diff --git a/README.md b/README.md
index 3805ae820e2..28633f6a019 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
-

+

-[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
+[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)

@@ -12,10 +12,10 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
-| 0⭐ | 4m ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell |
-| 0⭐ | 1h ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
-| 1⭐ | 6h ago |

[CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
-| 0⭐ | 10h ago | [cve-2025-30208](https://github.com/Minseo9503/cve-2025-30208) | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… |
+| 0⭐ | 1h ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell |
+| 0⭐ | 2h ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
+| 1⭐ | 7h ago |

[CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
+| 0⭐ | 11h ago | [cve-2025-30208](https://github.com/Minseo9503/cve-2025-30208) | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… |
| 0⭐ | 1d ago |

[CVE-2025-32463](https://github.com/klvlo/CVE-2025-32463) | PoC / Exploit for CVE-2025-32463(sudo LPE) |
| 0⭐ | 1d ago |

[CVE-2025-8088-WinRAR-PoC-3](https://github.com/roof1948576qwd/CVE-2025-8088-WinRAR-PoC-3) | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute… |
| 0⭐ | 1d ago |

[CVE-2025-8088-WinRAR-PoC-2](https://github.com/roof1948576qwd/CVE-2025-8088-WinRAR-PoC-2) | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute… |
@@ -27,7 +27,7 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
-| 3⭐ | 21h ago |

[CVE-2026-87902](https://github.com/tonydelouvre/CVE-2026-87902) | XWP_RCE - CVE-2026-87902 Hacker Console |
+| 3⭐ | 22h ago |

[CVE-2026-87902](https://github.com/tonydelouvre/CVE-2026-87902) | XWP_RCE - CVE-2026-87902 Hacker Console |
| 4⭐ | 1d ago |

[CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via… |
| 29⭐ | 1d ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse,… |
| 7⭐ | 1d ago |

[CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) | CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… |
@@ -41,9 +41,9 @@
| 16⭐ | 2d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass |
| 13⭐ | 2d ago |

[CVE-2026-88772](https://github.com/murrez/CVE-2026-88772) | CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… |
| 29⭐ | 2d ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. |
-| 13⭐ | 2d ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. |
+| 13⭐ | 3d ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. |
| 5⭐ | 3d ago | [opace6-cve-2026-64560](https://github.com/qingle009/opace6-cve-2026-64560) | OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address |
-| 9⭐ | 3d ago |

[CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
+| 10⭐ | 3d ago |

[CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
| 10⭐ | 3d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
| 4⭐ | 3d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. |
| 825⭐ | 4d ago |

[CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC |
diff --git a/cves/2026/CVE-2026-102427.md b/cves/2026/CVE-2026-102427.md
new file mode 100644
index 00000000000..8909d19ed33
--- /dev/null
+++ b/cves/2026/CVE-2026-102427.md
@@ -0,0 +1,18 @@
+### [CVE-2026-102427](https://www.cve.org/CVERecord?id=CVE-2026-102427)
+**Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16**
+
+
+
+
+
+### Description
+
+Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/murrez/CVE-2026-102427
diff --git a/cves/2026/CVE-2026-103437.md b/cves/2026/CVE-2026-103437.md
new file mode 100644
index 00000000000..f7981c84253
--- /dev/null
+++ b/cves/2026/CVE-2026-103437.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103437](https://www.cve.org/CVERecord?id=CVE-2026-103437)
+**ReadingLists imported metadata permits JavaScript URL XSS**
+
+
+
+
+
+
+### Description
+
+Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.
+
+This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103437
diff --git a/cves/2026/CVE-2026-103440.md b/cves/2026/CVE-2026-103440.md
new file mode 100644
index 00000000000..14b57c942e8
--- /dev/null
+++ b/cves/2026/CVE-2026-103440.md
@@ -0,0 +1,22 @@
+### [CVE-2026-103440](https://www.cve.org/CVERecord?id=CVE-2026-103440)
+**pagetriagelist discloses suppressed reviewer usernames**
+
+
+
+
+
+
+
+### Description
+
+Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.
+
+This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103440
diff --git a/cves/2026/CVE-2026-103441.md b/cves/2026/CVE-2026-103441.md
new file mode 100644
index 00000000000..aa0a26ea2b3
--- /dev/null
+++ b/cves/2026/CVE-2026-103441.md
@@ -0,0 +1,22 @@
+### [CVE-2026-103441](https://www.cve.org/CVERecord?id=CVE-2026-103441)
+**Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing**
+
+
+
+
+
+
+
+### Description
+
+Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.
+
+This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103441
diff --git a/cves/2026/CVE-2026-103442.md b/cves/2026/CVE-2026-103442.md
new file mode 100644
index 00000000000..4a69f5fa81a
--- /dev/null
+++ b/cves/2026/CVE-2026-103442.md
@@ -0,0 +1,22 @@
+### [CVE-2026-103442](https://www.cve.org/CVERecord?id=CVE-2026-103442)
+**MergeAccount PHP object injection via session-key substitution**
+
+
+
+
+
+
+
+### Description
+
+External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.
+
+This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103442
diff --git a/cves/2026/CVE-2026-103445.md b/cves/2026/CVE-2026-103445.md
new file mode 100644
index 00000000000..d0f1ef9e05e
--- /dev/null
+++ b/cves/2026/CVE-2026-103445.md
@@ -0,0 +1,22 @@
+### [CVE-2026-103445](https://www.cve.org/CVERecord?id=CVE-2026-103445)
+**Stored XSS through PageForms #autoedit redirect links**
+
+
+
+
+
+
+
+### Description
+
+Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS.
+
+This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103445
diff --git a/cves/2026/CVE-2026-103446.md b/cves/2026/CVE-2026-103446.md
new file mode 100644
index 00000000000..c27ef761ea6
--- /dev/null
+++ b/cves/2026/CVE-2026-103446.md
@@ -0,0 +1,20 @@
+### [CVE-2026-103446](https://www.cve.org/CVERecord?id=CVE-2026-103446)
+**WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments**
+
+
+
+
+
+### Description
+
+Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.
+
+This issue affects MediaWiki WikiLambda extension: 1.46.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BomboBombone/CVE-2026-103446
diff --git a/cves/2026/CVE-2026-12227.md b/cves/2026/CVE-2026-12227.md
index dbb2feee84b..078c25486d8 100644
--- a/cves/2026/CVE-2026-12227.md
+++ b/cves/2026/CVE-2026-12227.md
@@ -17,6 +17,7 @@ No PoCs from references.
#### Github
- https://github.com/murrez/CVE-2026-12227
- https://github.com/be-keb/CVE-2026-12227
+- https://github.com/MRdark-ops/CVE-2026-12227
#### Nuclei
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-12227.yaml
diff --git a/docs/hero.svg b/docs/hero.svg
index 11e5905e0f3..8dadd7e6fac 100644
--- a/docs/hero.svg
+++ b/docs/hero.svg
@@ -1,5 +1,5 @@