/mirth-connect-security-poc
diff --git a/docs/hero.svg b/docs/hero.svg
index 84fd783b3a0..aafd227b35b 100644
--- a/docs/hero.svg
+++ b/docs/hero.svg
@@ -1,5 +1,5 @@