From 821a197e3347f52b52873631c19b2e066b31f00f Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Mon, 5 Oct 2026 23:10:06 +0000 Subject: [PATCH] Trending CVEs update 2026-10-05 23:10 :robot: --- README.md | 12 ++++++------ cves/2026/CVE-2026-21096.md | 17 +++++++++++++++++ docs/hero.svg | 6 +++--- docs/social-card.svg | 4 ++-- docs/stats.json | 4 ++-- index/github.txt | 1 + index/trending.json | 2 +- 7 files changed, 32 insertions(+), 14 deletions(-) create mode 100644 cves/2026/CVE-2026-21096.md diff --git a/README.md b/README.md index d700dd2b232..352b9b86255 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-05%20Oct%202026%2022%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610052207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C019-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610052207)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-05%20Oct%202026%2023%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610052307)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C020-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610052307)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,10 +12,10 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 1h ago | [CVE-2025-14659-DIR-860L](https://github.com/PeterLinccl/CVE-2025-14659-DIR-860L) | A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown… | -| 0⭐ | 10h ago | [CVE-2025-54769](https://github.com/tunahantekeoglu/CVE-2025-54769) | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded… | +| 0⭐ | 2h ago | [CVE-2025-14659-DIR-860L](https://github.com/PeterLinccl/CVE-2025-14659-DIR-860L) | A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown… | +| 0⭐ | 11h ago | [CVE-2025-54769](https://github.com/tunahantekeoglu/CVE-2025-54769) | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded… | | 0⭐ | 1d ago | KEV [React2Shell_CVE-2025-55182](https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182) | A Proof-of-Concept implementation for CVE-2025-55182, a critical unauthenticated Remote Code Execution… | -| 0⭐ | 1d ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | +| 0⭐ | 2d ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | | 0⭐ | 2d ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | | 0⭐ | 3d ago | [CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE](https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE) | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… | | 0⭐ | 4d ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | @@ -28,7 +28,7 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | | 7⭐ | 2d ago | [cve-2026-103956-loom-unauth](https://github.com/abraxas/cve-2026-103956-loom-unauth) | CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is… | -| 230⭐ | 2d ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | +| 231⭐ | 2d ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | | 825⭐ | 2d ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 3d ago | [CVE-2026-40281-exploit](https://github.com/MRdark-ops/CVE-2026-40281-exploit) | Gotenberg 8.30.1 unauthenticated RCE exploit | | 4⭐ | 3d ago | [CVE-2026-100520-laranode-path-traversal](https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal) | Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup. | diff --git a/cves/2026/CVE-2026-21096.md b/cves/2026/CVE-2026-21096.md new file mode 100644 index 00000000000..cad5735d0e9 --- /dev/null +++ b/cves/2026/CVE-2026-21096.md @@ -0,0 +1,17 @@ +### [CVE-2026-21096](https://www.cve.org/CVERecord?id=CVE-2026-21096) +![](https://img.shields.io/static/v1?label=Vendor&message=Samsung%20Mobile&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Samsung%20Mobile%20Devices&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/Xen0nize/CVE-2026-21096 diff --git a/docs/hero.svg b/docs/hero.svg index 9ef75650e65..cf9aae4ef94 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 84,020 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 173,335 + fill="#e6edf3" letter-spacing="-0.5">173,336 CVES INDEXED84,019 + fill="#2f81f7" letter-spacing="-0.5">84,020 WITH POCS1,221 diff --git a/docs/social-card.svg b/docs/social-card.svg index 6581a7ad13e..40dd258ab42 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 173,335 + fill="#e6edf3" letter-spacing="-0.5">173,336 CVES INDEXED84,019 + fill="#2f81f7" letter-spacing="-0.5">84,020 WITH POCS1,221 diff --git a/docs/stats.json b/docs/stats.json index 4593f43443e..ea8caa5f6f7 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1221, - "total_cves": 173335, - "with_pocs": 84019 + "total_cves": 173336, + "with_pocs": 84020 } diff --git a/index/github.txt b/index/github.txt index be03fba9b47..0ce8f107211 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27190,3 +27190,4 @@ CVE-2026-39987 - https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-39987-Mar CVE-2026-43499 - https://github.com/a23bc/ALI-AN00-cve-2026-43499 CVE-2026-16444 - https://github.com/jamir0quai/CVE-2026-16444 CVE-2025-14659 - https://github.com/PeterLinccl/CVE-2025-14659-DIR-860L +CVE-2026-21096 - https://github.com/Xen0nize/CVE-2026-21096 diff --git a/index/trending.json b/index/trending.json index bde49aca6fa..b6b2b23db62 100644 --- a/index/trending.json +++ b/index/trending.json @@ -12,7 +12,7 @@ }, { "year": 2026, - "stars": 230, + "stars": 231, "name": "cve-2026-41940-PoC", "url": "https://github.com/yasouxken/cve-2026-41940-PoC", "desc": "A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header - no credentials required.",