admin/cve
1
0 Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Trending CVEs update 2026-09-06 12:09 🤖

Browse Source
This commit is contained in:
CVE-BOT committed 2026-09-06 12:09:10 +00:00
1 parent 55931ea6d2
commit 9e3896cd21
4 files changed
+36 -34
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+10 -10
View File
@@ -2,7 +2,7 @@
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=171285-82652-1186" alt="PoC Index" width="100%"></a>
[![last sync](https://img.shields.io/badge/last%20sync-06%20Sep%202026%2011%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609061107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C652-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609061107)](https://github.com/0xMarcio/pocindex/stargazers)
[![last sync](https://img.shields.io/badge/last%20sync-06%20Sep%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609061207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C652-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609061207)](https://github.com/0xMarcio/pocindex/stargazers)
<a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>
@@ -12,23 +12,23 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
| 0⭐ | 10h ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… |
| 0⭐ | 15h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… |
| 0⭐ | 15h ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 |
| 2⭐ | 17h ago | [CVE-2026-58138](https://github.com/0xBlackash/CVE-2026-58138) | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that… |
| 0⭐ | 23h ago | [CVE-2025-29927-PoC](https://github.com/Ritinify/CVE-2025-29927-PoC) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… |
| 0⭐ | 1d ago | [CVE-2026-3891](https://github.com/katranSefa/CVE-2026-3891) | The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing… |
| 0⭐ | 37m ago | [CVE-2026-49777](https://github.com/katranSefa/CVE-2026-49777) | Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for… |
| 0⭐ | 11h ago | [CVE-2025-24799](https://github.com/galisko/CVE-2025-24799) | GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection… |
| 0⭐ | 15h ago | [CVE-2026-64747](https://github.com/eddinos2/CVE-2026-64747) | AppleAVE2 kernel driver wire-format research and macOS reachability PoC for CVE-2026-64747. |
| 0⭐ | 16h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [POC-CVE-2025-68613](https://github.com/rmhowe425/POC-CVE-2025-68613) | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4,… |
| 0⭐ | 16h ago | [CVE-2025-4255---Buffer-Overflow](https://github.com/Tenor-Z/CVE-2025-4255---Buffer-Overflow) | Exploit Framework for CVE-2025-4255 |
| 2⭐ | 18h ago | [CVE-2026-58138](https://github.com/0xBlackash/CVE-2026-58138) | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that… |
| 0⭐ | 1d ago | [CVE-2025-29927-PoC](https://github.com/Ritinify/CVE-2025-29927-PoC) | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior… |
| 1⭐ | 1d ago | [CVE-2026-32475](https://github.com/4minx/CVE-2026-32475) | CVE-2026-32475 PoC : Elementor Pro Unauthenticated Arbitrary File Upload to RCE |
| 0⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… |
| 2⭐ | 1d ago | [CVE-2025-9974](https://github.com/Rajdave69/CVE-2025-9974) | Proof of Concept code for the CVE-2025-9974 affecting Nokia Beacon routers. |
| 0⭐ | 1d ago | [CVE-2026-19516](https://github.com/HORKimhab/CVE-2026-19516) | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests,… |
## Trending in 2026
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
| 4⭐ | 2h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via… |
| 5⭐ | 23h ago | [xiaomi15-dada-cve-2026-64560](https://github.com/quyicheng03-boop/xiaomi15-dada-cve-2026-64560) | Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8 |
| 4⭐ | 3h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM 🔥 via… |
| 5⭐ | 1d ago | [xiaomi15-dada-cve-2026-64560](https://github.com/quyicheng03-boop/xiaomi15-dada-cve-2026-64560) | Device-bound CVE-2026-64560 adaptation for Xiaomi 15 dada OS4.0.0.8 |
| 5⭐ | 1d ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… |
| 5⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-15409-15410-Framework](https://github.com/tc4dy/CVE-2026-15409-15410-Framework) | CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features:… |
| 3⭐ | 3d ago | [CVE-2026-62735](https://github.com/HackSpeak/CVE-2026-62735) | Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM… |
cves/2026/CVE-2026-49777.md
+1
View File
@@ -19,6 +19,7 @@ No PoCs from references.
#### Github
- https://github.com/xxconi/CVE-2026-49777-CVE-2026-10735
- https://github.com/izxci/CVE-2026-49777
- https://github.com/katranSefa/CVE-2026-49777
#### Nuclei
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49777.yaml
index/github.txt
+1
View File
@@ -26806,3 +26806,4 @@ CVE-2015-8562 - https://github.com/dmonst3r/CVE-2015-8562
CVE-2026-26211 - https://github.com/LindHunt/CVE-2026-26211
CVE-2026-6279 - https://github.com/katranSefa/CVE-2026-6279
CVE-2025-13407 - https://github.com/katranSefa/CVE--2025-13407
CVE-2026-49777 - https://github.com/katranSefa/CVE-2026-49777
index/trending.json
+24 -24
View File
@@ -494,6 +494,18 @@
"cve": "CVE-2022-29799",
"kev": false
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-49777",
"url": "https://github.com/katranSefa/CVE-2026-49777",
"desc": "Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.",
"pushed": "2026-09-06T11:31:19Z",
"created": "2026-09-06T11:31:01Z",
"cve": "CVE-2026-49777",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 0,
@@ -506,6 +518,18 @@
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-64747",
"url": "https://github.com/eddinos2/CVE-2026-64747",
"desc": "AppleAVE2 kernel driver wire-format research and macOS reachability PoC for CVE-2026-64747.",
"pushed": "2026-09-05T20:23:43Z",
"created": "2026-09-05T20:23:44Z",
"cve": "CVE-2026-64747",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 0,
@@ -554,18 +578,6 @@
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-3891",
"url": "https://github.com/katranSefa/CVE-2026-3891",
"desc": "The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",
"pushed": "2026-09-05T10:34:08Z",
"created": "2026-09-05T10:33:55Z",
"cve": "CVE-2026-3891",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 1,
@@ -601,17 +613,5 @@
"cve": "CVE-2025-9974",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-19516",
"url": "https://github.com/HORKimhab/CVE-2026-19516",
"desc": "A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.",
"pushed": "2026-09-04T13:06:57Z",
"created": "2026-09-04T13:02:38Z",
"cve": "CVE-2026-19516",
"kev": false,
"landed": true
}
]