Trending CVEs update 2026-10-01 12:09 🤖

2026-10-27 16:51:03 +00:00 · 2026-10-01 12:09:54 +00:00
1 parent fdd711cb91
commit c2554f5283
@@ -2,7 +2,7 @@

 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/hero.svg?v=173195-83889-1219" alt="PoC Index" width="100%"></a>

-[![last sync](https://img.shields.io/badge/last%20sync-01%20Oct%202026%2011%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610011107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C889-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610011107)](https://github.com/0xMarcio/pocindex/stargazers)
+[![last sync](https://img.shields.io/badge/last%20sync-01%20Oct%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main)&nbsp;[![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610011207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml)&nbsp;[![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-83%2C889-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![known exploited](https://img.shields.io/badge/known%20exploited-1%2C219-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/)&nbsp;[![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610011207)](https://github.com/0xMarcio/pocindex/stargazers)

 <a href="https://pocindex.io/"><img src="https://raw.githubusercontent.com/0xMarcio/pocindex/8dec6181e823d641132e0ee8a52a1612c2b5dd37/docs/search.svg" alt="Search PoC Index" width="100%"></a>

@@ -12,10 +12,10 @@

 | Stars | Updated | Repository | Description |
 | --- | --- | --- | --- |
-| 0⭐ | 1h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
-| 0⭐ | 17h ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell |
-| 0⭐ | 18h ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
-| 1⭐ | 23h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
+| 0⭐ | 2h ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
+| 0⭐ | 18h ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell |
+| 0⭐ | 19h ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
+| 1⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
 | 0⭐ | 1d ago | [cve-2025-30208](https://github.com/Minseo9503/cve-2025-30208) | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… |
 | 0⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-32463](https://github.com/klvlo/CVE-2025-32463) | PoC / Exploit for CVE-2025-32463(sudo LPE) |
 | 0⭐ | 2d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2025-8088-WinRAR-PoC-3](https://github.com/roof1948576qwd/CVE-2025-8088-WinRAR-PoC-3) | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute… |
@@ -32,7 +32,7 @@
 | 29⭐ | 1d ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse,… |
 | 7⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) | CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… |
 | 6⭐ | 1d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [watchTowr-vs-Citrix-Netscaler-CVE-2026-88772](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772) | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before… |
-| 39⭐ | 2d ago | [CVE-2026-94545](https://github.com/EQSTLab/CVE-2026-94545) | Next.js RCE |
+| 41⭐ | 2d ago | [CVE-2026-94545](https://github.com/EQSTLab/CVE-2026-94545) | Next.js RCE |
 | 3⭐ | 2d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-49869](https://github.com/EQSTLab/CVE-2026-49869) | Kestra Unauthenticated RCE |
 | 3⭐ | 3d ago | [CVE-2026-56096](https://github.com/yairHinkis/CVE-2026-56096) | Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr) |
 | 21⭐ | 3d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… |
@@ -43,7 +43,7 @@
 | 29⭐ | 3d ago | [CVE-2026-34990](https://github.com/predyy/CVE-2026-34990) | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. |
 | 13⭐ | 3d ago | [CVE-2026-28695](https://github.com/predyy/CVE-2026-28695) | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. |
 | 5⭐ | 3d ago | [opace6-cve-2026-64560](https://github.com/qingle009/opace6-cve-2026-64560) | OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address |
-| 3⭐ | 3d ago | [CVE-2026-48842](https://github.com/4minx/CVE-2026-48842) | CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi |
+| 3⭐ | 4d ago | [CVE-2026-48842](https://github.com/4minx/CVE-2026-48842) | CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi |
 | 10⭐ | 4d ago | <img src="https://raw.githubusercontent.com/0xMarcio/pocindex/main/docs/kev.svg" alt="KEV" title="CISA known exploited" height="14"> [CVE-2026-87902-Toolkit](https://github.com/tc4dy/CVE-2026-87902-Toolkit) | CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2… |
 | 10⭐ | 4d ago | [op13-cve-2026-64560](https://github.com/a23bc/op13-cve-2026-64560) | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by… |
 | 4⭐ | 4d ago | [CVE-2026-44011-craftcms-auth-rce](https://github.com/4xura/CVE-2026-44011-craftcms-auth-rce) | The PoC of CVE-2026-44011: Craft CMS RCE with an authenticated user. |
@@ -27091,41 +27091,18 @@ CVE-2025-8110 - https://github.com/Makis6/CVE-2025-8110
 CVE-2026-43284 - https://github.com/soumarcelino/DFRoot-S938BXXSCCZH1
 CVE-2026-53362 - https://github.com/ramondunker/ipv6_frag_escape_amzn2023_x86_64
 CVE-2026-88789 - https://github.com/oscerd/CVE-2026-88789
-CVE-2017-0781 - https://github.com/x3ero0/android712-blueborne
 CVE-2017-11882 - https://github.com/embedi/CVE-2017-11882
 CVE-2018-0802 - https://github.com/rxwx/CVE-2018-0802
 CVE-2018-0802 - https://github.com/zldww2011/CVE-2018-0802_POC
-CVE-2018-15133 - https://github.com/pwnedshell/Larascript
-CVE-2018-7600 - https://github.com/firefart/CVE-2018-7600
 CVE-2020-11108 - https://github.com/Frichetten/CVE-2020-11108-PoC
-CVE-2020-8597 - https://github.com/winmin/CVE-2020-8597
-CVE-2020-8816 - https://github.com/martinsohn/CVE-2020-8816
-CVE-2021-3560 - https://github.com/winmin/CVE-2021-3560
-CVE-2021-44228 - https://github.com/mkhazamipour/log4j-vulnerable-app-cve-2021-44228-terraform
-CVE-2021-44228 - https://github.com/nikolas-charalambidis/cve-2021-44228
-CVE-2022-24713 - https://github.com/jpeisach/CVE-2022-24713-POC
-CVE-2022-31897 - https://github.com/angelopioamirante/CVE-2022-31897
-CVE-2022-33075 - https://github.com/angelopioamirante/CVE-2022-33075
-CVE-2023-23638 - https://github.com/X1r0z/dubbo-rce
-CVE-2023-23752 - https://github.com/yusinomy/CVE-2023-23752
-CVE-2023-36664 - https://github.com/jeanchpt/CVE-2023-36664
 CVE-2023-40931 - https://github.com/NCF0126/Nagios-XI-s-CVE-2023-40931-Exploit
-CVE-2024-21006 - https://github.com/d3fudd/CVE-2024-21006_PoC
-CVE-2024-38063 - https://github.com/Sachinart/CVE-2024-38063-poc
-CVE-2024-38063 - https://github.com/brownpanda29/Cve-2024-38063
 CVE-2024-6387 - https://github.com/zgzhang/cve-2024-6387-poc
-CVE-2025-0133 - https://github.com/inteleon404/CVE-2025-0133
 CVE-2025-14783 - https://github.com/Ngagne-Demba-Dia/CVE-2025-14783-POC
 CVE-2025-24813 - https://github.com/Si13NTTT/CVE-2025-24813
-CVE-2025-31651 - https://github.com/gregk4sec/cve-2025-31651
 CVE-2025-32432 - https://github.com/Si13NTTT/CVE-2025-32432
-CVE-2025-4123 - https://github.com/NightBloodZ/CVE-2025-4123
-CVE-2025-63353 - https://github.com/zvckster/CVE-2025-63353
 CVE-2026-100903 - https://github.com/4ybrick/CVE-2026-100903
 CVE-2026-31431 - https://github.com/rifkyards/Copy-Fail-CVE-2026-31431-Kubernetes-PoC
 CVE-2026-32475 - https://github.com/cyeezy08/WordPress_Exploit_Directory
-CVE-2026-41089 - https://github.com/1posix/CVE-2026-41089-PoC
-CVE-2026-43499 - https://github.com/Cxyofficial/K50G-POCOF4GT-CVE-2026-43499-PoC
 CVE-2026-48611 - https://github.com/lxdwnpiper/CVE-2026-48611-phpBB
 CVE-2026-55494 - https://github.com/4qu4r1um/tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE
 CVE-2026-79417 - https://github.com/connorjaydunn/CVE-2026-79417
@@ -56,7 +56,7 @@
 },
 {
  "year": 2026,
-  "stars": 39,
+  "stars": 41,
  "name": "CVE-2026-94545",
  "url": "https://github.com/EQSTLab/CVE-2026-94545",
  "desc": "Next.js RCE",