diff --git a/README.md b/README.md
index f3afe99d65e..beea1c29bf1 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
-[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
+[](https://github.com/0xMarcio/pocindex/commits/main) [](https://github.com/0xMarcio/pocindex/actions/workflows/hot_cves.yml) [](https://pocindex.io/) [](https://pocindex.io/) [](https://github.com/0xMarcio/pocindex/stargazers)
@@ -14,16 +14,16 @@
| Stars | Released | PoC | Description |
| --- | --- | --- | --- |
-| 0⭐ | 6h ago | [CVE-2026-55450](https://github.com/0xBlackash/CVE-2026-55450) | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1,… |
-| 0⭐ | 8h ago | [CVE-2026-91940-crawl4ai-Arbitrary-File-Write](https://github.com/BiiTts/CVE-2026-91940-crawl4ai-Arbitrary-File-Write) | CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate… |
-| 0⭐ | 8h ago | [CVE-2023-54391-RCE](https://github.com/alexandrov666/CVE-2023-54391-RCE) | CVE-2023-54391: Proxmox VE Authentication Bypass RCE |
-| 0⭐ | 8h ago | 
[CVE-2026-67279-Mikrotik-6.42-POC](https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC) | Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42. |
-| 0⭐ | 11h ago | [CVE-2026-92555](https://github.com/Enay-Project/CVE-2026-92555) | CVE-2026-92555 Exploit |
-| 0⭐ | 17h ago | [CVE-2026-48908](https://github.com/theendofabbys/CVE-2026-48908) | A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files,… |
-| 0⭐ | 19h ago | [wso2_cve-2026-5430_lab](https://github.com/getdrive/wso2_cve-2026-5430_lab) | Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход… |
-| 0⭐ | 19h ago | [Keycloak-CVE-2026-18963-Exploit](https://github.com/hardeep-sudo/Keycloak-CVE-2026-18963-Exploit) | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine… |
-| 0⭐ | 20h ago | [-CVE-2026-18963-POC](https://github.com/SonOfABot/-CVE-2026-18963-POC) | PoC for keycloak 1.26 vulnerability |
-| 1⭐ | 20h ago | [CVE-2026-21589](https://github.com/murrez/CVE-2026-21589) | CVE-2026-21589 - Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC:… |
+| 0⭐ | 4m ago | [CVE-2026-80428](https://github.com/HackfutSecRoot/CVE-2026-80428) | ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at… |
+| 0⭐ | 7h ago | [CVE-2026-55450](https://github.com/0xBlackash/CVE-2026-55450) | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1,… |
+| 0⭐ | 9h ago | [CVE-2026-91940-crawl4ai-Arbitrary-File-Write](https://github.com/BiiTts/CVE-2026-91940-crawl4ai-Arbitrary-File-Write) | CVE-2026-91940: arbitrary file write in crawl4ai <=0.9.2 via the untrusted-config gate… |
+| 0⭐ | 9h ago | [CVE-2023-54391-RCE](https://github.com/alexandrov666/CVE-2023-54391-RCE) | CVE-2023-54391: Proxmox VE Authentication Bypass RCE |
+| 0⭐ | 9h ago | [CVE-2026-67279-Mikrotik-6.42-POC](https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC) | Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42. |
+| 0⭐ | 12h ago | [CVE-2026-92555](https://github.com/Enay-Project/CVE-2026-92555) | CVE-2026-92555 Exploit |
+| 0⭐ | 18h ago | [CVE-2026-48908](https://github.com/theendofabbys/CVE-2026-48908) | A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files,… |
+| 0⭐ | 20h ago | [wso2_cve-2026-5430_lab](https://github.com/getdrive/wso2_cve-2026-5430_lab) | Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход… |
+| 0⭐ | 20h ago | [Keycloak-CVE-2026-18963-Exploit](https://github.com/hardeep-sudo/Keycloak-CVE-2026-18963-Exploit) | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine… |
+| 0⭐ | 21h ago | [-CVE-2026-18963-POC](https://github.com/SonOfABot/-CVE-2026-18963-POC) | PoC for keycloak 1.26 vulnerability |
## Trending in 2026
@@ -44,7 +44,7 @@
| 38⭐ | 16d ago | [cve-2026-87902-poc](https://github.com/ressl/cve-2026-87902-poc) | PoC for CVE-2026-87902 - unauthenticated path traversal in WordPress page-template resolution (local PHP… |
| 108⭐ | 82d ago | [CVE-2026-43499-Poc-Analysis](https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis) | Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For… |
| 35⭐ | 2d ago | [CVE-2026-87902](https://github.com/abraxas/CVE-2026-87902) | CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion… |
-| 25⭐ | 10d ago | [CVE-2026-85706](https://github.com/EQSTLab/CVE-2026-85706) | GitLab Unauthenticated Arbitrary File Read |
+| 25⭐ | 11d ago | [CVE-2026-85706](https://github.com/EQSTLab/CVE-2026-85706) | GitLab Unauthenticated Arbitrary File Read |
| 11⭐ | 2d ago | [watchTowr-vs-Atlassian-CVE-2026-21589](https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589) | h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management… |
| 23⭐ | 10d ago | [watchTowr-vs-Citrix-Netscaler-CVE-2026-88771](https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771) | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… |
| 42⭐ | 27d ago | [cve-2026-85706](https://github.com/guneykabel/cve-2026-85706) | Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions:… |
@@ -89,7 +89,7 @@
| Stars | Updated | Repository | Description |
| --- | --- | --- | --- |
-| 6⭐ | 13h ago | [CVE-2022-22077](https://github.com/grisuno/CVE-2022-22077) | CVE-2022-22077 is a high-severity vulnerability (CVSS score 7.8) affecting the RTCore64.sys driver… |
+| 6⭐ | 14h ago | [CVE-2022-22077](https://github.com/grisuno/CVE-2022-22077) | CVE-2022-22077 is a high-severity vulnerability (CVSS score 7.8) affecting the RTCore64.sys driver… |
diff --git a/cves/2026/CVE-2026-80428.md b/cves/2026/CVE-2026-80428.md
index d7f003e260a..1e797bf3170 100644
--- a/cves/2026/CVE-2026-80428.md
+++ b/cves/2026/CVE-2026-80428.md
@@ -18,6 +18,7 @@ ILIAS deserialises stored session data for an unauthenticated caller. The Shibbo
#### Github
- https://github.com/digiprosec/CVE-2026-80428
+- https://github.com/HackfutSecRoot/CVE-2026-80428
#### ExploitDB
- https://www.exploit-db.com/exploits/52682
diff --git a/index/github.txt b/index/github.txt
index 3e44fabbe45..dcfedcc1bcb 100644
--- a/index/github.txt
+++ b/index/github.txt
@@ -27358,3 +27358,4 @@ CVE-2026-21589 - https://github.com/zseeu1/CVEHOT
CVE-2026-43499 - https://github.com/d16ug-a1l/REDMI_Root
CVE-2025-26466 - https://github.com/K0n9-log/cve-2025-26466-canvas
CVE-2026-107406 - https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406
+CVE-2026-80428 - https://github.com/HackfutSecRoot/CVE-2026-80428
diff --git a/index/releases/2021.json b/index/releases/2021.json
index 69b68e4107c..5ac0c5ca593 100644
--- a/index/releases/2021.json
+++ b/index/releases/2021.json
@@ -6702,7 +6702,7 @@
"CVE-2021-41773 github:layarkacasiber/cve-2021-41773?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/LayarKacaSiber/CVE-2021-41773"},
"CVE-2021-41773 github:lheeeesoo/apache-cve-2021-41773?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/lheeeesoo/Apache-CVE-2021-41773"},
"CVE-2021-41773 github:lorddemon/cve-2021-41773-poc?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/lorddemon/CVE-2021-41773-PoC"},
-"CVE-2021-41773 github:lordx404/cve_2021-41773?#":{"basis":"pending","checked":"2026-10-09T02:08:39Z","created":"2026-10-08T20:51:53Z","cve":"CVE-2021-41773","gone":"2026-10-09T05:11:38Z","head":"a8f739f62da113fe44aa71d4350e63fbc5251518","pending":true,"pushed_at":"2026-10-08T21:06:41Z","released":null,"repo":1410941932,"seen":"2026-10-08T21:09:06Z","url":"https://github.com/LordX404/CVE_2021-41773"},
+"CVE-2021-41773 github:lordx404/cve_2021-41773?#":{"basis":"pending","checked":"2026-10-09T02:08:39Z","created":"2026-10-08T20:51:53Z","cve":"CVE-2021-41773","gone":"2026-10-09T06:11:45Z","head":"a8f739f62da113fe44aa71d4350e63fbc5251518","pending":true,"pushed_at":"2026-10-08T21:06:41Z","released":null,"repo":1410941932,"seen":"2026-10-08T21:09:06Z","url":"https://github.com/LordX404/CVE_2021-41773"},
"CVE-2021-41773 github:ls4ss/cve-2021-41773_cve-2021-42013?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/Ls4ss/CVE-2021-41773_CVE-2021-42013"},
"CVE-2021-41773 github:ludovicpatho/cve-2021-41773?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/LudovicPatho/CVE-2021-41773"},
"CVE-2021-41773 github:luisdavidgarcia/webfortress?#":{"basis":"unknown","cve":"CVE-2021-41773","imported":true,"released":null,"url":"https://github.com/luisdavidgarcia/WebFortress"},
diff --git a/index/releases/2022.json b/index/releases/2022.json
index 1cbd3070a89..1a76d789279 100644
--- a/index/releases/2022.json
+++ b/index/releases/2022.json
@@ -3824,7 +3824,7 @@
"CVE-2022-26134 github:rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atlassian_confluence_namespace_ognl_injection.rb"},
"CVE-2022-26134 github:reph0r/poc-exp?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/reph0r/poc-exp"},
"CVE-2022-26134 github:reubensammut/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/reubensammut/cve-2022-26134"},
-"CVE-2022-26134 github:roodhelios/cve-2022-26134-ognl-injection?#":{"basis":"pending","checked":"2026-10-09T01:07:59Z","created":"2026-05-06T01:47:50Z","cve":"CVE-2022-26134","head":"425cffd7a9b2aad60bf142a09f089c22937d7f2f","imported":true,"pending":true,"pushed_at":"2026-10-09T00:45:32Z","released":null,"repo":1230429140,"url":"https://github.com/roodhelios/CVE-2022-26134-OGNL-Injection"},
+"CVE-2022-26134 github:roodhelios/cve-2022-26134-ognl-injection?#":{"basis":"pending","checked":"2026-10-09T06:07:56Z","created":"2026-05-06T01:47:50Z","cve":"CVE-2022-26134","head":"425cffd7a9b2aad60bf142a09f089c22937d7f2f","imported":true,"pending":true,"pushed_at":"2026-10-09T00:45:32Z","released":null,"repo":1230429140,"url":"https://github.com/roodhelios/CVE-2022-26134-OGNL-Injection"},
"CVE-2022-26134 github:secjia/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/secjia/CVE-2022-26134"},
"CVE-2022-26134 github:shamo0/cve-2022-26134?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/shamo0/CVE-2022-26134"},
"CVE-2022-26134 github:shiftsansan/cve-2022-26134-console?#":{"basis":"unknown","cve":"CVE-2022-26134","imported":true,"released":null,"url":"https://github.com/shiftsansan/CVE-2022-26134-Console"},
diff --git a/index/releases/2026.json b/index/releases/2026.json
index ab2cec2f388..a33375f7142 100644
--- a/index/releases/2026.json
+++ b/index/releases/2026.json
@@ -12111,6 +12111,7 @@
"CVE-2026-8037 github:horkimhab/cve-2026-8037?#":{"basis":"unknown","cve":"CVE-2026-8037","imported":true,"released":null,"url":"https://github.com/HORKimhab/CVE-2026-8037"},
"CVE-2026-8037 github:projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml?#":{"basis":"unknown","cve":"CVE-2026-8037","imported":true,"released":null,"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-8037.yaml"},
"CVE-2026-80428 github:digiprosec/cve-2026-80428?#":{"basis":"unknown","cve":"CVE-2026-80428","imported":true,"released":null,"url":"https://github.com/digiprosec/CVE-2026-80428"},
+"CVE-2026-80428 github:hackfutsecroot/cve-2026-80428?#":{"basis":"commit","blobs":["60f5c3d19c47cfcbc52c79f286514248a9841c95"],"checked":"2026-10-09T06:07:50Z","commit":"2026-10-09T06:06:02Z","commit_verified":true,"created":"2026-10-09T06:02:44Z","cve":"CVE-2026-80428","head":"c34fa081e7545e17224225d7b9169e296eb0134a","history_paths":["poc.py"],"history_version":3,"paths":["poc.py"],"pushed_at":"2026-10-09T06:06:02Z","released":"2026-10-09T06:06:02Z","repo":1411368624,"rev":"c713c785aeda89883bf8e12205e6627385ddd46686d4db09f9eec4cba13ac34a","seen":"2026-10-09T06:07:51Z","sha":"c34fa081e7545e17224225d7b9169e296eb0134a","url":"https://github.com/HackfutSecRoot/CVE-2026-80428"},
"CVE-2026-80428 https://schweigertit.de/en/writeups/php-object-injection-shibboleth-logout.html":{"basis":"unknown","cve":"CVE-2026-80428","imported":true,"released":null,"url":"https://schweigertit.de/en/writeups/php-object-injection-shibboleth-logout.html"},
"CVE-2026-80428 https://www.exploit-db.com/exploits/52682":{"basis":"source","cve":"CVE-2026-80428","imported":true,"released":"2026-09-11","source":"2026-09-11","url":"https://www.exploit-db.com/exploits/52682"},
"CVE-2026-80437 https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a":{"basis":"unknown","cve":"CVE-2026-80437","imported":true,"released":null,"url":"https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a/"},
diff --git a/index/trending.json b/index/trending.json
index e036f038d44..948d2ab4197 100644
--- a/index/trending.json
+++ b/index/trending.json
@@ -10,7 +10,7 @@
"pushed": "2026-08-20T21:56:15Z",
"released": null,
"basis": "pending",
- "score": 3.4671761207989564,
+ "score": 3.4651649110476503,
"trending": true,
"created": "2026-08-15T20:57:13Z",
"cve": "CVE-2026-9830",
@@ -27,7 +27,7 @@
"pushed": "2026-09-29T06:20:46Z",
"released": "2026-09-29T06:20:46Z",
"basis": "commit",
- "score": 1.9431520283311656,
+ "score": 1.9379876531052056,
"trending": true,
"created": "2026-02-05T10:21:22Z",
"cve": "CVE-2026-41096",
@@ -44,7 +44,7 @@
"pushed": "2026-07-27T19:12:07Z",
"released": "2026-07-24T03:30:17Z",
"basis": "commit",
- "score": 1.6992364229221344,
+ "score": 1.6986011755390598,
"trending": true,
"created": "2026-07-23T18:54:34Z",
"cve": "CVE-2026-54121",
@@ -61,7 +61,7 @@
"pushed": "2026-08-22T04:49:54Z",
"released": "2026-08-22T04:49:54Z",
"basis": "commit",
- "score": 1.3045041251400642,
+ "score": 1.303727560596762,
"trending": true,
"created": "2026-08-22T04:49:33Z",
"cve": "CVE-2026-62911",
@@ -78,7 +78,7 @@
"pushed": "2026-09-29T07:52:23Z",
"released": "2026-09-29T07:57:18Z",
"basis": "created",
- "score": 0.9960894500693737,
+ "score": 0.9934258596034369,
"trending": true,
"created": "2026-09-29T07:57:18Z",
"cve": "CVE-2026-94545",
@@ -95,7 +95,7 @@
"pushed": "2026-09-11T16:33:14Z",
"released": null,
"basis": "pending",
- "score": 0.9527417678264285,
+ "score": 0.9517677492120438,
"trending": true,
"created": "2026-09-10T11:28:38Z",
"cve": "CVE-2026-20805",
@@ -112,7 +112,7 @@
"pushed": "2026-09-12T00:03:49Z",
"released": null,
"basis": "pending",
- "score": 0.9183816470699067,
+ "score": 0.9174323558181108,
"trending": true,
"created": "2026-09-12T00:03:07Z",
"cve": "CVE-2026-21858",
@@ -129,7 +129,7 @@
"pushed": "2026-08-26T02:23:55Z",
"released": "2026-08-25T19:06:37Z",
"basis": "created",
- "score": 0.7851892031448869,
+ "score": 0.784684816527693,
"trending": true,
"created": "2026-08-25T19:06:37Z",
"cve": "CVE-2026-75604",
@@ -146,7 +146,7 @@
"pushed": "2026-09-03T20:38:35Z",
"released": null,
"basis": "pending",
- "score": 0.751542489804448,
+ "score": 0.7509394723826884,
"trending": true,
"created": "2026-09-02T20:12:10Z",
"cve": "CVE-2026-65343",
@@ -163,7 +163,7 @@
"pushed": "2026-09-24T02:47:40Z",
"released": "2026-09-24T02:47:40Z",
"basis": "commit",
- "score": 0.6182354103193364,
+ "score": 0.6171165704747205,
"trending": true,
"created": "2026-09-24T00:22:30Z",
"cve": "CVE-2026-84543",
@@ -180,7 +180,7 @@
"pushed": "2026-08-03T15:31:59Z",
"released": null,
"basis": "pending",
- "score": 0.6115843529988341,
+ "score": 0.6113202014193321,
"trending": true,
"created": "2026-08-03T15:29:22Z",
"cve": "CVE-2026-47301",
@@ -197,7 +197,7 @@
"pushed": "2026-09-27T19:48:09Z",
"released": "2026-09-27T19:47:52Z",
"basis": "commit",
- "score": 0.5755091590902235,
+ "score": 0.5741568052538296,
"trending": true,
"created": "2026-09-27T19:41:06Z",
"cve": "CVE-2026-34990",
@@ -214,7 +214,7 @@
"pushed": "2026-09-22T19:36:47Z",
"released": null,
"basis": "pending",
- "score": 0.5562668587159416,
+ "score": 0.5553351881920958,
"trending": true,
"created": "2026-09-22T18:40:26Z",
"cve": "CVE-2026-87902",
@@ -231,7 +231,7 @@
"pushed": "2026-07-18T21:09:06Z",
"released": null,
"basis": "pending",
- "score": 0.5280804555960523,
+ "score": 0.5278955033349783,
"trending": true,
"created": "2026-07-14T14:21:27Z",
"cve": "CVE-2026-43499",
@@ -248,7 +248,7 @@
"pushed": "2026-10-07T01:07:28Z",
"released": "2026-09-22T18:13:48Z",
"basis": "created",
- "score": 0.5111664598076033,
+ "score": 0.5103131469022195,
"trending": true,
"created": "2026-09-22T18:13:48Z",
"cve": "CVE-2026-87902",
@@ -265,7 +265,7 @@
"pushed": "2026-10-03T08:14:17Z",
"released": null,
"basis": "pending",
- "score": 0.47679342513036205,
+ "score": 0.47477776180077597,
"trending": true,
"created": "2026-04-07T12:02:52Z",
"cve": "CVE-2024-56426",
@@ -282,7 +282,7 @@
"pushed": "2026-09-28T05:17:40Z",
"released": "2026-09-28T05:17:40Z",
"basis": "commit",
- "score": 0.47478556677165307,
+ "score": 0.4736332008942138,
"trending": true,
"created": "2026-09-28T04:47:10Z",
"cve": "CVE-2026-85706",
@@ -299,7 +299,7 @@
"pushed": "2026-10-06T10:48:38Z",
"released": "2026-10-06T10:48:38Z",
"basis": "commit",
- "score": 0.47012561276829384,
+ "score": 0.46651356248373343,
"trending": true,
"created": "2026-10-06T10:40:59Z",
"cve": "CVE-2026-21589",
@@ -316,7 +316,7 @@
"pushed": "2026-09-28T09:24:46Z",
"released": "2026-09-28T09:24:46Z",
"basis": "commit",
- "score": 0.4412308332120617,
+ "score": 0.4401444124633001,
"trending": true,
"created": "2026-09-27T18:15:38Z",
"cve": "CVE-2026-88771",
@@ -333,7 +333,7 @@
"pushed": "2026-09-11T16:38:12Z",
"released": "2026-09-11T15:54:48Z",
"basis": "commit",
- "score": 0.43466268627663457,
+ "score": 0.4342187314675013,
"trending": true,
"created": "2026-09-11T15:24:22Z",
"cve": "CVE-2026-85706",
@@ -350,7 +350,7 @@
"pushed": "2026-09-21T15:02:37Z",
"released": "2026-09-21T15:02:37Z",
"basis": "commit",
- "score": 0.41927721816550406,
+ "score": 0.4186198710900232,
"trending": true,
"created": "2026-09-21T15:02:05Z",
"cve": "CVE-2026-43786",
@@ -367,7 +367,7 @@
"pushed": "2026-08-10T23:15:22Z",
"released": "2026-08-10T23:15:36Z",
"basis": "created",
- "score": 0.1349967909850408,
+ "score": 0.13493140224027284,
"trending": true,
"created": "2026-08-10T23:15:36Z",
"cve": "CVE-2025-7771",
@@ -384,7 +384,7 @@
"pushed": "2026-09-17T02:22:58Z",
"released": "2026-09-17T02:22:58Z",
"basis": "commit",
- "score": 0.08398633024664198,
+ "score": 0.08388040679768329,
"trending": true,
"created": "2026-09-16T23:32:09Z",
"cve": "CVE-2025-32432",
@@ -401,30 +401,12 @@
"pushed": "2026-08-27T07:13:42Z",
"released": null,
"basis": "pending",
- "score": 0.07656458164134895,
+ "score": 0.07651371454127373,
"trending": true,
"created": "2026-08-19T09:39:46Z",
"cve": "CVE-2025-21479",
"kev": true
},
- {
- "year": 2026,
- "stars": 1,
- "name": "CVE-2026-21589",
- "url": "https://github.com/murrez/CVE-2026-21589",
- "artifact": false,
- "source": "github.com",
- "desc": "CVE-2026-21589 - Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /download/resources/ for Jira, Confluence, Bitbucket. check + exploit (WEB-INF/web.xml, crowd.properties). Batch JSONL, hits.txt. Not RCE. https://pocbit.org/pocs/cve-2026-21589",
- "pushed": null,
- "released": "2026-10-08T08:31:47Z",
- "basis": "commit",
- "score": 0.0700027340422733,
- "trending": false,
- "created": "2026-10-08T08:31:03Z",
- "cve": "CVE-2026-21589",
- "kev": false,
- "landed": true
- },
{
"year": 2025,
"stars": 7,
@@ -436,7 +418,7 @@
"pushed": "2026-08-20T01:33:10Z",
"released": "2026-08-20T01:20:07Z",
"basis": "commit",
- "score": 0.04816146476317228,
+ "score": 0.04813399625113502,
"trending": true,
"created": "2026-08-20T01:13:39Z",
"cve": "CVE-2025-21479",
@@ -453,7 +435,7 @@
"pushed": "2026-08-02T06:48:32Z",
"released": "2026-07-28T09:37:42Z",
"basis": "commit",
- "score": 0.042583733864931986,
+ "score": 0.04256689703898178,
"trending": true,
"created": "2026-07-28T06:41:38Z",
"cve": "CVE-2025-21479",
@@ -470,7 +452,7 @@
"pushed": "2026-08-06T14:58:53Z",
"released": "2026-08-06T14:58:53Z",
"basis": "commit",
- "score": 0.040909910700440796,
+ "score": 0.040891427293934794,
"trending": true,
"created": "2026-08-06T13:52:33Z",
"cve": "CVE-2025-8045",
@@ -487,7 +469,7 @@
"pushed": "2026-07-22T19:46:33Z",
"released": null,
"basis": "pending",
- "score": 0.030350178236635255,
+ "score": 0.03033901847375384,
"trending": true,
"created": "2026-07-22T19:43:34Z",
"cve": "CVE-2023-36003",
@@ -504,7 +486,7 @@
"pushed": "2026-08-15T06:21:41Z",
"released": null,
"basis": "pending",
- "score": 0.025849339814025613,
+ "score": 0.025835856586717113,
"trending": true,
"created": "2026-08-15T06:12:04Z",
"cve": "CVE-2024-56426",
@@ -521,7 +503,7 @@
"pushed": "2026-08-28T00:05:41Z",
"released": "2026-08-28T00:05:42Z",
"basis": "created",
- "score": 0.023230237345372797,
+ "score": 0.023214553107784832,
"trending": true,
"created": "2026-08-28T00:05:42Z",
"cve": "CVE-2025-3248",
@@ -538,7 +520,7 @@
"pushed": "2026-08-18T01:39:34Z",
"released": null,
"basis": "pending",
- "score": 0.020097498955139986,
+ "score": 0.020086464660446078,
"trending": true,
"created": "2026-08-18T02:31:53Z",
"cve": "CVE-2025-21479",
@@ -555,7 +537,7 @@
"pushed": "2026-07-21T16:55:33Z",
"released": null,
"basis": "pending",
- "score": 0.02003624455224955,
+ "score": 0.020028981159169894,
"trending": true,
"created": "2026-07-21T16:52:22Z",
"cve": "CVE-2025-32432",
@@ -572,7 +554,7 @@
"pushed": "2026-07-19T11:00:00Z",
"released": "2026-07-19T11:00:00Z",
"basis": "commit",
- "score": 0.019653877368678824,
+ "score": 0.019646945948065826,
"trending": true,
"created": "2026-07-19T10:49:05Z",
"cve": "CVE-2025-64512",
@@ -589,7 +571,7 @@
"pushed": "2026-07-17T13:55:11Z",
"released": null,
"basis": "pending",
- "score": 0.019347521311105148,
+ "score": 0.01934084930459864,
"trending": true,
"created": "2026-07-17T13:46:16Z",
"cve": "CVE-2025-8110",
@@ -606,7 +588,7 @@
"pushed": "2026-07-29T21:15:12Z",
"released": "2026-07-29T21:15:12Z",
"basis": "commit",
- "score": 0.016197595098224018,
+ "score": 0.01619105863702286,
"trending": true,
"created": "2026-07-29T19:59:36Z",
"cve": "CVE-2024-36104",
@@ -623,7 +605,7 @@
"pushed": "2026-07-27T07:00:54Z",
"released": "2026-07-27T06:52:27Z",
"basis": "commit",
- "score": 0.01580220888949018,
+ "score": 0.015796052535113504,
"trending": true,
"created": "2026-07-27T06:51:21Z",
"cve": "CVE-2023-52076",
@@ -640,7 +622,7 @@
"pushed": "2026-07-20T13:33:10Z",
"released": "2026-07-20T13:33:10Z",
"basis": "commit",
- "score": 0.0148799379769161,
+ "score": 0.014874619126481218,
"trending": true,
"created": "2026-02-13T22:26:25Z",
"cve": "CVE-2025-6019",
@@ -657,12 +639,30 @@
"pushed": "2026-10-08T15:42:17Z",
"released": "2025-09-09T01:31:54Z",
"basis": "commit",
- "score": 0.009851451909362024,
+ "score": 0.0098507256486588,
"trending": true,
"created": "2025-09-08T21:12:19Z",
"cve": "CVE-2022-22077",
"kev": false
},
+ {
+ "year": 2026,
+ "stars": 0,
+ "name": "CVE-2026-80428",
+ "url": "https://github.com/HackfutSecRoot/CVE-2026-80428",
+ "artifact": false,
+ "source": "github.com",
+ "desc": "ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-written parser that calls unserialize without restricting which classes may be constructed. Any serialised object present in any session row is therefore instantiated on behalf of an anonymous request, and object destructors run when those objects are discarded. A serialised object can be placed into a session row without logging in, because the LTI authentication entry point stores request parameters into the session and is reachable on a path the same initialisation code exempts from authentication. A class bundled with the application writes a JSON-encoded structure to a file named by one of its own properties when it is destroyed, which places attacker-controlled content at an attacker-chosen path below the web root and results in code execution as the web server user. Versions 9.22, 10.10 and 11.3 remove the endpoint's logout-notification implementation.",
+ "pushed": null,
+ "released": "2026-10-09T06:06:02Z",
+ "basis": "commit",
+ "score": 0.0,
+ "trending": false,
+ "created": "2026-10-09T06:02:44Z",
+ "cve": "CVE-2026-80428",
+ "kev": false,
+ "landed": true
+ },
{
"year": 2026,
"stars": 0,