diff --git a/.github/cve_sync_state.json b/.github/cve_sync_state.json
index 8cae8d7c5d0..9dfb4377223 100644
--- a/.github/cve_sync_state.json
+++ b/.github/cve_sync_state.json
@@ -1,3 +1,3 @@
 {
-  "cvelist_fetch_time": "2026-08-30T08:08:00.342Z"
+  "cvelist_fetch_time": "2026-08-30T14:46:42.048Z"
 }
diff --git a/2025/CVE-2025-20700.md b/2025/CVE-2025-20700.md
new file mode 100644
index 00000000000..9e17337adaf
--- /dev/null
+++ b/2025/CVE-2025-20700.md
@@ -0,0 +1,17 @@
+### [CVE-2025-20700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20700)
+![](https://img.shields.io/static/v1?label=Product&message=AB156x%2C%20AB157x%2C%20AB158x%2C%20AB159x%20series%2C%20AB1627&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Airoha%20IoT%20SDK%20for%20BT%20audio%20v5.5.0%20and%20earlier&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=Airoha%20AB1561x%2FAB1562x%2FAB1563x%20SDK%20v3.3.1%20and%20earlier&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/xarlord/btsec-testtool
diff --git a/2025/CVE-2025-21479.md b/2025/CVE-2025-21479.md
index acea455df1b..da3420afc03 100644
--- a/2025/CVE-2025-21479.md
+++ b/2025/CVE-2025-21479.md
@@ -90,4 +90,5 @@ No PoCs from references.
 - https://github.com/DiscordTonyStark/root
 - https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1
 - https://github.com/zhuowei/cheese
+- https://github.com/Type010/cve-2025-21479-iqoo11pro
 
diff --git a/2025/CVE-2025-24813.md b/2025/CVE-2025-24813.md
index 0e7e5262b2f..b157f698540 100644
--- a/2025/CVE-2025-24813.md
+++ b/2025/CVE-2025-24813.md
@@ -79,4 +79,5 @@ Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution a
 - https://github.com/yaleman/cve-2025-24813-poc
 - https://github.com/s1lentf00thold/ZoneMinder-v1.29.0
 - https://github.com/leonzhao7/jvuln-platform
+- https://github.com/mrzero-cool/cve-poc-search
 
diff --git a/2025/CVE-2025-27915.md b/2025/CVE-2025-27915.md
index 16c61822745..3fb86ecbc9b 100644
--- a/2025/CVE-2025-27915.md
+++ b/2025/CVE-2025-27915.md
@@ -13,5 +13,5 @@ An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A s
 No PoCs from references.
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/alsyundawy/eradicate-zimbra-malware
 
diff --git a/2025/CVE-2025-36911.md b/2025/CVE-2025-36911.md
new file mode 100644
index 00000000000..1aa4fa33ccf
--- /dev/null
+++ b/2025/CVE-2025-36911.md
@@ -0,0 +1,16 @@
+### [CVE-2025-36911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-36911)
+![](https://img.shields.io/static/v1?label=Product&message=Android&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Android%20kernel&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20disclosure&color=brightgreen)
+
+### Description
+
+In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/xarlord/btsec-testtool
diff --git a/2025/CVE-2025-49844.md b/2025/CVE-2025-49844.md
index 2c44e106449..e0982e4b428 100644
--- a/2025/CVE-2025-49844.md
+++ b/2025/CVE-2025-49844.md
@@ -14,3 +14,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/Zain3311/CVE-2025-49844
+- https://github.com/alsyundawy/eradicate-zimbra-malware
diff --git a/2025/CVE-2025-55182.md b/2025/CVE-2025-55182.md
index a06f8a972fe..70e082fb007 100644
--- a/2025/CVE-2025-55182.md
+++ b/2025/CVE-2025-55182.md
@@ -21,3 +21,4 @@ No PoCs from references.
 - https://github.com/alyaapm/CVE-2025-55182-shellinteractive
 - https://github.com/UwUGreed/CVE-2025-55182-poc
 - https://github.com/Tc3s/REACT2SHELL-WEB-VULN
+- https://github.com/Farhan9488/CVE-2025-55182-research
diff --git a/2025/CVE-2025-5777.md b/2025/CVE-2025-5777.md
index c7c8d59d4cc..fb40fef9769 100644
--- a/2025/CVE-2025-5777.md
+++ b/2025/CVE-2025-5777.md
@@ -42,4 +42,5 @@ Insufficient input validation leading to memory overread when the NetScaler is
 - https://github.com/rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777
 - https://github.com/soltanali0/CVE-2025-5777-Exploit
 - https://github.com/win3zz/CVE-2025-5777
+- https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
 
diff --git a/2025/CVE-2025-6440.md b/2025/CVE-2025-6440.md
new file mode 100644
index 00000000000..74e1b791996
--- /dev/null
+++ b/2025/CVE-2025-6440.md
@@ -0,0 +1,16 @@
+### [CVE-2025-6440](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6440)
+![](https://img.shields.io/static/v1?label=Product&message=WooCommerce%20Designer%20Pro&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen)
+
+### Description
+
+The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/katranSefa/CVE-2025-6440
diff --git a/2026/CVE-2026-18741.md b/2026/CVE-2026-18741.md
new file mode 100644
index 00000000000..252ccbb53b4
--- /dev/null
+++ b/2026/CVE-2026-18741.md
@@ -0,0 +1,16 @@
+### [CVE-2026-18741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18741)
+![](https://img.shields.io/static/v1?label=Product&message=Worksuite%20SaaS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20%28%27Cross-site%20Scripting%27%29&color=brightgreen)
+
+### Description
+
+Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/LindHunt/CVE-2026-18741
diff --git a/2026/CVE-2026-23989.md b/2026/CVE-2026-23989.md
new file mode 100644
index 00000000000..50010e79d59
--- /dev/null
+++ b/2026/CVE-2026-23989.md
@@ -0,0 +1,17 @@
+### [CVE-2026-23989](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23989)
+![](https://img.shields.io/static/v1?label=Product&message=reva&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.40.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.41.0%2C%20%3C%202.42.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/dinosn/cve-2026-23989-opencloud-lab
diff --git a/2026/CVE-2026-43499.md b/2026/CVE-2026-43499.md
index 05591955db2..c2fd4caba72 100644
--- a/2026/CVE-2026-43499.md
+++ b/2026/CVE-2026-43499.md
@@ -138,3 +138,4 @@ No PoCs from references.
 - https://github.com/caramel1205zh/GKI_KernelSU_SUSFS
 - https://github.com/realthotboyshit/sukisu-
 - https://github.com/cancelledbit/x9u-501-unlock-kit
+- https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
diff --git a/2026/CVE-2026-50751.md b/2026/CVE-2026-50751.md
index 58fc020ae97..a684cad11c5 100644
--- a/2026/CVE-2026-50751.md
+++ b/2026/CVE-2026-50751.md
@@ -20,3 +20,4 @@ No PoCs from references.
 #### Github
 - https://github.com/fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit
 - https://github.com/0xBlackash/CVE-2026-50751
+- https://github.com/e4zyy/Project-CVE-2026-50751
diff --git a/2026/CVE-2026-53163.md b/2026/CVE-2026-53163.md
index 01e839e8cca..4ea6242f90c 100644
--- a/2026/CVE-2026-53163.md
+++ b/2026/CVE-2026-53163.md
@@ -53,3 +53,4 @@ No PoCs from references.
 - https://github.com/PuceLi/GKI_KernelSU_SUSFS_Local
 - https://github.com/caramel1205zh/GKI_KernelSU_SUSFS
 - https://github.com/realthotboyshit/sukisu-
+- https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
diff --git a/2026/CVE-2026-64849.md b/2026/CVE-2026-64849.md
index 6286f7b8687..d70e1b37d27 100644
--- a/2026/CVE-2026-64849.md
+++ b/2026/CVE-2026-64849.md
@@ -16,3 +16,4 @@ No PoCs from references.
 - https://github.com/BiuTrap/CVE-2026-64849
 - https://github.com/zavisco/CVE-2026-64849.yaml
 - https://github.com/codeb0ssx/CVE-2026-64849-PoC
+- https://github.com/mrzero-cool/cve-poc-search
diff --git a/2026/CVE-2026-76581.md b/2026/CVE-2026-76581.md
new file mode 100644
index 00000000000..6385a90f16e
--- /dev/null
+++ b/2026/CVE-2026-76581.md
@@ -0,0 +1,16 @@
+### [CVE-2026-76581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76581)
+![](https://img.shields.io/static/v1?label=Product&message=WPMU%20DEV%20Dashboard&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-347%20Improper%20Verification%20of%20Cryptographic%20Signature&color=brightgreen)
+
+### Description
+
+The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/HORKimhab/CVE-2026-76581
diff --git a/2026/CVE-2026-8222.md b/2026/CVE-2026-8222.md
index 724eb440119..115b861154c 100644
--- a/2026/CVE-2026-8222.md
+++ b/2026/CVE-2026-8222.md
@@ -20,4 +20,4 @@ A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function
 - https://github.com/open5gs/open5gs/issues/4437
 
 #### Github
-No PoCs found on GitHub currently.
+- https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
diff --git a/2026/CVE-2026-82222.md b/2026/CVE-2026-82222.md
index bd9484f164d..c04514b1a21 100644
--- a/2026/CVE-2026-82222.md
+++ b/2026/CVE-2026-82222.md
@@ -16,3 +16,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/UdinChan/cve-2026-82222-poc
+- https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
diff --git a/2026/CVE-2026-82286.md b/2026/CVE-2026-82286.md
new file mode 100644
index 00000000000..a13b98d8bc9
--- /dev/null
+++ b/2026/CVE-2026-82286.md
@@ -0,0 +1,16 @@
+### [CVE-2026-82286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82286)
+![](https://img.shields.io/static/v1?label=Product&message=gpt-crawler&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20%28%27Path%20Traversal%27%29&color=brightgreen)
+
+### Description
+
+gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.
+
+### POC
+
+#### Reference
+No PoCs from references.
+
+#### Github
+- https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write
diff --git a/2026/CVE-2026-82484.md b/2026/CVE-2026-82484.md
new file mode 100644
index 00000000000..59ee36cf145
--- /dev/null
+++ b/2026/CVE-2026-82484.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82484)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/20
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82485.md b/2026/CVE-2026-82485.md
new file mode 100644
index 00000000000..9f0d02cefc0
--- /dev/null
+++ b/2026/CVE-2026-82485.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82485)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pro_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/21
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82487.md b/2026/CVE-2026-82487.md
new file mode 100644
index 00000000000..70f3e52e289
--- /dev/null
+++ b/2026/CVE-2026-82487.md
@@ -0,0 +1,16 @@
+### [CVE-2026-82487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82487)
+![](https://img.shields.io/static/v1?label=Product&message=450TC3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=01.00.00_01&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Weak%20Password%20Recovery&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82488.md b/2026/CVE-2026-82488.md
new file mode 100644
index 00000000000..442cbe7845b
--- /dev/null
+++ b/2026/CVE-2026-82488.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82488)
+![](https://img.shields.io/static/v1?label=Product&message=450TC3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=01.00.00_01&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code of the component User Management. The manipulation of the argument Username leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://github.com/Greejith-k/Stored-Cross-Site-Scripting-Stored-XSS-Vulnerability-in-Beetel-450TC3-Router
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82539.md b/2026/CVE-2026-82539.md
new file mode 100644
index 00000000000..81eb8666cfc
--- /dev/null
+++ b/2026/CVE-2026-82539.md
@@ -0,0 +1,16 @@
+### [CVE-2026-82539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82539)
+![](https://img.shields.io/static/v1?label=Product&message=A720R&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.1.5cu.630_B20250509&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
+
+### POC
+
+#### Reference
+- https://github.com/Xernary/CVE-2026-82539
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82540.md b/2026/CVE-2026-82540.md
new file mode 100644
index 00000000000..a1d43e57ed1
--- /dev/null
+++ b/2026/CVE-2026-82540.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82540)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
+
+### POC
+
+#### Reference
+- https://github.com/niadwj221/cve/issues/2
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82541.md b/2026/CVE-2026-82541.md
new file mode 100644
index 00000000000..d4dcd32a873
--- /dev/null
+++ b/2026/CVE-2026-82541.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82541)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
+
+### POC
+
+#### Reference
+- https://github.com/kimjh1946/cve/issues/1
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82542.md b/2026/CVE-2026-82542.md
new file mode 100644
index 00000000000..cd488e9ddf0
--- /dev/null
+++ b/2026/CVE-2026-82542.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82542)
+![](https://img.shields.io/static/v1?label=Product&message=HG10&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=300001138&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+
+### Description
+
+A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
+
+### POC
+
+#### Reference
+- https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formIPv6Route-destNt.md
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82543.md b/2026/CVE-2026-82543.md
new file mode 100644
index 00000000000..11517444863
--- /dev/null
+++ b/2026/CVE-2026-82543.md
@@ -0,0 +1,19 @@
+### [CVE-2026-82543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82543)
+![](https://img.shields.io/static/v1?label=Product&message=FileCodeBox&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.1&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.2&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.3&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Race%20Condition&color=brightgreen)
+
+### Description
+
+A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the function update_file_usage of the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.5.0 is able to resolve this issue. The patch is named 8d7d856c62d73badd0797eb4daec8d2ff10a403a. Upgrading the affected component is recommended.
+
+### POC
+
+#### Reference
+- https://github.com/vastsa/FileCodeBox/issues/482
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82545.md b/2026/CVE-2026-82545.md
new file mode 100644
index 00000000000..0907907c133
--- /dev/null
+++ b/2026/CVE-2026-82545.md
@@ -0,0 +1,17 @@
+### [CVE-2026-82545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82545)
+![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_vuln/issues/22
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-82547.md b/2026/CVE-2026-82547.md
new file mode 100644
index 00000000000..b48a762e008
--- /dev/null
+++ b/2026/CVE-2026-82547.md
@@ -0,0 +1,16 @@
+### [CVE-2026-82547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82547)
+![](https://img.shields.io/static/v1?label=Product&message=Magma&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.9.0&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen)
+
+### Description
+
+A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown function of the file tasks/amf/amf_fsm.cpp of the component Registration Complete Message Handler. The manipulation results in improper authentication. The attack can be launched remotely. The exploit has been made public and could be used.
+
+### POC
+
+#### Reference
+- https://github.com/magma/magma/issues/16020
+
+#### Github
+No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-8452.md b/2026/CVE-2026-8452.md
index 3da950de196..fcb022ab933 100644
--- a/2026/CVE-2026-8452.md
+++ b/2026/CVE-2026-8452.md
@@ -18,3 +18,4 @@ No PoCs from references.
 
 #### Github
 - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
+- https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
diff --git a/github.txt b/github.txt
index 50a3c0f598f..fd3726babe6 100644
--- a/github.txt
+++ b/github.txt
@@ -62621,3 +62621,23 @@ CVE-2026-81578 - https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
 CVE-2026-82078 - https://github.com/yora1928/PaperCut-CVE-2026-81578-82078
 CVE-2026-82222 - https://github.com/UdinChan/cve-2026-82222-poc
 CVE-2026-9198 - https://github.com/joaovicdev/EXPLOIT-CVE-2026-9198
+CVE-2025-20700 - https://github.com/xarlord/btsec-testtool
+CVE-2025-21479 - https://github.com/Type010/cve-2025-21479-iqoo11pro
+CVE-2025-24813 - https://github.com/mrzero-cool/cve-poc-search
+CVE-2025-27915 - https://github.com/alsyundawy/eradicate-zimbra-malware
+CVE-2025-36911 - https://github.com/xarlord/btsec-testtool
+CVE-2025-49844 - https://github.com/alsyundawy/eradicate-zimbra-malware
+CVE-2025-55182 - https://github.com/Farhan9488/CVE-2025-55182-research
+CVE-2025-5777 - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
+CVE-2025-6440 - https://github.com/katranSefa/CVE-2025-6440
+CVE-2026-18741 - https://github.com/LindHunt/CVE-2026-18741
+CVE-2026-23989 - https://github.com/dinosn/cve-2026-23989-opencloud-lab
+CVE-2026-43499 - https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
+CVE-2026-50751 - https://github.com/e4zyy/Project-CVE-2026-50751
+CVE-2026-53163 - https://github.com/Alfnnnnyy/GKI_KernelSU_SUSFS
+CVE-2026-64849 - https://github.com/mrzero-cool/cve-poc-search
+CVE-2026-76581 - https://github.com/HORKimhab/CVE-2026-76581
+CVE-2026-8222 - https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
+CVE-2026-82222 - https://github.com/dinosn/givewp-cve-2026-82222-rce-lab
+CVE-2026-82286 - https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write
+CVE-2026-8452 - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
diff --git a/references.txt b/references.txt
index b6d9d497a09..9e017cd64c1 100644
--- a/references.txt
+++ b/references.txt
@@ -147864,3 +147864,14 @@ CVE-2026-82424 - https://github.com/Bai-public/CVE/issues/8
 CVE-2026-82473 - https://github.com/geo-chen/oss/blob/main/kubeedge.md
 CVE-2026-82482 - https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_biography.md
 CVE-2026-82483 - https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_album_desc.md
+CVE-2026-82484 - https://github.com/ltranquility/submit_vuln/issues/20
+CVE-2026-82485 - https://github.com/ltranquility/submit_vuln/issues/21
+CVE-2026-82487 - https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router
+CVE-2026-82488 - https://github.com/Greejith-k/Stored-Cross-Site-Scripting-Stored-XSS-Vulnerability-in-Beetel-450TC3-Router
+CVE-2026-82539 - https://github.com/Xernary/CVE-2026-82539
+CVE-2026-82540 - https://github.com/niadwj221/cve/issues/2
+CVE-2026-82541 - https://github.com/kimjh1946/cve/issues/1
+CVE-2026-82542 - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/Tenda/HG10/bof-formIPv6Route-destNt.md
+CVE-2026-82543 - https://github.com/vastsa/FileCodeBox/issues/482
+CVE-2026-82545 - https://github.com/ltranquility/submit_vuln/issues/22
+CVE-2026-82547 - https://github.com/magma/magma/issues/16020