From dacec8f6ef90a747001f33a991c2f334f78910d7 Mon Sep 17 00:00:00 2001 From: CVE-BOT Date: Sun, 4 Oct 2026 12:09:04 +0000 Subject: [PATCH] Trending CVEs update 2026-10-04 12:09 :robot: --- README.md | 28 ++++++++++++++-------------- cves/2025/CVE-2025-55182.md | 1 + cves/2026/CVE-2026-19632.md | 1 + cves/2026/CVE-2026-46215.md | 1 - index/github.txt | 26 ++------------------------ index/trending.json | 30 +++++++++++++++--------------- 6 files changed, 33 insertions(+), 54 deletions(-) diff --git a/README.md b/README.md index 962f7371bb2..33bfe3264b4 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ PoC Index -[![last sync](https://img.shields.io/badge/last%20sync-04%20Oct%202026%2009%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610040907)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C012-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610040907)](https://github.com/0xMarcio/pocindex/stargazers) +[![last sync](https://img.shields.io/badge/last%20sync-04%20Oct%202026%2012%3A07%20UTC-2f81f7?style=flat-square&labelColor=161b22)](https://github.com/0xMarcio/pocindex/commits/main) [![CI](https://img.shields.io/github/actions/workflow/status/0xMarcio/pocindex/hot_cves.yml?style=flat-square&label=CI&color=2f81f7&labelColor=161b22&_=202610041207)](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [![CVEs with PoCs](https://img.shields.io/badge/CVEs%20with%20PoCs-84%2C012-2f81f7?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![known exploited](https://img.shields.io/badge/known%20exploited-1%2C221-f85149?style=flat-square&labelColor=161b22)](https://pocindex.io/) [![stars](https://img.shields.io/github/stars/0xMarcio/pocindex?style=flat-square&label=stars&color=e3b341&labelColor=161b22&_=202610041207)](https://github.com/0xMarcio/pocindex/stargazers) Search PoC Index @@ -12,33 +12,33 @@ | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 0⭐ | 10h ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | -| 0⭐ | 15h ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | -| 0⭐ | 1d ago | [CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE](https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE) | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… | +| 0⭐ | 2h ago | KEV [React2Shell_CVE-2025-55182](https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182) | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0,… | +| 0⭐ | 13h ago | [CVE-2025-60787](https://github.com/diamorphine666/CVE-2025-60787) | MotionEye OS Command Injection (CVE-2025-60787) | +| 0⭐ | 18h ago | [CVE-2025-21065](https://github.com/Pealeap/CVE-2025-21065) | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… | +| 0⭐ | 2d ago | [CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE](https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE) | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… | | 0⭐ | 2d ago | [CVE-2025-47947](https://github.com/yel1337/CVE-2025-47947) | POC for libapache2-mod-security2 | -| 0⭐ | 2d ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | +| 0⭐ | 3d ago | KEV [CVE-2025-8110](https://github.com/Makis6/CVE-2025-8110) | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. | | 1⭐ | 3d ago | [CVE-2025-29927](https://github.com/vulnace/CVE-2025-29927) | POC for react2shell | | 0⭐ | 3d ago | [CVE-2025-59528-Poc](https://github.com/Amoru-Bek/CVE-2025-59528-Poc) | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… | -| 1⭐ | 3d ago | KEV [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… | +| 1⭐ | 4d ago | KEV [CVE-2025-31161](https://github.com/0xBlackash/CVE-2025-31161) | CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… | | 0⭐ | 4d ago | [cve-2025-30208](https://github.com/Minseo9503/cve-2025-30208) | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… | -| 0⭐ | 4d ago | KEV [CVE-2025-32463](https://github.com/klvlo/CVE-2025-32463) | PoC / Exploit for CVE-2025-32463(sudo LPE) | ## Trending in 2026 | Stars | Updated | Repository | Description | | --- | --- | --- | --- | -| 13⭐ | 16h ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | -| 825⭐ | 16h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | +| 25⭐ | 19h ago | KEV [cve-2026-41940-PoC](https://github.com/yasouxken/cve-2026-41940-PoC) | A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… | +| 825⭐ | 19h ago | KEV [CVE-2026-24061](https://github.com/jacubes/CVE-2026-24061) | CVE-2026-24061 exploit PoC | | 3⭐ | 2d ago | [CVE-2026-100520-laranode-path-traversal](https://github.com/wvllxe/CVE-2026-100520-laranode-path-traversal) | Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup. | -| 3⭐ | 4d ago | KEV [CVE-2026-87902](https://github.com/tonydelouvre/CVE-2026-87902) | XWP_RCE - CVE-2026-87902 Hacker Console | +| 4⭐ | 4d ago | KEV [CVE-2026-87902](https://github.com/tonydelouvre/CVE-2026-87902) | XWP_RCE - CVE-2026-87902 Hacker Console | | 4⭐ | 4d ago | KEV [CVE-2026-41091-PoC-Exploit](https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit) | CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via… | | 29⭐ | 4d ago | [CVE-2026-54121-PoC-Exploit](https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit) | CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse,… | -| 7⭐ | 4d ago | KEV [CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) | CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… | +| 8⭐ | 4d ago | KEV [CVE-2026-24061-PoC-Exploit](https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit) | CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… | | 6⭐ | 4d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88772](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772) | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before… | | 45⭐ | 5d ago | [CVE-2026-94545](https://github.com/EQSTLab/CVE-2026-94545) | Next.js RCE | | 3⭐ | 5d ago | KEV [CVE-2026-49869](https://github.com/EQSTLab/CVE-2026-49869) | Kestra Unauthenticated RCE | -| 3⭐ | 5d ago | [CVE-2026-56096](https://github.com/yairHinkis/CVE-2026-56096) | Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr) | -| 23⭐ | 5d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… | +| 3⭐ | 6d ago | [CVE-2026-56096](https://github.com/yairHinkis/CVE-2026-56096) | Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr) | +| 23⭐ | 6d ago | KEV [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… | | 25⭐ | 6d ago | KEV [CVE-2026-85706](https://github.com/EQSTLab/CVE-2026-85706) | GitLab Unauthenticated Arbitrary File Read | | 3⭐ | 6d ago | [CVE-2026-78006-CVE-2026-78159](https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159) | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 | | 17⭐ | 6d ago | [CVE-2026-18963](https://github.com/EQSTLab/CVE-2026-18963) | Keycloak reset-credentials flow bypass | @@ -63,7 +63,7 @@ | 7⭐ | 63d ago | KEV [SELinux-Permissive-Only-CVE-2025-21479](https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479) | This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… | | 4⭐ | 74d ago | KEV [CVE-2025-32432](https://github.com/c0gnit00/CVE-2025-32432) | Exploit, POC for CVE-2025-32432, CraftCMS2Shell | | 3⭐ | 75d ago | [CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation](https://github.com/JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation) | CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation | -| 4⭐ | 76d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | +| 4⭐ | 77d ago | [CVE-2025-64512](https://github.com/matesz44/CVE-2025-64512) | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads | | 4⭐ | 78d ago | KEV [CVE-2025-8110-gogs-poc](https://github.com/Shirouuu/CVE-2025-8110-gogs-poc) | PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink | | 7⭐ | 88d ago | [CVE-2025-30065](https://github.com/h3st4k3r/CVE-2025-30065) | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… | diff --git a/cves/2025/CVE-2025-55182.md b/cves/2025/CVE-2025-55182.md index d103794d056..ea889cbd7f9 100644 --- a/cves/2025/CVE-2025-55182.md +++ b/cves/2025/CVE-2025-55182.md @@ -342,6 +342,7 @@ A pre-authentication remote code execution vulnerability exists in React Server - https://github.com/r00tVen0m/react2shell-exploit - https://github.com/mythicemissarymall/zuvmwbnt - https://github.com/PedroPLCode/CVE-2025-55182_react2shell_exploit.py +- https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-55182.yaml diff --git a/cves/2026/CVE-2026-19632.md b/cves/2026/CVE-2026-19632.md index 616c5a50e96..91507a9929a 100644 --- a/cves/2026/CVE-2026-19632.md +++ b/cves/2026/CVE-2026-19632.md @@ -19,6 +19,7 @@ No PoCs from references. - https://github.com/DeadExpl0it/CVE-2026-19632-POC - https://github.com/HackfutSecRoot/multi_exploit_wp/blob/main/multi_exploit.py - https://github.com/HackfutSecRoot/multi_exploit_wp +- https://github.com/TheJesterrrr/CVE-2026-19632 #### Nuclei - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19632.yaml diff --git a/cves/2026/CVE-2026-46215.md b/cves/2026/CVE-2026-46215.md index 2dec5f78374..2700798c4e9 100644 --- a/cves/2026/CVE-2026-46215.md +++ b/cves/2026/CVE-2026-46215.md @@ -42,4 +42,3 @@ v2: cleanups of error paths - https://github.com/bluedragonsecurity/CVE-2026-46215-exploit-linux-7.0-uaf-stable - https://github.com/bluedragonsecurity/sheaf_uaf - https://github.com/bluedragonsecurity/exploits -- https://github.com/0xCyberstan/CVE-2026-46215-POC diff --git a/index/github.txt b/index/github.txt index e098ce6725e..cde3f7bebff 100644 --- a/index/github.txt +++ b/index/github.txt @@ -27158,36 +27158,14 @@ CVE-2022-35405 - https://github.com/CTIresource/Vendor-Verbiage CVE-2023-23752 - https://github.com/s4m98/CVE-2023-23752 CVE-2024-35250 - https://github.com/sunny-boy-fqy/windows-exploit CVE-2024-51482 - https://github.com/diamorphine666/CVE-2024-51482 -CVE-2017-0781 - https://github.com/x3ero0/android712-blueborne -CVE-2018-15133 - https://github.com/pwnedshell/Larascript -CVE-2018-7600 - https://github.com/firefart/CVE-2018-7600 -CVE-2020-8597 - https://github.com/winmin/CVE-2020-8597 -CVE-2020-8816 - https://github.com/martinsohn/CVE-2020-8816 -CVE-2021-3560 - https://github.com/winmin/CVE-2021-3560 -CVE-2021-44228 - https://github.com/mkhazamipour/log4j-vulnerable-app-cve-2021-44228-terraform -CVE-2021-44228 - https://github.com/nikolas-charalambidis/cve-2021-44228 -CVE-2022-24713 - https://github.com/jpeisach/CVE-2022-24713-POC -CVE-2022-31897 - https://github.com/angelopioamirante/CVE-2022-31897 -CVE-2022-33075 - https://github.com/angelopioamirante/CVE-2022-33075 -CVE-2023-23638 - https://github.com/X1r0z/dubbo-rce -CVE-2023-23752 - https://github.com/yusinomy/CVE-2023-23752 -CVE-2023-36664 - https://github.com/jeanchpt/CVE-2023-36664 -CVE-2024-21006 - https://github.com/d3fudd/CVE-2024-21006_PoC -CVE-2024-38063 - https://github.com/Sachinart/CVE-2024-38063-poc -CVE-2024-38063 - https://github.com/brownpanda29/Cve-2024-38063 CVE-2024-6387 - https://github.com/zgzhang/cve-2024-6387-poc -CVE-2025-0133 - https://github.com/inteleon404/CVE-2025-0133 -CVE-2025-31651 - https://github.com/gregk4sec/cve-2025-31651 CVE-2025-32433 - https://github.com/giriaryan694-a11y/cve-2025-32433_rce_exploit -CVE-2025-4123 - https://github.com/NightBloodZ/CVE-2025-4123 -CVE-2025-63353 - https://github.com/zvckster/CVE-2025-63353 CVE-2026-31857 - https://github.com/TRX-0/CVE-2026-31857-craftcms-ssti CVE-2026-33157 - https://github.com/TRX-0/CVE-2026-33157-craftcms-rce CVE-2026-34990 - https://github.com/TRX-0/CVE-2026-34990-cups-lpe -CVE-2026-41089 - https://github.com/1posix/CVE-2026-41089-PoC -CVE-2026-43499 - https://github.com/Cxyofficial/K50G-POCOF4GT-CVE-2026-43499-PoC CVE-2026-44011 - https://github.com/TRX-0/CVE-2026-44011-craftcms-rce -CVE-2026-46215 - https://github.com/0xCyberstan/CVE-2026-46215-POC CVE-2026-55794 - https://github.com/TRX-0/CVE-2026-55794-craftcms-ssti CVE-2026-72778 - https://github.com/TRX-0/CVE-2026-72778-craftcms-rce CVE-2026-72781 - https://github.com/TRX-0/CVE-2026-72781-craftcms-sandbox-rce +CVE-2025-55182 - https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182 +CVE-2026-19632 - https://github.com/TheJesterrrr/CVE-2026-19632 diff --git a/index/trending.json b/index/trending.json index a27d78465bb..4f65a4f60ea 100644 --- a/index/trending.json +++ b/index/trending.json @@ -1,7 +1,7 @@ [ { "year": 2026, - "stars": 13, + "stars": 25, "name": "cve-2026-41940-PoC", "url": "https://github.com/yasouxken/cve-2026-41940-PoC", "desc": "A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header - no credentials required.", @@ -34,7 +34,7 @@ }, { "year": 2026, - "stars": 3, + "stars": 4, "name": "CVE-2026-87902", "url": "https://github.com/tonydelouvre/CVE-2026-87902", "desc": "XWP_RCE - CVE-2026-87902 Hacker Console", @@ -67,7 +67,7 @@ }, { "year": 2026, - "stars": 7, + "stars": 8, "name": "CVE-2026-24061-PoC-Exploit", "url": "https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit", "desc": "CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON leads to auth bypass & instant root shell. Single/Mass exploitation, multi-threading, custom port/user, pipe mode, session keep-alive, colored output, retries, timeout support. Python & Bash versions. Critical CVSS 9.8.", @@ -439,6 +439,18 @@ "cve": "CVE-2023-4911", "kev": true }, + { + "year": 2025, + "stars": 0, + "name": "React2Shell_CVE-2025-55182", + "url": "https://github.com/RashmithaDeSilva/React2Shell_CVE-2025-55182", + "desc": "A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.", + "pushed": "2026-10-04T09:58:53Z", + "created": "2026-10-04T09:57:38Z", + "cve": "CVE-2025-55182", + "kev": true, + "landed": true + }, { "year": 2025, "stars": 0, @@ -546,17 +558,5 @@ "cve": "CVE-2025-30208", "kev": false, "landed": true - }, - { - "year": 2025, - "stars": 0, - "name": "CVE-2025-32463", - "url": "https://github.com/klvlo/CVE-2025-32463", - "desc": "PoC / Exploit for CVE-2025-32463(sudo LPE)", - "pushed": "2026-09-29T13:05:44Z", - "created": "2026-09-29T12:58:42Z", - "cve": "CVE-2025-32463", - "kev": true, - "landed": true } ]