diff --git a/README.md b/README.md index a59f8dceb44..4f3c2bfaa72 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-16%20Sep%202026%2011%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609161107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C903-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609161107)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-16%20Sep%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609161207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C904-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C197-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609161207)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,28 +12,28 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 11h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 2⭐ | 17h ago | [langflow-CVE-2026-17633-PoC](https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC) | PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint.… | -| 0⭐ | 20h ago | KEV [CVE-2025-24813](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | +| 1⭐ | 57m ago | [CVE-2025-57231](https://github.com/anirbala98/CVE-2025-57231) | Docmost < 0.22.0 - Arbitrary File Read | +| 0⭐ | 12h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 2⭐ | 18h ago | [langflow-CVE-2026-17633-PoC](https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC) | PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint.… | +| 0⭐ | 21h ago | KEV [CVE-2025-24813](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-24813) | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure… | | 0⭐ | 1d ago | [CVE-2025-64512_PoC](https://github.com/Jinook-Kim/CVE-2025-64512_PoC) | Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from… | -| 0⭐ | 1d ago | [CVE-2026-69328](https://github.com/0xf9b6a41ec/CVE-2026-69328) | Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. | | 0⭐ | 2d ago | KEV [CVE-2025-32432](https://github.com/e5dfdd568a75282b712b6d93a7a18e12/CVE-2025-32432) | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.… | | 0⭐ | 2d ago | [CVE-2025-24071](https://github.com/BardLaudian/CVE-2025-24071) | Dependency-free PoC generator for CVE-2025-24071 - Windows File Explorer .library-ms NTLM hash disclosure via… | -| 0⭐ | 2d ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | -| 5⭐ | 4d ago | KEV [CVE-2026-20805-PoC](https://github.com/ZeroDayEvil/CVE-2026-20805-PoC) | 🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information… | +| 0⭐ | 3d ago | KEV [CVE-2025-38352-PoC](https://github.com/longwasu/CVE-2025-38352-PoC) | PoC and GDB script assists in triggering CVE-2025-38352 | +| 6⭐ | 4d ago | KEV [CVE-2026-20805-PoC](https://github.com/ZeroDayEvil/CVE-2026-20805-PoC) | 🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information… | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 3⭐ | 15h ago | [POC-AIOWPM-CVE-2026-19949](https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949) | PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=… | +| 3⭐ | 16h ago | [POC-AIOWPM-CVE-2026-19949](https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949) | PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <=… | | 17⭐ | 1d ago | [CVE-2026-31694-POC](https://github.com/0xCyberstan/CVE-2026-31694-POC) | Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a… | | 4⭐ | 2d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | | 4⭐ | 2d ago | KEV [CVE-2026-73570](https://github.com/gabrielunknown/CVE-2026-73570) | Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc) | | 6⭐ | 2d ago | [CVE-2026-42536-PoC](https://github.com/erberkan/CVE-2026-42536-PoC) | Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and… | | 3⭐ | 3d ago | KEV [cve-2026-85706-poc-exploit-gitlab](https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab) | cve-2026-85706-poc-exploit-gitlab | | 3⭐ | 3d ago | [CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.](https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.) | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker… | -| 4⭐ | 3d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | +| 4⭐ | 4d ago | [CVE-2026-78006-POC](https://github.com/DeadExpl0it/CVE-2026-78006-POC) | POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code… | | 4⭐ | 4d ago | [CVE-2026-89013](https://github.com/Faceless0x7/CVE-2026-89013) | CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated… | | 5⭐ | 4d ago | [CVE-2026-89012](https://github.com/Faceless0x7/CVE-2026-89012) | CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution… | | 3⭐ | 4d ago | KEV [CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter](https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter) | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute… | diff --git a/cves/2025/CVE-2025-57231.md b/cves/2025/CVE-2025-57231.md index 5acf6964032..1c26500d6e8 100644 --- a/cves/2025/CVE-2025-57231.md +++ b/cves/2025/CVE-2025-57231.md @@ -13,7 +13,7 @@ Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticate No PoCs from references. #### Github -No PoCs found on GitHub currently. +- https://github.com/anirbala98/CVE-2025-57231 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57231.yaml diff --git a/cves/2026/CVE-2026-22686.md b/cves/2026/CVE-2026-22686.md index 46c863c9b93..f5a007ce4e3 100644 --- a/cves/2026/CVE-2026-22686.md +++ b/cves/2026/CVE-2026-22686.md @@ -18,3 +18,4 @@ Enclave is a secure JavaScript sandbox designed for safe AI agent code execution #### Github - https://github.com/amusedx/CVE-2026-22686 - https://github.com/moltengama/CVE-2026-22686-RemoteCodeExecution-RCE-PoC +- https://github.com/moi404/CVE-2026-22686-RemoteCodeExecution-RCE-PoC diff --git a/cves/2026/CVE-2026-65330.md b/cves/2026/CVE-2026-65330.md new file mode 100644 index 00000000000..f006952f7b5 --- /dev/null +++ b/cves/2026/CVE-2026-65330.md @@ -0,0 +1,21 @@ +### [CVE-2026-65330](https://www.cve.org/CVERecord?id=CVE-2026-65330) +![](https://img.shields.io/static/v1?label=Vendor&message=Apple&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=iOS%20and%20iPadOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=macOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=tvOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=visionOS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=watchOS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=An%20app%20may%20be%20able%20to%20cause%20unexpected%20system%20termination%20or%20corrupt%20kernel%20memory&color=brightgreen) + +### Description + +The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/csrXamfi/CVE-2026-65330 diff --git a/docs/hero.svg b/docs/hero.svg index ffa76543a73..d0a7ba130fd 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 82,904 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 172,084 + fill="#e6edf3" letter-spacing="-0.5">172,085 CVES INDEXED82,903 + fill="#2f81f7" letter-spacing="-0.5">82,904 WITH POCS1,197 diff --git a/docs/social-card.svg b/docs/social-card.svg index d1dfc47f099..7fb2f8c2549 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 172,084 + fill="#e6edf3" letter-spacing="-0.5">172,085 CVES INDEXED82,903 + fill="#2f81f7" letter-spacing="-0.5">82,904 WITH POCS1,197 diff --git a/docs/stats.json b/docs/stats.json index b5cd3a2190c..d1476da58d4 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1197, - "total_cves": 172084, - "with_pocs": 82903 + "total_cves": 172085, + "with_pocs": 82904 } diff --git a/index/github.txt b/index/github.txt index 849d70ea7cd..7e47e0f6838 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26626,3 +26626,6 @@ CVE-2026-54337 - https://github.com/4qu4r1um/CVE-2026-54337-PoC CVE-2026-69212 - https://github.com/c0gnit00/CVE-2026-69212 CVE-2026-76070 - https://github.com/ozcanpng/CVE-2026-76070 CVE-2026-76071 - https://github.com/ozcanpng/CVE-2026-76071 +CVE-2025-57231 - https://github.com/anirbala98/CVE-2025-57231 +CVE-2026-22686 - https://github.com/moi404/CVE-2026-22686-RemoteCodeExecution-RCE-PoC +CVE-2026-65330 - https://github.com/csrXamfi/CVE-2026-65330 diff --git a/index/trending.json b/index/trending.json index 9006fa504b5..d5eb7855c85 100644 --- a/index/trending.json +++ b/index/trending.json @@ -483,6 +483,18 @@ "cve": "CVE-2023-6019", "kev": false }, + { + "year": 2025, + "stars": 1, + "name": "CVE-2025-57231", + "url": "https://github.com/anirbala98/CVE-2025-57231", + "desc": "Docmost < 0.22.0 - Arbitrary File Read", + "pushed": "2026-09-16T11:12:10Z", + "created": "2026-09-12T12:17:38Z", + "cve": "CVE-2025-57231", + "kev": false, + "landed": true + }, { "year": 2025, "stars": 0, @@ -531,18 +543,6 @@ "kev": false, "landed": true }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-69328", - "url": "https://github.com/0xf9b6a41ec/CVE-2026-69328", - "desc": "Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.", - "pushed": "2026-09-15T00:15:45Z", - "created": "2026-09-15T00:14:32Z", - "cve": "CVE-2026-69328", - "kev": false, - "landed": true - }, { "year": 2025, "stars": 0, @@ -581,7 +581,7 @@ }, { "year": 2026, - "stars": 5, + "stars": 6, "name": "CVE-2026-20805-PoC", "url": "https://github.com/ZeroDayEvil/CVE-2026-20805-PoC", "desc": "🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information Disclosure & Memory Leak Diagnostic).",