Clean and verify CVE PoC sources

docs/CVE_list.json

@@ -1 +1 @@
-[{"cve": "CVE-2026-0006", "desc": "In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/aydin5245/cve-2026-0006", "https://github.com/mobilehackinglab/CVE-2026-0006-openapv-poc"]}, {"cve": "CVE-2026-0013", "desc": "In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/inforcqb/cve-2026-0013-exploit", "https://github.com/XiaoBaiLovesStirring/cve-2026-0013-poc"]}, {"cve": "CVE-2026-0023", "desc": "In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/QM4RS/CVE-2026-0023-Update-Ownership-PoC"]}, {"cve": "CVE-2026-0047", "desc": "In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/mobilehackinglab/CVE-2026-0047-poc"]}, {"cve": "CVE-2026-0049", "desc": "In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/R3n3r0/CVE-2026-0049"]}, {"cve": "CVE-2026-0059", "desc": "In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/paul-goon/bootlicka-POC"]}, {"cve": "CVE-2026-0073", "desc": "In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC", "https://github.com/adityatelange/poc-CVE-2026-0073", "https://github.com/MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC", "https://github.com/0xBlackash/CVE-2026-0073", "https://github.com/novaek/CVE-2026-0073-Research", "https://github.com/unnaim/adbHijacker", "https://github.com/xqi1337/poc-CVE-2026-0073", "https://github.com/ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN", "https://github.com/m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass", "https://github.com/fredevsec/CVE-2026-0073", "https://github.com/aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass"]}, {"cve": "CVE-2026-0092", "desc": "In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Majorjayyy1/CVE-2026-0092"]}, {"cve": "CVE-2026-0163", "desc": "In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/sentinel-aidefense/CVE-2026-0163-EXP"]}, {"cve": "CVE-2026-0227", "desc": "A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.", "poc": ["https://github.com/TeeyaR/CVE-2026-0227-Palo-Alto"]}, {"cve": "CVE-2026-0257", "desc": "Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\nPanorama and Cloud NGFW are not impacted by these issues.", "poc": ["https://github.com/sfewer-r7/CVE-2026-0257", "https://github.com/0xBlackash/CVE-2026-0257", "https://github.com/tushargurav28/CVE-2026-0257", "https://github.com/akashsingh0454/CVE-2026-0257-PoC", "https://github.com/Mr-Robot-LP/CVE-2Line truncated
+[{"cve": "CVE-2026-0006", "desc": "In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/aydin5245/cve-2026-0006", "https://github.com/mobilehackinglab/CVE-2026-0006-openapv-poc"]}, {"cve": "CVE-2026-0013", "desc": "In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/inforcqb/cve-2026-0013-exploit", "https://github.com/XiaoBaiLovesStirring/cve-2026-0013-poc"]}, {"cve": "CVE-2026-0023", "desc": "In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/QM4RS/CVE-2026-0023-Update-Ownership-PoC"]}, {"cve": "CVE-2026-0047", "desc": "In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/mobilehackinglab/CVE-2026-0047-poc"]}, {"cve": "CVE-2026-0049", "desc": "In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/R3n3r0/CVE-2026-0049"]}, {"cve": "CVE-2026-0059", "desc": "In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/paul-goon/bootlicka-POC"]}, {"cve": "CVE-2026-0073", "desc": "In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC", "https://github.com/adityatelange/poc-CVE-2026-0073", "https://github.com/MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC", "https://github.com/0xBlackash/CVE-2026-0073", "https://github.com/novaek/CVE-2026-0073-Research", "https://github.com/unnaim/adbHijacker", "https://github.com/xqi1337/poc-CVE-2026-0073", "https://github.com/ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN", "https://github.com/m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass", "https://github.com/fredevsec/CVE-2026-0073", "https://github.com/aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass"]}, {"cve": "CVE-2026-0092", "desc": "In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/Majorjayyy1/CVE-2026-0092"]}, {"cve": "CVE-2026-0163", "desc": "In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "poc": ["https://github.com/sentinel-aidefense/CVE-2026-0163-EXP"]}, {"cve": "CVE-2026-0227", "desc": "A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.", "poc": ["https://github.com/TeeyaR/CVE-2026-0227-Palo-Alto"]}, {"cve": "CVE-2026-0257", "desc": "Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\nPanorama and Cloud NGFW are not impacted by these issues.", "poc": ["https://github.com/sfewer-r7/CVE-2026-0257", "https://github.com/0xBlackash/CVE-2026-0257", "https://github.com/tushargurav28/CVE-2026-0257", "https://github.com/akashsingh0454/CVE-2026-0257-PoC", "https://github.com/Mr-Robot-LP/CVE-2Line truncated

docs/generate_cve_list.py

@@ -3,23 +3,22 @@ import json
 import os
 import re
 from pathlib import Path
-from typing import Dict, List, Optional, Tuple
+from typing import Collection, Dict, List, Optional, Tuple
 from urllib.parse import urlparse
 
 ROOT = Path(__file__).resolve().parent.parent
 OUTPUT = Path(__file__).resolve().with_name("CVE_list.json")
-REMOVED_OUTPUT = Path(__file__).resolve().with_name("CVE_blacklist_removed.json")
 BLACKLIST = ROOT / "blacklist.txt"
 
 
-def load_blacklist(path: Path = BLACKLIST) -> List[str]:
+def load_blacklist(path: Path = BLACKLIST) -> set[str]:
     if not path.exists():
-        return []
-    items: List[str] = []
+        return set()
+    items: set[str] = set()
     for raw in path.read_text(encoding="utf-8").splitlines():
         entry = raw.strip()
         if entry and not entry.startswith("#"):
-            items.append(entry)
+            items.add(entry.lower())
     return items
 
 
@@ -34,24 +33,27 @@ def repo_from_url(url: str) -> str:
         path = url
     parts = path.strip("/").split("/")
     if len(parts) >= 2:
-        return parts[1].lower()
+        return "/".join(parts[:2]).lower()
     return (parts[-1] if parts else "").lower()
 
 
-def is_blacklisted(url: str, blacklist: List[str]) -> bool:
-    repo = repo_from_url(url)
-    if not repo:
+def is_blacklisted(url: str, blacklist: Collection[str]) -> bool:
+    full_name = repo_from_url(url)
+    if not full_name:
         return False
-    for entry in blacklist:
-        slug = entry.lower()
-        if not slug:
-            continue
-        if slug.endswith("*"):
-            if repo.startswith(slug[:-1]):
-                return True
-        elif repo == slug:
-            return True
-    return False
+    return full_name in blacklist
+
+
+def link_key(url: str) -> str:
+    parsed = urlparse(url)
+    if (parsed.hostname or "").lower() not in {"github.com", "www.github.com"}:
+        return url
+    parts = [part for part in parsed.path.split("/") if part]
+    if len(parts) < 2:
+        return url
+    repo = f"{parts[0]}/{parts[1]}".lower()
+    suffix = "/" + "/".join(parts[2:]) if len(parts) > 2 else ""
+    return f"github:{repo}{suffix}?{parsed.query}#{parsed.fragment}"
 
 
 def normalise_block(text: str) -> str:
@@ -82,11 +84,9 @@ def parse_sections(content: str) -> Dict[str, str]:
     return sections
 
 
-def collect_links(block: str, *, blacklist: Optional[List[str]] = None, removed: Optional[List[str]] = None) -> List[str]:
+def collect_links(block: str, *, blacklist: Optional[Collection[str]] = None) -> List[str]:
     links: List[str] = []
-    blacklist = blacklist or []
-    if removed is None:
-        removed = []
+    blacklist = blacklist or set()
     for raw in block.splitlines():
         entry = raw.strip()
         if not entry or "No PoCs" in entry:
@@ -96,7 +96,6 @@ def collect_links(block: str, *, blacklist: Optional[List[str]] = None, removed:
         if not entry:
             continue
         if is_blacklisted(entry, blacklist):
-            removed.append(entry)
             continue
         if entry not in links:
             links.append(entry)
@@ -106,8 +105,6 @@ def collect_links(block: str, *, blacklist: Optional[List[str]] = None, removed:
 def main() -> None:
     blacklist = load_blacklist()
     cve_entries = []
-    removed_by_cve: Dict[str, List[str]] = {}
-    removed_seen: set[str] = set()
     years = [entry for entry in os.listdir(ROOT) if entry.isdigit()]
     years.sort(reverse=True)
 
@@ -121,22 +118,18 @@ def main() -> None:
 
             sections = parse_sections(content)
             description = normalise_block(sections.get("### Description", ""))
-            removed_links: List[str] = []
-            references = collect_links(sections.get("#### Reference", ""), blacklist=blacklist, removed=removed_links)
-            github_links = collect_links(sections.get("#### Github", ""), blacklist=blacklist, removed=removed_links)
+            references = collect_links(sections.get("#### Reference", ""), blacklist=blacklist)
+            github_links = collect_links(sections.get("#### Github", ""), blacklist=blacklist)
 
             poc_entries: List[str] = []
             seen = set()
             for link in references + github_links:
-                if link not in seen:
+                key = link_key(link)
+                if key not in seen:
                     poc_entries.append(link)
-                    seen.add(link)
+                    seen.add(key)
 
             cve_id = filename.replace(".md", "")
-            if removed_links:
-                removed_by_cve[cve_id] = sorted(set(removed_links))
-                removed_seen.update(removed_links)
-
             # Skip CVEs with zero PoCs (both sections empty) to keep lookup clean
             if not poc_entries:
                 continue
@@ -150,17 +143,6 @@ def main() -> None:
     with open(OUTPUT, "w", encoding="utf-8") as outfile:
         json.dump(cve_entries, outfile, ensure_ascii=False)
 
-    with open(REMOVED_OUTPUT, "w", encoding="utf-8") as removed_file:
-        json.dump(
-            {
-                "removed": sorted(removed_seen),
-                "by_cve": removed_by_cve,
-            },
-            removed_file,
-            ensure_ascii=False,
-            indent=2,
-        )
-
     print("CVE list saved to CVE_list.json")