From d50180cfe5ee61b7c71a90fb333409d281b480cc Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sat, 5 Sep 2026 11:08:52 +0000 Subject: [PATCH] Trending CVEs update 2026-09-05 11:08 :robot: --- README.md | 18 +++++++++--------- cves/2026/CVE-2026-14894.md | 1 + cves/2026/CVE-2026-15981.md | 1 + cves/2026/CVE-2026-18366.md | 1 + cves/2026/CVE-2026-3891.md | 1 + cves/2026/CVE-2026-56290.md | 1 + index/github.txt | 5 +++++ 7 files changed, 19 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 80c009202c4..c36c612b666 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-05%20Sep%202026%2010%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609051007)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C646-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609051007)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-05%20Sep%202026%2011%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202609051107)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-82%2C646-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C186-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202609051107)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,11 +12,11 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 2⭐ | 3h ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… | -| 0⭐ | 6h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | -| 1⭐ | 11h ago | [CVE-2025-9974](https://github.com/Rajdave69/CVE-2025-9974) | Proof of Concept code for the CVE-2025-9974 affecting Nokia Beacon routers. | -| 0⭐ | 21h ago | [CVE-2026-19516](https://github.com/HORKimhab/CVE-2026-19516) | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests,… | -| 2⭐ | 23h ago | [CVE-2026-65643-PoC-Toolkit](https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit) | 🧰 CVE-2026-65643 - cPanel Domain Parking RCE Toolkit (CVSS 8.7) / Red/Blue Team suite for unpatched cPanel &… | +| 2⭐ | 4h ago | [cve-2026-32475-elementor-pro-lab](https://github.com/dinosn/cve-2026-32475-elementor-pro-lab) | A/B Docker lab + PoC for CVE-2026-32475 (Elementor Pro Forms unauthenticated arbitrary file upload -> RCE via… | +| 0⭐ | 7h ago | KEV [Langflow-RCE-CVE-2025-3248](https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248) | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… | +| 1⭐ | 12h ago | [CVE-2025-9974](https://github.com/Rajdave69/CVE-2025-9974) | Proof of Concept code for the CVE-2025-9974 affecting Nokia Beacon routers. | +| 0⭐ | 22h ago | [CVE-2026-19516](https://github.com/HORKimhab/CVE-2026-19516) | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests,… | +| 2⭐ | 1d ago | [CVE-2026-65643-PoC-Toolkit](https://github.com/tc4dy/CVE-2026-65643-PoC-Toolkit) | 🧰 CVE-2026-65643 - cPanel Domain Parking RCE Toolkit (CVSS 8.7) / Red/Blue Team suite for unpatched cPanel &… | | 2⭐ | 1d ago | [CVE-2026-65349](https://github.com/ByteV0rtex/CVE-2026-65349) | CVE-2026-65349 PoC - getattrlist OOB write in vfs_attr_pack_internal (iOS 26.6 / 23G71) | | 4⭐ | 1d ago | [CVE-2026-64788](https://github.com/ByteV0rtex/CVE-2026-64788) | CVE-2026-64788 PoC - IOGPUFamily Use-After-Free (iOS 26.6 / 23G71) | | 0⭐ | 1d ago | [CVE-2026-31787](https://github.com/0xAtharv/CVE-2026-31787) | Linux kernel double free in Xen privcmd driver | @@ -27,8 +27,8 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 5⭐ | 12h ago | KEV [CVE-2026-15409-15410-Framework](https://github.com/tc4dy/CVE-2026-15409-15410-Framework) | CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features:… | -| 3⭐ | 1d ago | [CVE-2026-62735](https://github.com/HackSpeak/CVE-2026-62735) | Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM… | +| 5⭐ | 13h ago | KEV [CVE-2026-15409-15410-Framework](https://github.com/tc4dy/CVE-2026-15409-15410-Framework) | CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework 🔥 SSRF→Erlang RPC→RCE→root privesc. Features:… | +| 3⭐ | 2d ago | [CVE-2026-62735](https://github.com/HackSpeak/CVE-2026-62735) | Windows HTTP.sys integer overflow -> nonpaged pool overflow LPE PoC (CVE-2026-62735): crash + full SYSTEM… | | 7⭐ | 2d ago | [CVE-2026-19490](https://github.com/TarPeg007/CVE-2026-19490) | NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause… | | 3⭐ | 5d ago | [CVE-2026-78904-Digital-Dinar-Drain](https://github.com/vxssroott/CVE-2026-78904-Digital-Dinar-Drain) | CBDC Infrastructure Vulnerability Research. CVE-2026-78904: Infinite mint and redemption bypass in central… | | 16⭐ | 6d ago | [givewp-cve-2026-82222-rce-lab](https://github.com/dinosn/givewp-cve-2026-82222-rce-lab) | Authorized Docker lab and clean PoC for validating CVE-2026-82222 RCE in GiveWP 4.16.5.1 and the 4.16.7.2 fix. | @@ -58,7 +58,7 @@ | 6⭐ | 29d ago | [CVE-2025-8045](https://github.com/kuzeyardabulut/CVE-2025-8045) | Dirty Pagetable Exploit for CVE-2025-8045 | | 7⭐ | 34d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 45d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | -| 4⭐ | 47d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | +| 4⭐ | 48d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | | 5⭐ | 49d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 59d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | | 4⭐ | 64d ago | [CVE-2025-69212-PoC](https://github.com/BridgerAlderson/CVE-2025-69212-PoC) | OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M… | diff --git a/cves/2026/CVE-2026-14894.md b/cves/2026/CVE-2026-14894.md index 0a93dcdf2b2..549caa5b37b 100644 --- a/cves/2026/CVE-2026-14894.md +++ b/cves/2026/CVE-2026-14894.md @@ -17,6 +17,7 @@ No PoCs from references. #### Github - https://github.com/1beelze/CVE-2026-14894 - https://github.com/shinthink/CVE-2026-14894 +- https://github.com/katranSefa/cve_2026_14894 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14894.yaml diff --git a/cves/2026/CVE-2026-15981.md b/cves/2026/CVE-2026-15981.md index 73d9a4f13bd..33c7e739ec5 100644 --- a/cves/2026/CVE-2026-15981.md +++ b/cves/2026/CVE-2026-15981.md @@ -16,3 +16,4 @@ No PoCs from references. #### Github - https://github.com/Nxploited/CVE-2026-15981 +- https://github.com/katranSefa/CVE-2026-15981 diff --git a/cves/2026/CVE-2026-18366.md b/cves/2026/CVE-2026-18366.md index df22bee6ea6..cd01ce70106 100644 --- a/cves/2026/CVE-2026-18366.md +++ b/cves/2026/CVE-2026-18366.md @@ -16,3 +16,4 @@ The Events Manager WordPress plugin before 7.4.1 does not properly scope its ca #### Github - https://github.com/Nxploited/CVE-2026-18366 - https://github.com/ghostpels/CVE-2026-18366 +- https://github.com/katranSefa/CVE-2026-18366 diff --git a/cves/2026/CVE-2026-3891.md b/cves/2026/CVE-2026-3891.md index 0c1f54e3749..3585e7e2efa 100644 --- a/cves/2026/CVE-2026-3891.md +++ b/cves/2026/CVE-2026-3891.md @@ -22,6 +22,7 @@ No PoCs from references. - https://github.com/shinthink/CVE-2026-3891 - https://github.com/VeronnX666/CVE-2026-3891 - https://github.com/Ch4120N/CVE-2026-3891 +- https://github.com/katranSefa/CVE-2026-3891 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-3891.yaml diff --git a/cves/2026/CVE-2026-56290.md b/cves/2026/CVE-2026-56290.md index e505e17642c..453a15dc08c 100644 --- a/cves/2026/CVE-2026-56290.md +++ b/cves/2026/CVE-2026-56290.md @@ -20,6 +20,7 @@ No PoCs from references. - https://github.com/MRCUKIL/com_pagebuilderck - https://github.com/ChiefYoru/CVE-2026-56290_PoC - https://github.com/Jenderal92/CVE-2026-56290 +- https://github.com/katranSefa/CVE-2026-56290 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-56290.yaml diff --git a/index/github.txt b/index/github.txt index eb554625b9a..d9fb6c69283 100644 --- a/index/github.txt +++ b/index/github.txt @@ -26772,3 +26772,8 @@ CVE-2024-6387 - https://github.com/zgzhang/cve-2024-6387-poc CVE-2026-44402 - https://github.com/Virgula0/CVE-2026-44402 CVE-2026-64468 - https://github.com/aramosf/CVE-2026-64468 CVE-2026-6471 - https://github.com/0xBlackash/CVE-2026-6471 +CVE-2026-14894 - https://github.com/katranSefa/cve_2026_14894 +CVE-2026-15981 - https://github.com/katranSefa/CVE-2026-15981 +CVE-2026-18366 - https://github.com/katranSefa/CVE-2026-18366 +CVE-2026-3891 - https://github.com/katranSefa/CVE-2026-3891 +CVE-2026-56290 - https://github.com/katranSefa/CVE-2026-56290