diff --git a/README.md b/README.md index 45432f03fe7..9435ed28f4a 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@
-PoC Index +PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-10%20Oct%202026%2008%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610100807)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C334-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C230-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610100807)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-10%20Oct%202026%2009%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610100907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C335-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C230-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610100907)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -14,16 +14,16 @@ | Stars | Released | PoC | Description | | --- | --- | --- | --- | -| 0⭐ | 3h ago | [CVE-2026-94503](https://github.com/Wayang1337/CVE-2026-94503) | Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload | -| 0⭐ | 3h ago | [CVE-2026-85097](https://github.com/Wayang1337/CVE-2026-85097) | Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload | -| 0⭐ | 6h ago | [telegram-cve-2026-107181](https://github.com/SeanDishman/telegram-cve-2026-107181) | Telegram CVE-2026-107181 | -| 1⭐ | 7h ago | [CVE-2026-84520](https://github.com/csrXamfi/CVE-2026-84520) | AppleFDEKeyStore poc | -| 0⭐ | 18h ago | [CVE-2025-34071](https://github.com/cppghoul/CVE-2025-34071) | RCE in Kerio Control 9.4.5 via unsigned firmware update. | -| 0⭐ | 20h ago | [CVE-2024-36774-Monstra-CMS-RCE-PoC](https://github.com/PawFV/CVE-2024-36774-Monstra-CMS-RCE-PoC) | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via… | +| 0⭐ | 32m ago | [CVE-2026-102428](https://github.com/murrez/CVE-2026-102428) | CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi - order_field/order_direction… | +| 0⭐ | 45m ago | [CVE-2026-106445](https://github.com/murrez/CVE-2026-106445) | CVE-2026-106445 - Handlebars 4.0.0-4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f).… | +| 0⭐ | 53m ago | [CVE-2026-107806](https://github.com/murrez/CVE-2026-107806) | CVE-2026-107806 - nginx-ui 2.3.8-2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET… | +| 0⭐ | 4h ago | [CVE-2026-94503](https://github.com/Wayang1337/CVE-2026-94503) | Zombify <= 1.7.7 Unauthenticated Arbitrary File Upload | +| 0⭐ | 4h ago | [CVE-2026-85097](https://github.com/Wayang1337/CVE-2026-85097) | Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload | +| 0⭐ | 7h ago | [telegram-cve-2026-107181](https://github.com/SeanDishman/telegram-cve-2026-107181) | Telegram CVE-2026-107181 | +| 1⭐ | 8h ago | [CVE-2026-84520](https://github.com/csrXamfi/CVE-2026-84520) | AppleFDEKeyStore poc | +| 0⭐ | 19h ago | [CVE-2025-34071](https://github.com/cppghoul/CVE-2025-34071) | RCE in Kerio Control 9.4.5 via unsigned firmware update. | +| 0⭐ | 21h ago | [CVE-2024-36774-Monstra-CMS-RCE-PoC](https://github.com/PawFV/CVE-2024-36774-Monstra-CMS-RCE-PoC) | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via… | | 2⭐ | 1d ago | [CVE-2026-80428](https://github.com/HackfutSecRoot/CVE-2026-80428) | ILIAS ≤ 9.21 / 10.9 / 11.2 - Unauthenticated PHP Object Injection (RCE) | -| 0⭐ | 1d ago | [CVE-2026-55450](https://github.com/0xBlackash/CVE-2026-55450) | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1,… | -| 0⭐ | 1d ago | [CVE-2026-91940-crawl4ai-Arbitrary-File-Write](https://github.com/BiiTts/CVE-2026-91940-crawl4ai-Arbitrary-File-Write) | CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate… | -| 2⭐ | 1d ago | [CVE-2023-54391-RCE](https://github.com/alexand0www/CVE-2023-54391-RCE) | CVE-2023-54391: Proxmox VE Authentication Bypass RCE Exploit | ## Trending in 2026 @@ -74,7 +74,7 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 17⭐ | 6d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | +| 17⭐ | 7d ago | [CVE-2024-56426](https://github.com/Creeeeger/CVE-2024-56426) | A PoC of the CVE-2024-56426 vulnerability. | | 4⭐ | 56d ago | [CVE-2024-56426](https://github.com/xcracker000/CVE-2024-56426) | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F | | 3⭐ | 72d ago | [CVE-2024-36104-PoC](https://github.com/Groppoxx/CVE-2024-36104-PoC) | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… | diff --git a/cves/2026/CVE-2026-102428.md b/cves/2026/CVE-2026-102428.md new file mode 100644 index 00000000000..4656c6089a3 --- /dev/null +++ b/cves/2026/CVE-2026-102428.md @@ -0,0 +1,18 @@ +### [CVE-2026-102428](https://www.cve.org/CVERecord?id=CVE-2026-102428) +**Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16** +![](https://img.shields.io/static/v1?label=Vendor&message=ordasoft.com&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=OrdaSoft%20Joomla%20CCK&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0-8.3.15&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20%28%27SQL%20Injection%27%29&color=brightgreen) + +### Description + +Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector. + +### POC + +#### Reference +No PoCs from references. + +#### Github +- https://github.com/murrez/CVE-2026-102428 diff --git a/docs/hero.svg b/docs/hero.svg index 3d3ccf93d4e..26447f28c02 100644 --- a/docs/hero.svg +++ b/docs/hero.svg @@ -1,5 +1,5 @@ + role="img" aria-label="PoC Index, 84,335 CVEs with public proof-of-concept exploits"> @@ -19,10 +19,10 @@ pocindex.io 173,779 + fill="#e6edf3" letter-spacing="-0.5">173,780 CVES INDEXED84,334 + fill="#2f81f7" letter-spacing="-0.5">84,335 WITH POCS1,230 diff --git a/docs/social-card.svg b/docs/social-card.svg index ab4c071c577..893208ff1c6 100644 --- a/docs/social-card.svg +++ b/docs/social-card.svg @@ -20,10 +20,10 @@ 173,779 + fill="#e6edf3" letter-spacing="-0.5">173,780 CVES INDEXED84,334 + fill="#2f81f7" letter-spacing="-0.5">84,335 WITH POCS1,230 diff --git a/docs/stats.json b/docs/stats.json index d47cd0913d5..0f925695d28 100644 --- a/docs/stats.json +++ b/docs/stats.json @@ -1,5 +1,5 @@ { "kev": 1230, - "total_cves": 173779, - "with_pocs": 84334 + "total_cves": 173780, + "with_pocs": 84335 } diff --git a/index/github.txt b/index/github.txt index 94a254c8d02..dbb90f9bed8 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27387,3 +27387,4 @@ CVE-2021-44228 - https://github.com/excanear/Escanearcpl-Exploit-Tools CVE-2023-2163 - https://github.com/mrmilady/ebpf-kernel-exploits CVE-2026-106445 - https://github.com/murrez/CVE-2026-106445 CVE-2026-107806 - https://github.com/murrez/CVE-2026-107806 +CVE-2026-102428 - https://github.com/murrez/CVE-2026-102428 diff --git a/index/releases/2022.json b/index/releases/2022.json index bf219a9abd8..4f7530c7e3a 100644 --- a/index/releases/2022.json +++ b/index/releases/2022.json @@ -3824,7 +3824,7 @@ "CVE-2022-26134 github:rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb"}, "CVE-2022-26134 github:reph0r/poc-exp?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/reph0r/poc-exp"}, "CVE-2022-26134 github:reubensammut/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/reubensammut/cve-2022-26134"}, -"CVE-2022-26134 github:roodhelios/cve-2022-26134-ognl-injection?#":{"basis":"pending","checked":"2026-10-10T05:07:34Z","created":"2026-05-06T01:47:50Z","cve":"CVE-2022-26134","head":"425cffd7a9b2aad60bf142a09f089c22937d7f2f","imported":true,"pending":true,"pushed_at":"2026-10-09T23:02:02Z","released":null,"repo":1230429140,"url":"https://github.com/roodhelios/CVE-2022-26134-OGNL-Injection"}, +"CVE-2022-26134 github:roodhelios/cve-2022-26134-ognl-injection?#":{"basis":"pending","checked":"2026-10-10T09:07:53Z","created":"2026-05-06T01:47:50Z","cve":"CVE-2022-26134","head":"425cffd7a9b2aad60bf142a09f089c22937d7f2f","imported":true,"pending":true,"pushed_at":"2026-10-09T23:02:02Z","released":null,"repo":1230429140,"url":"https://github.com/roodhelios/CVE-2022-26134-OGNL-Injection"}, "CVE-2022-26134 github:secjia/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/secjia/CVE-2022-26134"}, "CVE-2022-26134 github:shamo0/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/shamo0/CVE-2022-26134"}, "CVE-2022-26134 github:shiftsansan/cve-2022-26134-console?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/shiftsansan/CVE-2022-26134-Console"}, diff --git a/index/releases/2025.json b/index/releases/2025.json index f54f030e736..7e25488277d 100644 --- a/index/releases/2025.json +++ b/index/releases/2025.json @@ -3827,7 +3827,7 @@ "CVE-2025-2646 github:liuhao2638/cve/issues/9?#":{"basis":"unknown","cve":"CVE-2025-2646","imported":true,"released":null,"url":"https://github.com/liuhao2638/cve/issues/9"}, "CVE-2025-26465 github:rxerium/cve-2025-26465?#":{"basis":"unknown","cve":"CVE-2025-26465","imported":true,"released":null,"url":"https://github.com/rxerium/CVE-2025-26465"}, "CVE-2025-26466 github:acidboonrs/cve-2025-26466-openssh-poc?#":{"basis":"unknown","cve":"CVE-2025-26466","imported":true,"released":null,"url":"https://github.com/acidboonrs/cve-2025-26466-openssh-poc"}, -"CVE-2025-26466 github:k0n9-log/cve-2025-26466-canvas?#":{"basis":"pending","checked":"2026-10-10T05:08:04Z","created":"2026-10-09T06:25:25Z","cve":"CVE-2025-26466","head":"58436afeb56a7a01597b289b3a5c7d7b8e2868ea","pending":true,"pushed_at":"2026-10-09T07:00:26Z","released":null,"repo":1411390164,"seen":"2026-10-09T05:07:55Z","url":"https://github.com/K0n9-log/cve-2025-26466-canvas"}, +"CVE-2025-26466 github:k0n9-log/cve-2025-26466-canvas?#":{"basis":"pending","checked":"2026-10-10T09:08:21Z","created":"2026-10-09T06:25:25Z","cve":"CVE-2025-26466","head":"58436afeb56a7a01597b289b3a5c7d7b8e2868ea","pending":true,"pushed_at":"2026-10-09T07:00:26Z","released":null,"repo":1411390164,"seen":"2026-10-09T05:07:55Z","url":"https://github.com/K0n9-log/cve-2025-26466-canvas"}, "CVE-2025-26466 github:mrowkoob/cve-2025-26466-msf?#":{"basis":"unknown","cve":"CVE-2025-26466","imported":true,"released":null,"url":"https://github.com/mrowkoob/CVE-2025-26466-msf"}, "CVE-2025-26466 github:rxerium/cve-2025-26466?#":{"basis":"unknown","cve":"CVE-2025-26466","imported":true,"released":null,"url":"https://github.com/rxerium/CVE-2025-26466"}, "CVE-2025-26466 github:tpirate/cve-2025-26466?#":{"basis":"unknown","cve":"CVE-2025-26466","imported":true,"released":null,"url":"https://github.com/tpirate/CVE-2025-26466"}, diff --git a/index/releases/2026.json b/index/releases/2026.json index 16cfa3d744e..f44e7110cdd 100644 --- a/index/releases/2026.json +++ b/index/releases/2026.json @@ -496,6 +496,7 @@ "CVE-2026-102425 github:murrez/cve-2026-102425?#":{"basis":"unknown","cve":"CVE-2026-102425","imported":true,"released":null,"url":"https://github.com/murrez/CVE-2026-102425"}, "CVE-2026-102425 github:tonydelouvre/cve-2026-102425?#":{"basis":"unknown","cve":"CVE-2026-102425","imported":true,"released":null,"url":"https://github.com/tonydelouvre/CVE-2026-102425"}, "CVE-2026-102427 github:murrez/cve-2026-102427?#":{"basis":"unknown","cve":"CVE-2026-102427","imported":true,"released":null,"url":"https://github.com/murrez/CVE-2026-102427"}, +"CVE-2026-102428 github:murrez/cve-2026-102428?#":{"basis":"commit","blobs":["41f768621b5486bbe721c3851c3568f23e38f54c"],"checked":"2026-10-10T09:07:48Z","commit":"2026-10-10T08:38:37Z","commit_verified":true,"created":"2026-10-10T08:37:51Z","cve":"CVE-2026-102428","head":"fb7dbb6e7543a20fc5badfa34fe25bf01a386f52","history_paths":["poc.py"],"history_version":3,"paths":["poc.py"],"pushed_at":"2026-10-10T08:38:38Z","released":"2026-10-10T08:38:37Z","repo":1412962445,"rev":"39ae214c431cb166240a77fd86aad161af0af14ec4e47a093f070430d06ad654","seen":"2026-10-10T09:07:49Z","sha":"fb7dbb6e7543a20fc5badfa34fe25bf01a386f52","url":"https://github.com/murrez/CVE-2026-102428"}, "CVE-2026-10243 github:xmyronn/cve-2026-10243-auth?#":{"basis":"unknown","cve":"CVE-2026-10243","imported":true,"released":null,"url":"https://github.com/Xmyronn/CVE-2026-10243-AUTH"}, "CVE-2026-10243 github:xmyronn/smart-parking-system-broken-access.git?#":{"basis":"unknown","cve":"CVE-2026-10243","imported":true,"released":null,"url":"https://github.com/Xmyronn/smart-parking-system-broken-access.git"}, "CVE-2026-10244 github:timeflies123/cve/issues/2?#":{"basis":"unknown","cve":"CVE-2026-10244","imported":true,"released":null,"url":"https://github.com/timeflies123/cve/issues/2"}, @@ -941,7 +942,7 @@ "CVE-2026-1064 github:analogyc0de/public_exp/blob/main/archives/Bastillion/report2.md?#":{"basis":"unknown","cve":"CVE-2026-1064","imported":true,"released":null,"url":"https://github.com/AnalogyC0de/public_exp/blob/main/archives/Bastillion/report2.md"}, "CVE-2026-106443 github:advisories/ghsa-r543-q48m-4c9j?#":{"basis":"unknown","cve":"CVE-2026-106443","released":null,"seen":"2026-10-08T10:27:18Z","url":"https://github.com/advisories/GHSA-r543-q48m-4c9j"}, "CVE-2026-106445 github:advisories/ghsa-p8wg-vrv2-v86f?#":{"basis":"unknown","cve":"CVE-2026-106445","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f"}, -"CVE-2026-106445 github:murrez/cve-2026-106445?#":{"basis":"unknown","cve":"CVE-2026-106445","released":null,"seen":"2026-10-10T08:41:38Z","url":"https://github.com/murrez/CVE-2026-106445"}, +"CVE-2026-106445 github:murrez/cve-2026-106445?#":{"basis":"commit","blobs":["ffb193788e100b5ce050c1fba580742d8c7673d9"],"checked":"2026-10-10T09:07:48Z","commit":"2026-10-10T08:25:36Z","commit_verified":true,"created":"2026-10-10T08:24:22Z","cve":"CVE-2026-106445","head":"82fe1365b9d5564497069d35e69ac8ecc4c04013","history_paths":["poc.py"],"history_version":3,"paths":["poc.py"],"pushed_at":"2026-10-10T08:25:37Z","released":"2026-10-10T08:25:36Z","repo":1412950847,"rev":"198f605112b9cf66073c9f2ab4289f0c6c225e53e5dbaba44c3d752ecddc3f34","seen":"2026-10-10T08:41:38Z","sha":"82fe1365b9d5564497069d35e69ac8ecc4c04013","url":"https://github.com/murrez/CVE-2026-106445"}, "CVE-2026-106446 github:advisories/ghsa-8r5x-fm3f-whwj?#":{"basis":"unknown","cve":"CVE-2026-106446","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj"}, "CVE-2026-106454 github:advisories/ghsa-8pqf-f4m5-798g?#":{"basis":"unknown","cve":"CVE-2026-106454","released":null,"seen":"2026-10-08T10:27:18Z","url":"https://github.com/advisories/GHSA-8pqf-f4m5-798g"}, "CVE-2026-10650 github:biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py?#":{"basis":"unknown","cve":"CVE-2026-10650","imported":true,"released":null,"url":"https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py"}, @@ -992,7 +993,7 @@ "CVE-2026-107388 github:advisories/ghsa-jjpr-9cvf-cq55?#":{"basis":"unknown","cve":"CVE-2026-107388","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-jjpr-9cvf-cq55"}, "CVE-2026-107391 github:advisories/ghsa-f94x-6692-553q?#":{"basis":"unknown","cve":"CVE-2026-107391","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-f94x-6692-553q"}, "CVE-2026-107392 github:advisories/ghsa-8j4c-6x6g-rq3j?#":{"basis":"unknown","cve":"CVE-2026-107392","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-8j4c-6x6g-rq3j"}, -"CVE-2026-107406 github:apexbreach/cve-2026-107406-poc?#":{"basis":"pending","checked":"2026-10-10T05:08:00Z","created":"2026-10-09T08:34:38Z","cve":"CVE-2026-107406","head":"0ab81ac47208c7f6fad40006b5f5bc2bf49b9f17","pending":true,"pushed_at":"2026-10-09T09:09:24Z","released":null,"repo":1411531399,"seen":"2026-10-09T09:31:09Z","url":"https://github.com/ApexBreach/CVE-2026-107406-Poc"}, +"CVE-2026-107406 github:apexbreach/cve-2026-107406-poc?#":{"basis":"pending","checked":"2026-10-10T09:08:16Z","created":"2026-10-09T08:34:38Z","cve":"CVE-2026-107406","head":"0ab81ac47208c7f6fad40006b5f5bc2bf49b9f17","pending":true,"pushed_at":"2026-10-09T09:09:24Z","released":null,"repo":1411531399,"seen":"2026-10-09T09:31:09Z","url":"https://github.com/ApexBreach/CVE-2026-107406-Poc"}, "CVE-2026-107406 github:techupdate24/citrix-netscaler-rce-cve-2026-107406?#":{"basis":"pending","checked":"2026-10-10T08:08:37Z","created":"2026-10-09T04:38:49Z","cve":"CVE-2026-107406","head":"2bb0de5094ea438001a28f9d152c464986de63b4","pending":true,"pushed_at":"2026-10-09T04:38:55Z","released":null,"repo":1411290380,"seen":"2026-10-09T05:07:55Z","url":"https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406"}, "CVE-2026-107449 github:kashishtopi/heimdall-unauth-ssrf?#":{"basis":"unknown","cve":"CVE-2026-107449","released":null,"seen":"2026-10-09T09:31:09Z","url":"https://github.com/kashishtopi/heimdall-unauth-ssrf"}, "CVE-2026-107450 github:kashishtopi/stump-smartlist-bola?#":{"basis":"unknown","cve":"CVE-2026-107450","released":null,"seen":"2026-10-09T09:31:09Z","url":"https://github.com/kashishtopi/stump-smartlist-bola"}, @@ -1014,7 +1015,7 @@ "CVE-2026-107724 github:advisories/ghsa-g3jj-5cmm-3hxx?#":{"basis":"unknown","cve":"CVE-2026-107724","released":null,"seen":"2026-10-09T10:25:35Z","url":"https://github.com/advisories/GHSA-g3jj-5cmm-3hxx"}, "CVE-2026-10775 github:sgl-project/sglang/issues/25462?#":{"basis":"unknown","cve":"CVE-2026-10775","imported":true,"released":null,"url":"https://github.com/sgl-project/sglang/issues/25462"}, "CVE-2026-10777 github:ealpha072/student-management-system/issues/2?#":{"basis":"unknown","cve":"CVE-2026-10777","imported":true,"released":null,"url":"https://github.com/ealpha072/Student-Management-System/issues/2"}, -"CVE-2026-107806 github:murrez/cve-2026-107806?#":{"basis":"unknown","cve":"CVE-2026-107806","released":null,"seen":"2026-10-10T08:41:38Z","url":"https://github.com/murrez/CVE-2026-107806"}, +"CVE-2026-107806 github:murrez/cve-2026-107806?#":{"basis":"commit","blobs":["29508fbc486c794c6369e0dbc75d580170000125"],"checked":"2026-10-10T09:07:48Z","commit":"2026-10-10T08:17:30Z","commit_verified":true,"created":"2026-10-10T08:17:07Z","cve":"CVE-2026-107806","head":"adb94d21171dfc5a3c01b2a6ebe1f0bc7de0e5b9","history_paths":["poc.py"],"history_version":3,"paths":["poc.py"],"pushed_at":"2026-10-10T08:17:31Z","released":"2026-10-10T08:17:30Z","repo":1412944401,"rev":"7a5ea802a8bf30401f6e0a36c134664196bbf34f53331d02998da1b6d596badc","seen":"2026-10-10T08:41:38Z","sha":"adb94d21171dfc5a3c01b2a6ebe1f0bc7de0e5b9","url":"https://github.com/murrez/CVE-2026-107806"}, "CVE-2026-10783 github:gradio-app/gradio/issues/13395?#":{"basis":"unknown","cve":"CVE-2026-10783","imported":true,"released":null,"url":"https://github.com/gradio-app/gradio/issues/13395"}, "CVE-2026-10795 github:izxci/cve-2026-10795?#":{"basis":"unknown","cve":"CVE-2026-10795","imported":true,"released":null,"url":"https://github.com/izxci/CVE-2026-10795"}, "CVE-2026-10795 github:projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-10795.yaml?#":{"basis":"unknown","cve":"CVE-2026-10795","imported":true,"released":null,"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2026/CVE-2026-10795.yaml"}, @@ -3561,7 +3562,7 @@ "CVE-2026-21589 github:0xblackash/cve-2026-21589?#":{"basis":"commit","blobs":["ea6d9269d791f32f99dced1a1ac1d3c83ba8a54a"],"checked":"2026-10-07T16:09:46Z","commit":"2026-10-07T16:02:15Z","commit_verified":true,"copy":"CVE-2026-21589 github:marcusprogram/cve-2026-21589?#","created":"2026-10-07T15:41:20Z","cve":"CVE-2026-21589","head":"66dfe8ed84e09f77866e34d9ddc11375db8874f9","history_paths":["CVE-2026-21589.py"],"history_version":3,"paths":["CVE-2026-21589.py"],"pushed_at":"2026-10-07T16:02:15Z","released":"2026-10-06T15:51:43Z","repo":1409019111,"rev":"fe3cdf4367adb0a2c3026a3d954c204e7ec7c4ec39166ee2ceaeda7c0438ac43","seen":"2026-10-07T16:09:53Z","sha":"66dfe8ed84e09f77866e34d9ddc11375db8874f9","url":"https://github.com/0xBlackash/CVE-2026-21589"}, "CVE-2026-21589 github:aduli198/cve-2026-21589?#":{"basis":"commit","blobs":["c36930227d632cac27206146421a062cd0e5ccce"],"checked":"2026-10-07T12:09:09Z","commit":"2026-10-07T09:10:12Z","commit_verified":true,"created":"2026-10-07T09:03:00Z","cve":"CVE-2026-21589","head":"3c08a1ae4fe83563b3f9bafb4855720a2f508ce5","history_paths":["cve-2026-21589-admin-takeover.py"],"history_version":3,"paths":["cve-2026-21589-admin-takeover.py"],"pushed_at":"2026-10-07T09:10:13Z","released":"2026-10-07T09:10:12Z","repo":1408523550,"rev":"508d2ae01d6fd8a9756fd484b1a417d7f7704aa7bb66ed1b934f7c7c09bf6df8","seen":"2026-10-07T12:09:17Z","sha":"3c08a1ae4fe83563b3f9bafb4855720a2f508ce5","url":"https://github.com/aduli198/CVE-2026-21589"}, "CVE-2026-21589 github:bimboxh4/cve-2026-21589?#":{"basis":"commit","blobs":["27abcc0574ee699c79fdbaf5e6d9b08799be02ea"],"checked":"2026-10-07T16:09:46Z","commit":"2026-10-07T13:45:58Z","commit_verified":true,"created":"2026-10-07T13:44:41Z","cve":"CVE-2026-21589","head":"b1e96131abe70968708195a1561e00631f9b556a","history_paths":["CVE-2026-21589.py"],"history_version":3,"paths":["CVE-2026-21589.py"],"pushed_at":"2026-10-07T13:45:59Z","released":"2026-10-07T13:45:58Z","repo":1408857126,"rev":"a70f0486d8e3fd2de4a322121eed4619d9b3f124969e8f5272f0373012e74d1d","seen":"2026-10-07T16:09:53Z","sha":"b1e96131abe70968708195a1561e00631f9b556a","url":"https://github.com/BimBoxH4/CVE-2026-21589"}, -"CVE-2026-21589 github:gotr00t0day/cve-2026-21589?#":{"basis":"pending","checked":"2026-10-10T05:07:34Z","created":"2026-10-09T19:15:01Z","cve":"CVE-2026-21589","head":"c8693a427f8d2df54b3c1308cfef4eef52c032e5","pending":true,"pushed_at":"2026-10-09T19:17:27Z","released":null,"repo":1412343154,"seen":"2026-10-09T20:08:35Z","url":"https://github.com/gotr00t0day/CVE-2026-21589"}, +"CVE-2026-21589 github:gotr00t0day/cve-2026-21589?#":{"basis":"pending","checked":"2026-10-10T09:07:53Z","created":"2026-10-09T19:15:01Z","cve":"CVE-2026-21589","head":"c8693a427f8d2df54b3c1308cfef4eef52c032e5","pending":true,"pushed_at":"2026-10-09T19:17:27Z","released":null,"repo":1412343154,"seen":"2026-10-09T20:08:35Z","url":"https://github.com/gotr00t0day/CVE-2026-21589"}, "CVE-2026-21589 github:marcusprogram/cve-2026-21589?#":{"basis":"commit","blobs":["ea6d9269d791f32f99dced1a1ac1d3c83ba8a54a"],"checked":"2026-10-06T22:56:53Z","commit":"2026-10-06T15:51:43Z","commit_verified":true,"created":"2026-10-06T15:43:34Z","cve":"CVE-2026-21589","head":"52c0899dad92ea6a6a1f8d33818ec100843d0009","history_paths":["cve-2026-21589.py"],"history_version":3,"imported":true,"paths":["cve-2026-21589.py"],"pushed_at":"2026-10-06T15:51:43Z","released":"2026-10-06T15:51:43Z","repo":1407557235,"rev":"fe3cdf4367adb0a2c3026a3d954c204e7ec7c4ec39166ee2ceaeda7c0438ac43","sha":"52c0899dad92ea6a6a1f8d33818ec100843d0009","url":"https://github.com/MarcusProgram/CVE-2026-21589"}, "CVE-2026-21589 github:murrez/cve-2026-21589?#":{"basis":"commit","blobs":["136f712815092e8114cfff8de174fd243a3e49d2"],"checked":"2026-10-08T09:08:34Z","commit":"2026-10-08T08:31:47Z","commit_verified":true,"created":"2026-10-08T08:31:03Z","cve":"CVE-2026-21589","head":"fee5ad1221487ba4ee139a062c4b1582b1501310","history_paths":["poc.py"],"history_version":3,"paths":["poc.py"],"pushed_at":"2026-10-08T08:31:48Z","released":"2026-10-08T08:31:47Z","repo":1409993065,"rev":"e07b250487408e0be4668aaf8fc0c559a86b79dc22c678fc16cdb021077e009c","seen":"2026-10-08T09:08:36Z","sha":"fee5ad1221487ba4ee139a062c4b1582b1501310","url":"https://github.com/murrez/CVE-2026-21589"}, "CVE-2026-21589 github:projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml?#":{"basis":"unknown","cve":"CVE-2026-21589","released":null,"seen":"2026-10-07T11:11:43Z","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21589.yaml"}, diff --git a/index/trending.json b/index/trending.json index e83072dd83c..b319f30ff93 100644 --- a/index/trending.json +++ b/index/trending.json @@ -10,7 +10,7 @@ "pushed": "2026-08-20T21:56:15Z", "released": null, "basis": "pending", - "score": 3.413884131698165, + "score": 3.4119786207245397, "trending": true, "created": "2026-08-15T20:57:13Z", "cve": "CVE-2026-9830", @@ -27,7 +27,7 @@ "pushed": "2026-09-29T06:20:46Z", "released": "2026-09-29T06:20:46Z", "basis": "commit", - "score": 1.8145372569031324, + "score": 1.8102337647561293, "trending": true, "created": "2026-02-05T10:21:22Z", "cve": "CVE-2026-41096", @@ -44,7 +44,7 @@ "pushed": "2026-07-27T19:12:07Z", "released": "2026-07-24T03:30:17Z", "basis": "commit", - "score": 1.6822959292146251, + "score": 1.6816860259357294, "trending": true, "created": "2026-07-23T18:54:34Z", "cve": "CVE-2026-54121", @@ -61,7 +61,7 @@ "pushed": "2026-08-22T04:49:54Z", "released": "2026-08-22T04:49:54Z", "basis": "commit", - "score": 1.290914717731314, + "score": 1.2901756881763031, "trending": true, "created": "2026-08-22T04:49:33Z", "cve": "CVE-2026-62911", @@ -78,7 +78,7 @@ "pushed": "2026-09-29T07:52:23Z", "released": "2026-09-29T07:57:18Z", "basis": "created", - "score": 0.929785979188945, + "score": 0.9275685556524352, "trending": true, "created": "2026-09-29T07:57:18Z", "cve": "CVE-2026-94545", @@ -95,7 +95,7 @@ "pushed": "2026-09-11T16:33:14Z", "released": null, "basis": "pending", - "score": 0.927280520849745, + "score": 0.9263832860262603, "trending": true, "created": "2026-09-10T11:28:38Z", "cve": "CVE-2026-20805", @@ -112,7 +112,7 @@ "pushed": "2026-09-12T00:03:49Z", "released": null, "basis": "pending", - "score": 0.8935753355234495, + "score": 0.8927015031470245, "trending": true, "created": "2026-09-12T00:03:07Z", "cve": "CVE-2026-21858", @@ -129,7 +129,7 @@ "pushed": "2026-08-26T02:23:55Z", "released": "2026-08-25T19:06:37Z", "basis": "created", - "score": 0.7718499169580947, + "score": 0.7713739411719385, "trending": true, "created": "2026-08-25T19:06:37Z", "cve": "CVE-2026-75604", @@ -146,7 +146,7 @@ "pushed": "2026-09-03T20:38:35Z", "released": null, "basis": "pending", - "score": 0.7356730533768242, + "score": 0.7351097797574498, "trending": true, "created": "2026-09-02T20:12:10Z", "cve": "CVE-2026-65343", @@ -163,7 +163,7 @@ "pushed": "2026-08-03T15:31:59Z", "released": null, "basis": "pending", - "score": 0.6045527887180903, + "score": 0.6043001244547843, "trending": true, "created": "2026-08-03T15:29:22Z", "cve": "CVE-2026-47301", @@ -180,7 +180,7 @@ "pushed": "2026-09-24T02:47:40Z", "released": "2026-09-24T02:47:40Z", "basis": "commit", - "score": 0.5896721709016064, + "score": 0.588690798376972, "trending": true, "created": "2026-09-24T00:22:30Z", "cve": "CVE-2026-84543", @@ -197,7 +197,7 @@ "pushed": "2026-09-22T19:36:47Z", "released": null, "basis": "pending", - "score": 0.5463965949504848, + "score": 0.5455509053473936, "trending": true, "created": "2026-09-22T18:40:26Z", "cve": "CVE-2026-87902", @@ -214,7 +214,7 @@ "pushed": "2026-09-27T19:48:09Z", "released": "2026-09-27T19:47:52Z", "basis": "commit", - "score": 0.5415280199354813, + "score": 0.540380126648365, "trending": true, "created": "2026-09-27T19:41:06Z", "cve": "CVE-2026-34990", @@ -231,7 +231,7 @@ "pushed": "2026-07-18T21:09:06Z", "released": null, "basis": "pending", - "score": 0.5231446029838076, + "score": 0.522966758510966, "trending": true, "created": "2026-07-14T14:21:27Z", "cve": "CVE-2026-43499", @@ -248,7 +248,7 @@ "pushed": "2026-10-07T01:07:28Z", "released": "2026-09-22T18:13:48Z", "basis": "created", - "score": 0.48929088246300867, + "score": 0.4885359229417268, "trending": true, "created": "2026-09-22T18:13:48Z", "cve": "CVE-2026-87902", @@ -265,7 +265,7 @@ "pushed": "2026-09-28T05:17:40Z", "released": "2026-09-28T05:17:40Z", "basis": "commit", - "score": 0.46373040940210014, + "score": 0.46271785881350197, "trending": true, "created": "2026-09-28T04:47:10Z", "cve": "CVE-2026-85706", @@ -282,7 +282,7 @@ "pushed": "2026-09-11T16:38:12Z", "released": "2026-09-11T15:54:48Z", "basis": "commit", - "score": 0.43312997817740856, + "score": 0.4327112589040028, "trending": true, "created": "2026-09-11T15:24:22Z", "cve": "CVE-2026-85706", @@ -299,7 +299,7 @@ "pushed": "2026-10-03T08:14:17Z", "released": null, "basis": "pending", - "score": 0.42875913306648405, + "score": 0.4272347704571028, "trending": true, "created": "2026-04-07T12:02:52Z", "cve": "CVE-2024-56426", @@ -316,7 +316,7 @@ "pushed": "2026-10-06T10:48:38Z", "released": "2026-10-06T10:48:38Z", "basis": "commit", - "score": 0.42706149774873436, + "score": 0.4245708926813585, "trending": true, "created": "2026-10-06T10:40:59Z", "cve": "CVE-2026-21589", @@ -333,7 +333,7 @@ "pushed": "2026-09-28T09:24:46Z", "released": "2026-09-28T09:24:46Z", "basis": "commit", - "score": 0.41402095794136834, + "score": 0.4131049995371968, "trending": true, "created": "2026-09-27T18:15:38Z", "cve": "CVE-2026-88771", @@ -350,7 +350,7 @@ "pushed": "2026-09-21T15:02:37Z", "released": "2026-09-21T15:02:37Z", "basis": "commit", - "score": 0.4023743056527107, + "score": 0.40178906645075085, "trending": true, "created": "2026-09-21T15:02:05Z", "cve": "CVE-2026-43786", @@ -367,7 +367,7 @@ "pushed": "2026-08-10T23:15:22Z", "released": "2026-08-10T23:15:36Z", "basis": "created", - "score": 0.13325885426590128, + "score": 0.13319666071044636, "trending": true, "created": "2026-08-10T23:15:36Z", "cve": "CVE-2025-7771", @@ -384,31 +384,13 @@ "pushed": null, "released": "2026-10-09T06:06:02Z", "basis": "commit", - "score": 0.12917110519352604, + "score": 0.1274289089765529, "trending": false, "created": "2026-10-09T06:02:44Z", "cve": "CVE-2026-80428", "kev": false, "landed": true }, - { - "year": 2023, - "stars": 2, - "name": "CVE-2023-54391-RCE", - "url": "https://github.com/alexand0www/CVE-2023-54391-RCE", - "artifact": false, - "source": "github.com", - "desc": "CVE-2023-54391: Proxmox VE Authentication Bypass RCE Exploit", - "pushed": null, - "released": "2026-10-08T20:42:15Z", - "basis": "commit", - "score": 0.1145262174775585, - "trending": false, - "created": "2026-10-06T08:49:34Z", - "cve": "CVE-2023-54391", - "kev": false, - "landed": true - }, { "year": 2026, "stars": 1, @@ -420,7 +402,7 @@ "pushed": null, "released": "2026-10-10T00:42:30Z", "basis": "commit", - "score": 0.08939070192529747, + "score": 0.0874909178471062, "trending": false, "created": "2026-10-10T00:40:47Z", "cve": "CVE-2026-84520", @@ -438,7 +420,7 @@ "pushed": "2026-09-17T02:22:58Z", "released": "2026-09-17T02:22:58Z", "basis": "commit", - "score": 0.08123718498327459, + "score": 0.08114128195758849, "trending": true, "created": "2026-09-16T23:32:09Z", "cve": "CVE-2025-32432", @@ -455,7 +437,7 @@ "pushed": "2026-08-27T07:13:42Z", "released": null, "basis": "pending", - "score": 0.07522011268497752, + "score": 0.07517228643537269, "trending": true, "created": "2026-08-19T09:39:46Z", "cve": "CVE-2025-21479", @@ -472,7 +454,7 @@ "pushed": "2026-08-20T01:33:10Z", "released": "2026-08-20T01:20:07Z", "basis": "commit", - "score": 0.047433333423203286, + "score": 0.047407351035019335, "trending": true, "created": "2026-08-20T01:13:39Z", "cve": "CVE-2025-21479", @@ -489,7 +471,7 @@ "pushed": "2026-08-02T06:48:32Z", "released": "2026-07-28T09:37:42Z", "basis": "commit", - "score": 0.042134996879616415, + "score": 0.04211889066810863, "trending": true, "created": "2026-07-28T06:41:38Z", "cve": "CVE-2025-21479", @@ -506,7 +488,7 @@ "pushed": "2026-08-06T14:58:53Z", "released": "2026-08-06T14:58:53Z", "basis": "commit", - "score": 0.04041815215105865, + "score": 0.04040053503011562, "trending": true, "created": "2026-08-06T13:52:33Z", "cve": "CVE-2025-8045", @@ -523,7 +505,7 @@ "pushed": "2026-07-22T19:46:33Z", "released": null, "basis": "pending", - "score": 0.030052516325184044, + "score": 0.03004186277041074, "trending": true, "created": "2026-07-22T19:43:34Z", "cve": "CVE-2023-36003", @@ -540,7 +522,7 @@ "pushed": "2026-08-15T06:21:41Z", "released": null, "basis": "pending", - "score": 0.025491390123239286, + "score": 0.025478643052997036, "trending": true, "created": "2026-08-15T06:12:04Z", "cve": "CVE-2024-56426", @@ -557,7 +539,7 @@ "pushed": "2026-08-28T00:05:41Z", "released": "2026-08-28T00:05:42Z", "basis": "created", - "score": 0.022815824975820864, + "score": 0.022801088516814574, "trending": true, "created": "2026-08-28T00:05:42Z", "cve": "CVE-2025-3248", @@ -574,7 +556,7 @@ "pushed": "2026-07-21T16:55:33Z", "released": null, "basis": "pending", - "score": 0.019842461580733065, + "score": 0.019835498606787468, "trending": true, "created": "2026-07-21T16:52:22Z", "cve": "CVE-2025-32432", @@ -591,7 +573,7 @@ "pushed": "2026-08-18T01:39:34Z", "released": null, "basis": "pending", - "score": 0.01980481062609618, + "score": 0.01979435904069261, "trending": true, "created": "2026-08-18T02:31:53Z", "cve": "CVE-2025-21479", @@ -608,7 +590,7 @@ "pushed": "2026-07-19T11:00:00Z", "released": "2026-07-19T11:00:00Z", "basis": "commit", - "score": 0.019468894530347797, + "score": 0.019462245570976408, "trending": true, "created": "2026-07-19T10:49:05Z", "cve": "CVE-2025-64512", @@ -625,7 +607,7 @@ "pushed": "2026-07-17T13:55:11Z", "released": null, "basis": "pending", - "score": 0.01916941818477495, + "score": 0.01916301482938964, "trending": true, "created": "2026-07-17T13:46:16Z", "cve": "CVE-2025-8110", @@ -642,7 +624,7 @@ "pushed": "2026-07-29T21:15:12Z", "released": "2026-07-29T21:15:12Z", "basis": "commit", - "score": 0.01602342945942185, + "score": 0.016017202719966008, "trending": true, "created": "2026-07-29T19:59:36Z", "cve": "CVE-2024-36104", @@ -659,7 +641,7 @@ "pushed": "2026-07-27T07:00:54Z", "released": "2026-07-27T06:52:27Z", "basis": "commit", - "score": 0.015638113648325663, + "score": 0.015632244848860218, "trending": true, "created": "2026-07-27T06:51:21Z", "cve": "CVE-2023-52076", @@ -676,7 +658,7 @@ "pushed": "2026-07-20T13:33:10Z", "released": "2026-07-20T13:33:10Z", "basis": "commit", - "score": 0.014738011858869403, + "score": 0.014732911331393058, "trending": true, "created": "2026-02-13T22:26:25Z", "cve": "CVE-2025-6019", @@ -693,12 +675,66 @@ "pushed": "2026-10-08T15:42:17Z", "released": "2025-09-09T01:31:54Z", "basis": "commit", - "score": 0.00983190275245363, + "score": 0.00983119615282421, "trending": true, "created": "2025-09-08T21:12:19Z", "cve": "CVE-2022-22077", "kev": false }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-102428", + "url": "https://github.com/murrez/CVE-2026-102428", + "artifact": false, + "source": "github.com", + "desc": "CVE-2026-102428 PoC: OrdaSoft Joomla OS CCK (com_os_cck) <=8.3.15 unauth SQLi - order_field/order_direction ORDER BY injection on public listings. Check + mass exploit, POCBIT-102428-OK marker, CVSS 9.3. https://pocbit.org/pocs/cve-2026-102428", + "pushed": null, + "released": "2026-10-10T08:38:37Z", + "basis": "commit", + "score": 0.0, + "trending": false, + "created": "2026-10-10T08:37:51Z", + "cve": "CVE-2026-102428", + "kev": false, + "landed": true + }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-106445", + "url": "https://github.com/murrez/CVE-2026-106445", + "artifact": false, + "source": "github.com", + "desc": "CVE-2026-106445 - Handlebars 4.0.0-4.7.9 RCE via Function.prototype.constructor bypass (GHSA-p8wg-vrv2-v86f). PoCbit PoC + Docker lab (4.7.9), check/exploit HTTP client, GHSA template chain. Fixed 4.7.10. https://pocbit.org/pocs/cve-2026-106445", + "pushed": null, + "released": "2026-10-10T08:25:36Z", + "basis": "commit", + "score": 0.0, + "trending": false, + "created": "2026-10-10T08:24:22Z", + "cve": "CVE-2026-106445", + "kev": false, + "landed": true + }, + { + "year": 2026, + "stars": 0, + "name": "CVE-2026-107806", + "url": "https://github.com/murrez/CVE-2026-107806", + "artifact": false, + "source": "github.com", + "desc": "CVE-2026-107806 - nginx-ui 2.3.8-2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch url/JWT. Fixed 2.5.0. https://pocbit.org/pocs/cve-2026-107806", + "pushed": null, + "released": "2026-10-10T08:17:30Z", + "basis": "commit", + "score": 0.0, + "trending": false, + "created": "2026-10-10T08:17:07Z", + "cve": "CVE-2026-107806", + "kev": false, + "landed": true + }, { "year": 2026, "stars": 0, @@ -788,41 +824,5 @@ "cve": "CVE-2024-36774", "kev": false, "landed": true - }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-55450", - "url": "https://github.com/0xBlackash/CVE-2026-55450", - "artifact": false, - "source": "github.com", - "desc": "Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.", - "pushed": null, - "released": "2026-10-08T22:58:38Z", - "basis": "commit", - "score": 0.0, - "trending": false, - "created": "2026-10-08T22:48:26Z", - "cve": "CVE-2026-55450", - "kev": false, - "landed": true - }, - { - "year": 2026, - "stars": 0, - "name": "CVE-2026-91940-crawl4ai-Arbitrary-File-Write", - "url": "https://github.com/BiiTts/CVE-2026-91940-crawl4ai-Arbitrary-File-Write", - "artifact": false, - "source": "github.com", - "desc": "CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate (PDFContentScrapingStrategy image_save_dir). Analysis, reproduction harness and verified 0.9.2 vs 0.9.3 boundary.", - "pushed": null, - "released": "2026-10-08T20:54:07Z", - "basis": "created", - "score": 0.0, - "trending": false, - "created": "2026-10-08T20:54:07Z", - "cve": "CVE-2026-91940", - "kev": false, - "landed": true } ]