admin/cve
1
0 Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
36cbb4dc5636fb1a4e4bb820a951c19ee85b7994
cve/index/trending.json
T

761 lines
23 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
[
{
"year": 2026,
"stars": 532,
"name": "CVE-2026-41940-PoC",
"url": "https://github.com/sakidekin/CVE-2026-41940-PoC",
"artifact": false,
"source": "github.com",
"desc": "cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation",
"pushed": "2026-10-20T17:26:07Z",
"released": "2026-10-15T12:44:31Z",
"basis": "commit",
"score": 15.765625872242692,
"trending": true,
"created": "2026-10-11T07:54:18Z",
"cve": "CVE-2026-41940",
"kev": true
},
{
"year": 2026,
"stars": 69,
"name": "CVE-2026-20817",
"url": "https://github.com/ZeroDayEvil/CVE-2026-20817",
"artifact": false,
"source": "github.com",
"desc": "🛡️ Official AI Security Tool module for CVE-2026-20817 (Windows Error Reporting WER ALPC Local Privilege Escalation PoC).",
"pushed": "2026-10-19T13:57:31Z",
"released": null,
"basis": "pending",
"score": 4.161762157813474,
"trending": true,
"created": "2026-09-28T19:01:20Z",
"cve": "CVE-2026-20817",
"kev": false
},
{
"year": 2026,
"stars": 477,
"name": "CVE-2026-9830",
"url": "https://github.com/opaxial/CVE-2026-9830",
"artifact": false,
"source": "github.com",
"desc": "CVE-2026-9830 Proof of Concept",
"pushed": "2026-08-20T21:56:15Z",
"released": null,
"basis": "pending",
"score": 2.8697729424092078,
"trending": true,
"created": "2026-08-15T20:57:13Z",
"cve": "CVE-2026-9830",
"kev": false
},
{
"year": 2026,
"stars": 28,
"name": "CVE-2026-41940-PoC",
"url": "https://github.com/ZeroDayEvil/CVE-2026-41940-PoC",
"artifact": false,
"source": "github.com",
"desc": "cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.",
"pushed": "2026-10-19T07:44:03Z",
"released": null,
"basis": "pending",
"score": 1.5672071815469741,
"trending": true,
"created": "2026-09-28T18:52:52Z",
"cve": "CVE-2026-41940",
"kev": true
},
{
"year": 2026,
"stars": 335,
"name": "CVE-2026-54121",
"url": "https://github.com/aniqfakhrul/CVE-2026-54121",
"artifact": false,
"source": "github.com",
"desc": "Certighost POC",
"pushed": "2026-07-27T19:12:07Z",
"released": "2026-07-24T03:30:17Z",
"basis": "commit",
"score": 1.5553071592531185,
"trending": true,
"created": "2026-07-23T18:54:34Z",
"cve": "CVE-2026-54121",
"kev": false
},
{
"year": 2026,
"stars": 59,
"name": "CVE-2026-97229-PoC",
"url": "https://github.com/jburgess-r7/CVE-2026-97229-PoC",
"artifact": false,
"source": "github.com",
"desc": "GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image",
"pushed": "2026-10-13T16:00:26Z",
"released": "2026-10-13T16:00:26Z",
"basis": "commit",
"score": 1.4602662776142132,
"trending": true,
"created": "2026-10-13T09:39:17Z",
"cve": "CVE-2026-97229",
"kev": false
},
{
"year": 2026,
"stars": 96,
"name": "CVE-2026-41096-PoC",
"url": "https://github.com/ZeroDayEvil/CVE-2026-41096-PoC",
"artifact": false,
"source": "github.com",
"desc": "🛡️ Official AI Security Tool module for CVE-2026-41096 (Windows DNSAPI.dll Heap Overflow / DNS-Mayhem Deep Dive Analysis & Audit Module).",
"pushed": "2026-09-29T06:20:46Z",
"released": "2026-09-29T06:20:46Z",
"basis": "commit",
"score": 1.1694846531462317,
"trending": true,
"created": "2026-02-05T10:21:22Z",
"cve": "CVE-2026-41096",
"kev": false
},
{
"year": 2026,
"stars": 188,
"name": "CVE-2026-62911",
"url": "https://github.com/hypnguyen1209/CVE-2026-62911",
"artifact": false,
"source": "github.com",
"desc": "POC pre-auth RCE on Exchange",
"pushed": "2026-08-22T04:49:54Z",
"released": "2026-08-22T04:49:54Z",
"basis": "commit",
"score": 1.1478060184963694,
"trending": true,
"created": "2026-08-22T04:49:33Z",
"cve": "CVE-2026-62911",
"kev": false
},
{
"year": 2026,
"stars": 17,
"name": "CVE-2026-64560-public",
"url": "https://github.com/Feng1586/CVE-2026-64560-public",
"artifact": false,
"source": "github.com",
"desc": "CVE-2026-64560 staged security research package",
"pushed": "2026-10-19T05:30:19Z",
"released": null,
"basis": "pending",
"score": 0.9280857628746225,
"trending": true,
"created": "2026-10-19T05:30:01Z",
"cve": "CVE-2026-64560",
"kev": false
},
{
"year": 2026,
"stars": 35,
"name": "CVE-2026-85884",
"url": "https://github.com/Beardhammer/CVE-2026-85884",
"artifact": false,
"source": "github.com",
"desc": "CVE-85884 POC",
"pushed": "2026-10-13T20:06:18Z",
"released": "2026-10-13T20:06:18Z",
"basis": "commit",
"score": 0.8790875952038985,
"trending": true,
"created": "2026-10-13T20:02:03Z",
"cve": "CVE-2026-85884",
"kev": false
},
{
"year": 2026,
"stars": 24,
"name": "CVE-2026-40369-EXPLOIT",
"url": "https://github.com/ZeroDayEvil/CVE-2026-40369-EXPLOIT",
"artifact": false,
"source": "github.com",
"desc": "🛡️ Official AI Security Tool module for CVE-2026-40369 (Windows NtQuerySystemInformation Class 253 Arbitrary Kernel Address Increment LPE Primitive).",
"pushed": "2026-10-16T17:36:11Z",
"released": null,
"basis": "pending",
"score": 0.8237810682821036,
"trending": true,
"created": "2026-09-28T18:55:22Z",
"cve": "CVE-2026-40369",
"kev": false
},
{
"year": 2026,
"stars": 92,
"name": "CVE-2026-20805-PoC",
"url": "https://github.com/ZeroDayEvil/CVE-2026-20805-PoC",
"artifact": false,
"source": "github.com",
"desc": "🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information Disclosure & Memory Leak Diagnostic).",
"pushed": "2026-09-11T16:33:14Z",
"released": null,
"basis": "pending",
"score": 0.7494298392961274,
"trending": true,
"created": "2026-09-10T11:28:38Z",
"cve": "CVE-2026-20805",
"kev": true
},
{
"year": 2026,
"stars": 25,
"name": "plz110-6.12.69-cve-2026-64560-ksu",
"url": "https://github.com/feiguang-ai/plz110-6.12.69-cve-2026-64560-ksu",
"artifact": false,
"source": "github.com",
"desc": "一加 15T（PLZ110）临时 root + KernelSU per-boot 接管：CVE-2026-64560 移植，不写分区、重启即失效。内核 6.12.69-android16-6-g242e1a07f878。",
"pushed": "2026-10-15T14:24:25Z",
"released": "2026-10-15T14:24:25Z",
"basis": "commit",
"score": 0.7465827831298993,
"trending": true,
"created": "2026-10-15T14:19:23Z",
"cve": "CVE-2026-64560",
"kev": false
},
{
"year": 2026,
"stars": 88,
"name": "CVE-2026-21858-n8n-FullChain",
"url": "https://github.com/ZeroDayEvil/CVE-2026-21858-n8n-FullChain",
"artifact": false,
"source": "github.com",
"desc": "🛡️ Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n \"Ni8mare\" Unauthenticated Arbitrary File Read & Expression Injection RCE Full Chain).",
"pushed": "2026-09-12T00:03:49Z",
"released": null,
"basis": "pending",
"score": 0.7207784023515122,
"trending": true,
"created": "2026-09-12T00:03:07Z",
"cve": "CVE-2026-21858",
"kev": false
},
{
"year": 2026,
"stars": 105,
"name": "CVE-2026-75604-poc",
"url": "https://github.com/rafabd1/CVE-2026-75604-poc",
"artifact": false,
"source": "github.com",
"desc": "CVE-2026-75604 Next.js Windows RCE poc",
"pushed": "2026-08-26T02:23:55Z",
"released": "2026-08-25T19:06:37Z",
"basis": "created",
"score": 0.6690607184199141,
"trending": true,
"created": "2026-08-25T19:06:37Z",
"cve": "CVE-2026-75604",
"kev": false
},
{
"year": 2026,
"stars": 52,
"name": "CVE-2026-94545",
"url": "https://github.com/EQSTLab/CVE-2026-94545",
"artifact": false,
"source": "github.com",
"desc": "Next.js RCE",
"pushed": "2026-09-29T07:52:23Z",
"released": "2026-09-29T07:57:18Z",
"basis": "created",
"score": 0.6347883984084391,
"trending": true,
"created": "2026-09-29T07:57:18Z",
"cve": "CVE-2026-94545",
"kev": false
},
{
"year": 2026,
"stars": 86,
"name": "CVE-2026-65343",
"url": "https://github.com/ByteV0rtex/CVE-2026-65343",
"artifact": false,
"source": "github.com",
"desc": "CVE-2026-65343 PoC - AppleKeyStore OOB read → KASLR defeat (iOS 26.6 / 23G71)",
"pushed": "2026-09-03T20:38:35Z",
"released": null,
"basis": "pending",
"score": 0.618493896420708,
"trending": true,
"created": "2026-09-02T20:12:10Z",
"cve": "CVE-2026-65343",
"kev": false
},
{
"year": 2026,
"stars": 108,
"name": "SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit",
"url": "https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit",
"artifact": false,
"source": "github.com",
"desc": "Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.",
"pushed": "2026-08-03T15:31:59Z",
"released": null,
"basis": "pending",
"score": 0.5470537807852959,
"trending": true,
"created": "2026-08-03T15:29:22Z",
"cve": "CVE-2026-47301",
"kev": false
},
{
"year": 2026,
"stars": 14,
"name": "CVE-2026-99999",
"url": "https://github.com/PeronGH/CVE-2026-99999",
"artifact": false,
"source": "github.com",
"desc": "PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP.",
"pushed": "2026-10-17T07:35:29Z",
"released": "2026-10-17T06:21:55Z",
"basis": "created",
"score": 0.5186347559477525,
"trending": true,
"created": "2026-10-17T06:21:55Z",
"cve": "CVE-2026-99999",
"kev": false
},
{
"year": 2026,
"stars": 40,
"name": "CVE-2026-84543",
"url": "https://github.com/petermalone/CVE-2026-84543",
"artifact": false,
"source": "github.com",
"desc": "Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability",
"pushed": "2026-09-24T02:47:40Z",
"released": "2026-09-24T02:47:40Z",
"basis": "commit",
"score": 0.4221279162945879,
"trending": true,
"created": "2026-09-24T00:22:30Z",
"cve": "CVE-2026-84543",
"kev": false
},
{
"year": 2024,
"stars": 17,
"name": "CVE-2024-56426",
"url": "https://github.com/Creeeeger/CVE-2024-56426",
"artifact": false,
"source": "github.com",
"desc": "A PoC of the CVE-2024-56426 vulnerability.",
"pushed": "2026-10-03T08:14:17Z",
"released": null,
"basis": "pending",
"score": 0.23802459151337166,
"trending": true,
"created": "2026-04-07T12:02:52Z",
"cve": "CVE-2024-56426",
"kev": false
},
{
"year": 2026,
"stars": 2,
"name": "CVE-2026-105810",
"url": "https://github.com/M0ud4/CVE-2026-105810",
"artifact": false,
"source": "github.com",
"desc": "CVE-2026-105810 TP-Link Tapo C320WS authenticated connectAp stack overflow (RCE as root)",
"pushed": null,
"released": "2026-10-20T17:07:42Z",
"basis": "created",
"score": 0.19371601370194985,
"trending": false,
"created": "2026-10-20T17:07:42Z",
"cve": "CVE-2026-105810",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 22,
"name": "CVE-2025-7771",
"url": "https://github.com/enessakircolak/CVE-2025-7771",
"artifact": false,
"source": "github.com",
"desc": "ThrottleStop.sys Arbitrary Physical Memory R/W",
"pushed": "2026-08-10T23:15:22Z",
"released": "2026-08-10T23:15:36Z",
"basis": "created",
"score": 0.11926273980629191,
"trending": true,
"created": "2026-08-10T23:15:36Z",
"cve": "CVE-2025-7771",
"kev": false
},
{
"year": 2025,
"stars": 5,
"name": "CVE-2025-8110",
"url": "https://github.com/Ghxstsec/CVE-2025-8110",
"artifact": false,
"source": "github.com",
"desc": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.",
"pushed": "2026-10-12T15:07:46Z",
"released": null,
"basis": "pending",
"score": 0.11387463440477727,
"trending": true,
"created": "2026-04-11T22:40:07Z",
"cve": "CVE-2025-8110",
"kev": true
},
{
"year": 2026,
"stars": 1,
"name": "CVE-2026-106173",
"url": "https://github.com/horizon3ai/CVE-2026-106173",
"artifact": false,
"source": "github.com",
"desc": "Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM",
"pushed": null,
"released": "2026-10-20T12:43:34Z",
"basis": "commit",
"score": 0.08747010686199923,
"trending": false,
"created": "2026-10-20T12:29:09Z",
"cve": "CVE-2026-106173",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 8,
"name": "CVE-2025-32432-exploit-by-P34NUT",
"url": "https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT",
"artifact": false,
"source": "github.com",
"desc": "Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail",
"pushed": "2026-09-17T02:22:58Z",
"released": "2026-09-17T02:22:58Z",
"basis": "commit",
"score": 0.07210679409366676,
"trending": true,
"created": "2026-09-16T23:32:09Z",
"cve": "CVE-2025-32432",
"kev": true
},
{
"year": 2025,
"stars": 10,
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"url": "https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"artifact": false,
"source": "github.com",
"desc": "Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.",
"pushed": "2026-08-27T07:13:42Z",
"released": null,
"basis": "pending",
"score": 0.06492283692931065,
"trending": true,
"created": "2026-08-19T09:39:46Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 9,
"name": "SELinux-Permissive-Only-CVE-2025-21479",
"url": "https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479",
"artifact": false,
"source": "github.com",
"desc": "This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices",
"pushed": "2026-08-02T06:48:32Z",
"released": "2026-07-28T09:37:42Z",
"basis": "commit",
"score": 0.043229667767697766,
"trending": true,
"created": "2026-07-28T06:41:38Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 7,
"name": "CVE-2025-8045",
"url": "https://github.com/kuzeyardabulut/CVE-2025-8045",
"artifact": false,
"source": "github.com",
"desc": "Dirty Pagetable Exploit for CVE-2025-8045",
"pushed": "2026-08-06T14:58:53Z",
"released": "2026-08-06T14:58:53Z",
"basis": "commit",
"score": 0.03642051184863571,
"trending": true,
"created": "2026-08-06T13:52:33Z",
"cve": "CVE-2025-8045",
"kev": false
},
{
"year": 2025,
"stars": 6,
"name": "cve-2025-21479_iqooneo8",
"url": "https://github.com/Qingizi7/cve-2025-21479_iqooneo8",
"artifact": false,
"source": "github.com",
"desc": "Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables SELinux, spawns root shell",
"pushed": "2026-08-20T01:33:10Z",
"released": "2026-08-20T01:20:07Z",
"basis": "commit",
"score": 0.03575178118339062,
"trending": true,
"created": "2026-08-20T01:13:39Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2024,
"stars": 4,
"name": "CVE-2024-56426",
"url": "https://github.com/xcracker000/CVE-2024-56426",
"artifact": false,
"source": "github.com",
"desc": "CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F",
"pushed": "2026-08-15T06:21:41Z",
"released": null,
"basis": "pending",
"score": 0.022639506802691826,
"trending": true,
"created": "2026-08-15T06:12:04Z",
"cve": "CVE-2024-56426",
"kev": false
},
{
"year": 2025,
"stars": 3,
"name": "CVE-2025-3248-Langflow-RCE",
"url": "https://github.com/hideki233/CVE-2025-3248-Langflow-RCE",
"artifact": false,
"source": "github.com",
"desc": "Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode.",
"pushed": "2026-08-28T00:05:41Z",
"released": "2026-08-28T00:05:42Z",
"basis": "created",
"score": 0.019651110145692603,
"trending": true,
"created": "2026-08-28T00:05:42Z",
"cve": "CVE-2025-3248",
"kev": true
},
{
"year": 2025,
"stars": 3,
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"url": "https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"artifact": false,
"source": "github.com",
"desc": "iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案",
"pushed": "2026-08-18T01:39:34Z",
"released": null,
"basis": "pending",
"score": 0.017490588184375253,
"trending": true,
"created": "2026-08-18T02:31:53Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2024,
"stars": 3,
"name": "CVE-2024-36104-PoC",
"url": "https://github.com/Groppoxx/CVE-2024-36104-PoC",
"artifact": false,
"source": "github.com",
"desc": "PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport",
"pushed": "2026-07-29T21:15:12Z",
"released": "2026-07-29T21:15:12Z",
"basis": "commit",
"score": 0.01458766188248268,
"trending": true,
"created": "2026-07-29T19:59:36Z",
"cve": "CVE-2024-36104",
"kev": false
},
{
"year": 2023,
"stars": 3,
"name": "CVE-2023-52076-PoC",
"url": "https://github.com/Groppoxx/CVE-2023-52076-PoC",
"artifact": false,
"source": "github.com",
"desc": "PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only.",
"pushed": "2026-07-27T07:00:54Z",
"released": "2026-07-27T06:52:27Z",
"basis": "commit",
"score": 0.014279774132134541,
"trending": true,
"created": "2026-07-27T06:51:21Z",
"cve": "CVE-2023-52076",
"kev": false
},
{
"year": 2022,
"stars": 7,
"name": "CVE-2022-22077",
"url": "https://github.com/grisuno/CVE-2022-22077",
"artifact": false,
"source": "github.com",
"desc": "CVE-2022-22077 is a high-severity vulnerability (CVSS score 7.8) affecting the RTCore64.sys driver distributed with MSI Center",
"pushed": "2026-10-08T15:42:17Z",
"released": "2025-09-09T01:31:54Z",
"basis": "commit",
"score": 0.011262179907046206,
"trending": true,
"created": "2025-09-08T21:12:19Z",
"cve": "CVE-2022-22077",
"kev": false
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-87690-POC",
"url": "https://github.com/h00die/CVE-2026-87690-POC",
"artifact": false,
"source": "github.com",
"desc": "Exploit and writeup for CVE-2026-87690",
"pushed": null,
"released": "2026-10-20T20:10:36Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-20T20:00:09Z",
"cve": "CVE-2026-87690",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-113468",
"url": "https://github.com/yuwkaaa/CVE-2026-113468",
"artifact": false,
"source": "github.com",
"desc": "forgeable PayPal payment callback in TYPO3 EXT:shop",
"pushed": null,
"released": "2026-10-20T18:18:54Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-20T17:45:28Z",
"cve": "CVE-2026-113468",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-112071",
"url": "https://github.com/yuwkaaa/CVE-2026-112071",
"artifact": false,
"source": "github.com",
"desc": "unauthenticated order cancellation in TYPO3 EXT:shop",
"pushed": null,
"released": "2026-10-20T18:18:35Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-20T17:44:49Z",
"cve": "CVE-2026-112071",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-106173",
"url": "https://github.com/0xBlackash/CVE-2026-106173",
"artifact": false,
"source": "github.com",
"desc": "A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.",
"pushed": null,
"released": "2026-10-20T15:09:42Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-20T14:59:39Z",
"cve": "CVE-2026-106173",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-85313",
"url": "https://github.com/oscerd/CVE-2026-85313",
"artifact": false,
"source": "github.com",
"desc": "Reproducer for CVE-2026-85313 - Apache Camel camel-jetty enableCORS credentialed any-origin CORS (CWE-942). Camel Spring Boot.",
"pushed": null,
"released": "2026-10-20T13:10:30Z",
"basis": "created",
"score": 0.0,
"trending": false,
"created": "2026-10-20T13:10:30Z",
"cve": "CVE-2026-85313",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-111058-CVE-2026-111057-mercury-rce",
"url": "https://github.com/ExDev994/CVE-2026-111058-CVE-2026-111057-mercury-rce",
"artifact": false,
"source": "github.com",
"desc": "Mercury unauth RCE combo: CVE-2026-111058 (kernels) + CVE-2026-111057 (terminals). By 0xNuts (@ExDev994). Authorized testing only.",
"pushed": null,
"released": "2026-10-20T04:44:22Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-20T04:38:18Z",
"cve": "CVE-2026-111058",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-103663",
"url": "https://github.com/striga-ai/CVE-2026-103663",
"artifact": false,
"source": "github.com",
"desc": "Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.",
"pushed": null,
"released": "2026-10-19T21:03:37Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-19T20:59:59Z",
"cve": "CVE-2026-103663",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 0,
"name": "CVE-2026-63030",
"url": "https://github.com/K52-ai/CVE-2026-63030",
"artifact": false,
"source": "github.com",
"desc": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.",
"pushed": null,
"released": "2026-10-19T20:52:39Z",
"basis": "commit",
"score": 0.0,
"trending": false,
"created": "2026-10-19T20:47:31Z",
"cve": "CVE-2026-63030",
"kev": true,
"landed": true
}
]
Reference in new issue View Git Blame Copy Permalink