From 9a70317cd71c1c171718c71ef114efca4b6554ff Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sun, 11 Oct 2026 09:12:12 +0000 Subject: [PATCH] Trending CVEs update 2026-10-11 09:12 :robot: --- README.md | 22 ++++----- index/trending.json | 108 ++++++++++++++++++++++---------------------- 2 files changed, 65 insertions(+), 65 deletions(-) diff --git a/README.md b/README.md index 10a792f33ac..cb207be216e 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-11%20Oct%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610110807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C369-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C230-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610110807)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-11%20Oct%202026%2009%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610110907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C369-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C230-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610110907)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -14,14 +14,14 @@ | Stars | Released | PoC | Description | | --- | --- | --- | --- | -| 0⭐ | 1h ago | KEV [CVE-2025-57819](https://github.com/Wayang1337/CVE-2025-57819) | FreePBX unauthenticated SQLi (endpoint module) | -| 0⭐ | 1h ago | [CVE-2026-104335](https://github.com/Farih123/CVE-2026-104335) | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code… | -| 0⭐ | 3h ago | KEV [cve-2025-24813](https://github.com/toyplan/cve-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | -| 0⭐ | 6h ago | [RuoYi-CVE-2026-38812-UNFIX](https://github.com/YYF1337/RuoYi-CVE-2026-38812-UNFIX) | RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the… | -| 0⭐ | 8h ago | [CVE-2026-108592-poc](https://github.com/asvorg/CVE-2026-108592-poc) | CVE-2026-108592 - Environment Variable Exposure PoC in mini-swe-agent | -| 0⭐ | 23h ago | [CVE-2026-102428](https://github.com/murrez/CVE-2026-102428) | CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi - order_field/order_direction… | -| 0⭐ | 23h ago | [CVE-2026-106445](https://github.com/murrez/CVE-2026-106445) | CVE-2026-106445 - Handlebars 4.0.0-4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f).… | -| 0⭐ | 23h ago | [CVE-2026-107806](https://github.com/murrez/CVE-2026-107806) | CVE-2026-107806 - nginx-ui 2.3.8-2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET… | +| 0⭐ | 2h ago | KEV [CVE-2025-57819](https://github.com/Wayang1337/CVE-2025-57819) | FreePBX unauthenticated SQLi (endpoint module) | +| 0⭐ | 2h ago | [CVE-2026-104335](https://github.com/Farih123/CVE-2026-104335) | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code… | +| 0⭐ | 4h ago | KEV [cve-2025-24813](https://github.com/toyplan/cve-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | +| 0⭐ | 7h ago | [RuoYi-CVE-2026-38812-UNFIX](https://github.com/YYF1337/RuoYi-CVE-2026-38812-UNFIX) | RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the… | +| 0⭐ | 9h ago | [CVE-2026-108592-poc](https://github.com/asvorg/CVE-2026-108592-poc) | CVE-2026-108592 - Environment Variable Exposure PoC in mini-swe-agent | +| 0⭐ | 1d ago | [CVE-2026-102428](https://github.com/murrez/CVE-2026-102428) | CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi - order_field/order_direction… | +| 0⭐ | 1d ago | [CVE-2026-106445](https://github.com/murrez/CVE-2026-106445) | CVE-2026-106445 - Handlebars 4.0.0-4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f).… | +| 0⭐ | 1d ago | [CVE-2026-107806](https://github.com/murrez/CVE-2026-107806) | CVE-2026-107806 - nginx-ui 2.3.8-2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET… | | 0⭐ | 1d ago | [CVE-2026-94503](https://github.com/Wayang1337/CVE-2026-94503) | Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload | | 0⭐ | 1d ago | [CVE-2026-85097](https://github.com/Wayang1337/CVE-2026-85097) | Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload | @@ -48,7 +48,7 @@ | 43⭐ | 29d ago | KEV [cve-2026-85706](https://github.com/guneykabel/cve-2026-85706) | Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions:… | | 13⭐ | 4d ago | [watchTowr-vs-Atlassian-CVE-2026-21589](https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589) | h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management… | | 86⭐ | 89d ago | [Android-CVE-2026-43499](https://github.com/CakesTwix/Android-CVE-2026-43499) | Android version CVE-2026-43499 tester | -| 23⭐ | 12d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… | +| 44⭐ | 34d ago | [CVE-2026-28576-poc](https://github.com/mobilehackinglab/CVE-2026-28576-poc) | SQL injection vulnerability in Android 17 (AOSP) | ## Trending in 2025 @@ -74,7 +74,7 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 17⭐ | 7d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | +| 17⭐ | 8d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | | 4⭐ | 57d ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | | 3⭐ | 73d ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… | diff --git a/index/trending.json b/index/trending.json index 98c2b83d6bd..20ed6e4cf7f 100644 --- a/index/trending.json +++ b/index/trending.json @@ -10,7 +10,7 @@ "pushed": "2026-08-20T21:56:15Z", "released": null, "basis": "pending", - "score": 3.2261745855749053, + "score": 3.2243699327203275, "trending": true, "created": "2026-08-15T20:57:13Z", "cve": "CVE-2026-9830", @@ -27,7 +27,7 @@ "pushed": "2026-09-29T06:20:46Z", "released": "2026-09-29T06:20:46Z", "basis": "commit", - "score": 1.7163249513786907, + "score": 1.7124834354420837, "trending": true, "created": "2026-02-05T10:21:22Z", "cve": "CVE-2026-41096", @@ -44,7 +44,7 @@ "pushed": "2026-07-27T19:12:07Z", "released": "2026-07-24T03:30:17Z", "basis": "commit", - "score": 1.6675959007314505, + "score": 1.666985937834896, "trending": true, "created": "2026-07-23T18:54:34Z", "cve": "CVE-2026-54121", @@ -61,7 +61,7 @@ "pushed": "2026-08-22T04:49:54Z", "released": "2026-08-22T04:49:54Z", "basis": "commit", - "score": 1.2732066208569723, + "score": 1.2724765013533283, "trending": true, "created": "2026-08-22T04:49:33Z", "cve": "CVE-2026-62911", @@ -78,7 +78,7 @@ "pushed": "2026-09-11T16:33:14Z", "released": null, "basis": "pending", - "score": 0.9060154082555154, + "score": 0.9051489578619971, "trending": true, "created": "2026-09-10T11:28:38Z", "cve": "CVE-2026-20805", @@ -95,7 +95,7 @@ "pushed": "2026-09-29T07:52:23Z", "released": "2026-09-29T07:57:18Z", "basis": "created", - "score": 0.8791985672270003, + "score": 0.8772206126352114, "trending": true, "created": "2026-09-29T07:57:18Z", "cve": "CVE-2026-94545", @@ -112,7 +112,7 @@ "pushed": "2026-09-12T00:03:49Z", "released": null, "basis": "pending", - "score": 0.8728707472541276, + "score": 0.8720273944286363, "trending": true, "created": "2026-09-12T00:03:07Z", "cve": "CVE-2026-21858", @@ -129,7 +129,7 @@ "pushed": "2026-08-26T02:23:55Z", "released": "2026-08-25T19:06:37Z", "basis": "created", - "score": 0.7604589387654789, + "score": 0.7599899049769971, "trending": true, "created": "2026-08-25T19:06:37Z", "cve": "CVE-2026-75604", @@ -146,7 +146,7 @@ "pushed": "2026-09-03T20:38:35Z", "released": null, "basis": "pending", - "score": 0.7222484762839568, + "score": 0.7216981782191776, "trending": true, "created": "2026-09-02T20:12:10Z", "cve": "CVE-2026-65343", @@ -163,7 +163,7 @@ "pushed": "2026-08-03T15:31:59Z", "released": null, "basis": "pending", - "score": 0.5984724563107537, + "score": 0.5982205833552008, "trending": true, "created": "2026-08-03T15:29:22Z", "cve": "CVE-2026-47301", @@ -180,7 +180,7 @@ "pushed": "2026-09-24T02:47:40Z", "released": "2026-09-24T02:47:40Z", "basis": "commit", - "score": 0.5668497024276525, + "score": 0.5659386725952273, "trending": true, "created": "2026-09-24T00:22:30Z", "cve": "CVE-2026-84543", @@ -197,7 +197,7 @@ "pushed": "2026-09-22T19:36:47Z", "released": null, "basis": "pending", - "score": 0.526667626091221, + "score": 0.5258774038565708, "trending": true, "created": "2026-09-22T18:40:26Z", "cve": "CVE-2026-87902", @@ -214,7 +214,7 @@ "pushed": "2026-07-18T21:09:06Z", "released": null, "basis": "pending", - "score": 0.5188554391193909, + "score": 0.5186773421961408, "trending": true, "created": "2026-07-14T14:21:27Z", "cve": "CVE-2026-43499", @@ -231,7 +231,7 @@ "pushed": "2026-09-27T19:48:09Z", "released": "2026-09-27T19:47:52Z", "basis": "commit", - "score": 0.5151561304098439, + "score": 0.5141171668177433, "trending": true, "created": "2026-09-27T19:41:06Z", "cve": "CVE-2026-34990", @@ -248,7 +248,7 @@ "pushed": "2026-10-07T01:07:28Z", "released": "2026-09-22T18:13:48Z", "basis": "created", - "score": 0.47167626235536236, + "score": 0.47097062930026634, "trending": true, "created": "2026-09-22T18:13:48Z", "cve": "CVE-2026-87902", @@ -265,7 +265,7 @@ "pushed": "2026-09-28T05:17:40Z", "released": "2026-09-28T05:17:40Z", "basis": "commit", - "score": 0.4405072230823547, + "score": 0.439593976030659, "trending": true, "created": "2026-09-28T04:47:10Z", "cve": "CVE-2026-85706", @@ -282,7 +282,7 @@ "pushed": "2026-09-11T16:38:12Z", "released": "2026-09-11T15:54:48Z", "basis": "commit", - "score": 0.42320579232650146, + "score": 0.422801419312711, "trending": true, "created": "2026-09-11T15:24:22Z", "cve": "CVE-2026-85706", @@ -299,7 +299,7 @@ "pushed": "2026-10-06T10:48:38Z", "released": "2026-10-06T10:48:38Z", "basis": "commit", - "score": 0.4061952161571205, + "score": 0.40418345289392776, "trending": true, "created": "2026-10-06T10:40:59Z", "cve": "CVE-2026-21589", @@ -316,12 +316,29 @@ "pushed": "2026-07-13T13:32:26Z", "released": null, "basis": "pending", - "score": 0.3960694223329261, + "score": 0.39594143174307345, "trending": true, "created": "2026-07-13T13:31:55Z", "cve": "CVE-2026-43499", "kev": false }, + { + "year": 2026, + "stars": 44, + "name": "CVE-2026-28576-poc", + "url": "https://github.com/mobilehackinglab/CVE-2026-28576-poc", + "artifact": false, + "source": "github.com", + "desc": "SQL injection vulnerability in Android 17 (AOSP)", + "pushed": "2026-09-07T08:42:12Z", + "released": null, + "basis": "pending", + "score": 0.3947201301931278, + "trending": true, + "created": "2026-09-07T09:25:30Z", + "cve": "CVE-2026-28576", + "kev": false + }, { "year": 2024, "stars": 17, @@ -333,29 +350,12 @@ "pushed": "2026-10-03T08:14:17Z", "released": null, "basis": "pending", - "score": 0.39485269468484746, + "score": 0.39356930831688913, "trending": true, "created": "2026-04-07T12:02:52Z", "cve": "CVE-2024-56426", "kev": false }, - { - "year": 2026, - "stars": 23, - "name": "watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", - "url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", - "artifact": false, - "source": "github.com", - "desc": "Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.", - "pushed": "2026-09-28T09:24:46Z", - "released": "2026-09-28T09:24:46Z", - "basis": "commit", - "score": 0.39302920205639963, - "trending": true, - "created": "2026-09-27T18:15:38Z", - "cve": "CVE-2026-88771", - "kev": true - }, { "year": 2025, "stars": 22, @@ -367,7 +367,7 @@ "pushed": "2026-08-10T23:15:22Z", "released": "2026-08-10T23:15:36Z", "basis": "created", - "score": 0.13176105737335617, + "score": 0.13169908094690944, "trending": true, "created": "2026-08-10T23:15:36Z", "cve": "CVE-2025-7771", @@ -384,7 +384,7 @@ "pushed": "2026-09-17T02:22:58Z", "released": "2026-09-17T02:22:58Z", "basis": "commit", - "score": 0.09025459140691505, + "score": 0.09014977662381261, "trending": true, "created": "2026-09-16T23:32:09Z", "cve": "CVE-2025-32432", @@ -401,7 +401,7 @@ "pushed": "2026-08-27T07:13:42Z", "released": null, "basis": "pending", - "score": 0.07407374716928417, + "score": 0.07402655468467062, "trending": true, "created": "2026-08-19T09:39:46Z", "cve": "CVE-2025-21479", @@ -418,7 +418,7 @@ "pushed": "2026-08-20T01:33:10Z", "released": "2026-08-20T01:20:07Z", "basis": "commit", - "score": 0.0468090205478894, + "score": 0.046783250908662914, "trending": true, "created": "2026-08-20T01:13:39Z", "cve": "CVE-2025-21479", @@ -435,7 +435,7 @@ "pushed": "2026-08-02T06:48:32Z", "released": "2026-07-28T09:37:42Z", "basis": "commit", - "score": 0.04174619417384479, + "score": 0.041730064761020286, "trending": true, "created": "2026-07-28T06:41:38Z", "cve": "CVE-2025-21479", @@ -452,7 +452,7 @@ "pushed": "2026-08-06T14:58:53Z", "released": "2026-08-06T14:58:53Z", "basis": "commit", - "score": 0.039993515328165516, + "score": 0.03997592806425716, "trending": true, "created": "2026-08-06T13:52:33Z", "cve": "CVE-2025-8045", @@ -469,7 +469,7 @@ "pushed": "2026-07-22T19:46:33Z", "released": null, "basis": "pending", - "score": 0.029794256603205005, + "score": 0.029783527470115645, "trending": true, "created": "2026-07-22T19:43:34Z", "cve": "CVE-2023-36003", @@ -486,7 +486,7 @@ "pushed": "2026-08-15T06:21:41Z", "released": null, "basis": "pending", - "score": 0.02518367071607556, + "score": 0.025170947526883463, "trending": true, "created": "2026-08-15T06:12:04Z", "cve": "CVE-2024-56426", @@ -503,7 +503,7 @@ "pushed": "2026-07-21T16:55:33Z", "released": null, "basis": "pending", - "score": 0.02459278488379779, + "score": 0.02458405261608059, "trending": true, "created": "2026-07-21T16:52:22Z", "cve": "CVE-2025-32432", @@ -520,7 +520,7 @@ "pushed": "2026-08-28T00:05:41Z", "released": "2026-08-28T00:05:42Z", "basis": "created", - "score": 0.022462700245418275, + "score": 0.02244816756067268, "trending": true, "created": "2026-08-28T00:05:42Z", "cve": "CVE-2025-3248", @@ -537,7 +537,7 @@ "pushed": "2026-08-18T01:39:34Z", "released": null, "basis": "pending", - "score": 0.0195535360907072, + "score": 0.019543157983254088, "trending": true, "created": "2026-08-18T02:31:53Z", "cve": "CVE-2025-21479", @@ -554,7 +554,7 @@ "pushed": "2026-07-19T11:00:00Z", "released": "2026-07-19T11:00:00Z", "basis": "commit", - "score": 0.019308205393112742, + "score": 0.019301530949333102, "trending": true, "created": "2026-07-19T10:49:05Z", "cve": "CVE-2025-64512", @@ -571,7 +571,7 @@ "pushed": "2026-07-17T13:55:11Z", "released": null, "basis": "pending", - "score": 0.019014632165795468, + "score": 0.01900820144939323, "trending": true, "created": "2026-07-17T13:46:16Z", "cve": "CVE-2025-8110", @@ -588,7 +588,7 @@ "pushed": "2026-07-29T21:15:12Z", "released": "2026-07-29T21:15:12Z", "basis": "commit", - "score": 0.01587264171187138, + "score": 0.015866385906420005, "trending": true, "created": "2026-07-29T19:59:36Z", "cve": "CVE-2024-36104", @@ -605,7 +605,7 @@ "pushed": "2026-07-27T07:00:54Z", "released": "2026-07-27T06:52:27Z", "basis": "commit", - "score": 0.01549592763236521, + "score": 0.015490024416104772, "trending": true, "created": "2026-07-27T06:51:21Z", "cve": "CVE-2023-52076", @@ -622,7 +622,7 @@ "pushed": "2026-07-20T13:33:10Z", "released": "2026-07-20T13:33:10Z", "basis": "commit", - "score": 0.01461476035312693, + "score": 0.014609641645132255, "trending": true, "created": "2026-02-13T22:26:25Z", "cve": "CVE-2025-6019", @@ -639,7 +639,7 @@ "pushed": "2026-10-08T15:42:17Z", "released": "2025-09-09T01:31:54Z", "basis": "commit", - "score": 0.009814635106140734, + "score": 0.009813911419894784, "trending": true, "created": "2025-09-08T21:12:19Z", "cve": "CVE-2022-22077",