admin/cve
1
0 Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2026-10-27 16:51:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
712bb54b1b5d4b654927d47f7dc4e1b70d3dd4f8
cve/index/trending.json
T

596 lines
21 KiB
JSON
Raw Blame History

[
{
"year": 2026,
"stars": 3,
"name": "CVE-2026-55781-poc",
"url": "https://github.com/g17hubH4ck/CVE-2026-55781-poc",
"desc": "Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.",
"pushed": "2026-09-17T00:59:57Z",
"created": "2026-09-17T00:54:20Z",
"cve": "CVE-2026-55781",
"kev": false
},
{
"year": 2026,
"stars": 16,
"name": "CVE-2026-83991-writeup-and-poc",
"url": "https://github.com/karollooool/CVE-2026-83991-writeup-and-poc",
"desc": "CVE-2026-83991: Windows Cloud Files access-check bypass",
"pushed": "2026-09-16T19:41:03Z",
"created": "2026-09-09T01:44:35Z",
"cve": "CVE-2026-83991",
"kev": false
},
{
"year": 2026,
"stars": 5,
"name": "CVE-2026-12793",
"url": "https://github.com/murrez/CVE-2026-12793",
"desc": "CVE-2026-12793 PoC - JetFormBuilder ≤3.6.2 unauth Register User / admin account creation",
"pushed": "2026-09-16T14:44:04Z",
"created": "2026-09-16T14:43:36Z",
"cve": "CVE-2026-12793",
"kev": false
},
{
"year": 2026,
"stars": 526,
"name": "cve-2026-41940-PoC",
"url": "https://github.com/ctdal/cve-2026-41940-PoC",
"desc": "A cPanel and WHM authentication bypassing tool",
"pushed": "2026-09-16T13:49:52Z",
"created": "2026-09-16T13:47:39Z",
"cve": "CVE-2026-41940",
"kev": true
},
{
"year": 2026,
"stars": 3,
"name": "POC-AIOWPM-CVE-2026-19949",
"url": "https://github.com/686f6c61/POC-AIOWPM-CVE-2026-19949",
"desc": "PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.",
"pushed": "2026-09-15T19:20:24Z",
"created": "2026-09-08T09:25:28Z",
"cve": "CVE-2026-19949",
"kev": false
},
{
"year": 2026,
"stars": 3,
"name": "CVE-2026-12944",
"url": "https://github.com/cflowsec/CVE-2026-12944",
"desc": "Langflow 1.10.0 urllib SSRF POC",
"pushed": "2026-09-15T17:25:47Z",
"created": "2026-09-15T17:23:04Z",
"cve": "CVE-2026-12944",
"kev": false
},
{
"year": 2026,
"stars": 16,
"name": "CVE-2026-31694-POC",
"url": "https://github.com/0xCyberstan/CVE-2026-31694-POC",
"desc": "Linux kernel FUSE readdir cache out-of-bounds write (CVE-2026-31694): a malicious FUSE server overflows a page-cache page by 24 bytes. PoC plus an unprivileged local-root exploit via /etc/passwd page-cache corruption. Run only inside a VM.",
"pushed": "2026-09-14T13:05:46Z",
"created": "2026-06-30T11:49:36Z",
"cve": "CVE-2026-31694",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "CVE-2026-18963",
"url": "https://github.com/EQSTLab/CVE-2026-18963",
"desc": "Keycloak reset-credentials flow bypass",
"pushed": "2026-09-14T06:40:31Z",
"created": "2026-09-01T09:08:39Z",
"cve": "CVE-2026-18963",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "CVE-2026-73570",
"url": "https://github.com/gabrielunknown/CVE-2026-73570",
"desc": "Zimbra SNMP Notification OS Command Injection - Unauthenticated RCE via SMTP exploit (Poc)",
"pushed": "2026-09-14T05:13:23Z",
"created": "2026-08-26T03:30:14Z",
"cve": "CVE-2026-73570",
"kev": true
},
{
"year": 2026,
"stars": 7,
"name": "CVE-2026-42536-PoC",
"url": "https://github.com/erberkan/CVE-2026-42536-PoC",
"desc": "Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content",
"pushed": "2026-09-13T18:55:32Z",
"created": "2026-09-13T18:53:32Z",
"cve": "CVE-2026-42536",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "CVE-2026-33439-Python-PoC",
"url": "https://github.com/infernosalex/CVE-2026-33439-Python-PoC",
"desc": "Python PoC for CVE-2026-33439, an OpenAM pre-authentication RCE via jato.clientSession deserialization",
"pushed": "2026-09-12T22:10:00Z",
"created": "2026-09-12T22:10:46Z",
"cve": "CVE-2026-33439",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "cve-2026-85706-poc-exploit-gitlab",
"url": "https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab",
"desc": "cve-2026-85706-poc-exploit-gitlab",
"pushed": "2026-09-12T20:42:07Z",
"created": "2026-09-12T20:40:56Z",
"cve": "CVE-2026-85706",
"kev": true
},
{
"year": 2026,
"stars": 5,
"name": "CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.",
"url": "https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.",
"desc": "Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)",
"pushed": "2026-09-12T17:25:09Z",
"created": "2026-09-12T17:17:06Z",
"cve": "CVE-2026-87575",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "CVE-2026-78006-POC",
"url": "https://github.com/DeadExpl0it/CVE-2026-78006-POC",
"desc": "POC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution",
"pushed": "2026-09-12T11:40:55Z",
"created": "2026-09-12T11:19:47Z",
"cve": "CVE-2026-78006",
"kev": false
},
{
"year": 2026,
"stars": 4,
"name": "CVE-2026-89013",
"url": "https://github.com/Faceless0x7/CVE-2026-89013",
"desc": "CVE-2026-89013 Exploit - Authorization bypass in Dolibarr via the hashp parameter, enabling unauthenticated access to protected documents and files.",
"pushed": "2026-09-11T22:07:34Z",
"created": "2026-09-11T22:06:47Z",
"cve": "CVE-2026-89013",
"kev": false
},
{
"year": 2026,
"stars": 5,
"name": "CVE-2026-89012",
"url": "https://github.com/Faceless0x7/CVE-2026-89012",
"desc": "CVE-2026-89012 Exploit - SQL filter denylist bypass in Dolibarr via case-insensitive SQL column resolution and case-sensitive denylist matching.",
"pushed": "2026-09-11T22:04:39Z",
"created": "2026-09-11T22:03:51Z",
"cve": "CVE-2026-89012",
"kev": false
},
{
"year": 2026,
"stars": 3,
"name": "CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter",
"url": "https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter",
"desc": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"pushed": "2026-09-11T19:05:49Z",
"created": "2026-09-10T21:47:12Z",
"cve": "CVE-2026-87491",
"kev": true
},
{
"year": 2026,
"stars": 10,
"name": "CVE-2026-85706",
"url": "https://github.com/mhtsec/CVE-2026-85706",
"desc": "GitLab CE/EE unauthenticated path traversal (CVE-2026-85706) - PoC",
"pushed": "2026-09-11T17:15:16Z",
"created": "2026-09-11T16:18:11Z",
"cve": "CVE-2026-85706",
"kev": true
},
{
"year": 2026,
"stars": 38,
"name": "cve-2026-85706",
"url": "https://github.com/guneykabel/cve-2026-85706",
"desc": "Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7-19.1.7; 19.2.0-19.2.5; 19.3.0-19.3.1",
"pushed": "2026-09-11T16:38:12Z",
"created": "2026-09-11T15:24:22Z",
"cve": "CVE-2026-85706",
"kev": true
},
{
"year": 2026,
"stars": 28,
"name": "CVE-2026-54121-PoC-Exploit",
"url": "https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit",
"desc": "👻 CVE-2026-54121 - Best CertiGhost AD CS Multi-Exploit Framework / Advanced toolkit with rogue DC/LDAP servers, certificate abuse, PKINIT hash extraction. Features: detect safe check, exploit full multi-threaded. 🛡️ CVSS 8.8 High - Use Ethically, Stay Legal. 🔒",
"pushed": "2026-09-11T16:00:25Z",
"created": "2026-07-25T18:01:04Z",
"cve": "CVE-2026-54121",
"kev": false
},
{
"year": 2025,
"stars": 7,
"name": "CVE-2025-32432-exploit-by-P34NUT",
"url": "https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT",
"desc": "Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail",
"pushed": "2026-09-17T02:22:58Z",
"created": "2026-09-16T23:32:09Z",
"cve": "CVE-2025-32432",
"kev": true
},
{
"year": 2025,
"stars": 3,
"name": "CVE-2025-3248-Langflow-RCE",
"url": "https://github.com/hideki233/CVE-2025-3248-Langflow-RCE",
"desc": "Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode.",
"pushed": "2026-08-28T00:05:41Z",
"created": "2026-08-28T00:05:42Z",
"cve": "CVE-2025-3248",
"kev": true
},
{
"year": 2025,
"stars": 7,
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"url": "https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"desc": "Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.",
"pushed": "2026-08-27T07:13:42Z",
"created": "2026-08-19T09:39:46Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 4,
"name": "cve-2025-21479_iqooneo8",
"url": "https://github.com/Qingizi7/cve-2025-21479_iqooneo8",
"desc": "Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables SELinux, spawns root shell",
"pushed": "2026-08-20T01:33:10Z",
"created": "2026-08-20T01:13:39Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 3,
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"url": "https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
"desc": "iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案",
"pushed": "2026-08-18T01:40:18Z",
"created": "2026-08-18T02:31:53Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 20,
"name": "CVE-2025-7771",
"url": "https://github.com/enessakircolak/CVE-2025-7771",
"desc": "ThrottleStop.sys Arbitrary Physical Memory R/W",
"pushed": "2026-08-10T23:15:22Z",
"created": "2026-08-10T23:15:36Z",
"cve": "CVE-2025-7771",
"kev": false
},
{
"year": 2025,
"stars": 6,
"name": "CVE-2025-8045",
"url": "https://github.com/kuzeyardabulut/CVE-2025-8045",
"desc": "Dirty Pagetable Exploit for CVE-2025-8045",
"pushed": "2026-08-06T14:58:53Z",
"created": "2026-08-06T13:52:33Z",
"cve": "CVE-2025-8045",
"kev": false
},
{
"year": 2025,
"stars": 7,
"name": "SELinux-Permissive-Only-CVE-2025-21479",
"url": "https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479",
"desc": "This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices",
"pushed": "2026-08-02T06:48:32Z",
"created": "2026-07-28T06:41:38Z",
"cve": "CVE-2025-21479",
"kev": true
},
{
"year": 2025,
"stars": 4,
"name": "CVE-2025-32432",
"url": "https://github.com/c0gnit00/CVE-2025-32432",
"desc": "Exploit, POC for CVE-2025-32432, CraftCMS2Shell",
"pushed": "2026-07-21T16:55:33Z",
"created": "2026-07-21T16:52:22Z",
"cve": "CVE-2025-32432",
"kev": true
},
{
"year": 2025,
"stars": 4,
"name": "CVE-2025-64512",
"url": "https://github.com/matesz44/CVE-2025-64512",
"desc": "CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads",
"pushed": "2026-07-19T11:00:00Z",
"created": "2026-07-19T10:49:05Z",
"cve": "CVE-2025-64512",
"kev": false
},
{
"year": 2025,
"stars": 4,
"name": "CVE-2025-8110-gogs-poc",
"url": "https://github.com/Shirouuu/CVE-2025-8110-gogs-poc",
"desc": "PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink",
"pushed": "2026-07-17T13:55:11Z",
"created": "2026-07-17T13:46:16Z",
"cve": "CVE-2025-8110",
"kev": true
},
{
"year": 2025,
"stars": 7,
"name": "CVE-2025-30065",
"url": "https://github.com/h3st4k3r/CVE-2025-30065",
"desc": "This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls.",
"pushed": "2026-07-08T08:01:25Z",
"created": "2025-04-04T08:45:24Z",
"cve": "CVE-2025-30065",
"kev": false
},
{
"year": 2025,
"stars": 4,
"name": "CVE-2025-69212-PoC",
"url": "https://github.com/BridgerAlderson/CVE-2025-69212-PoC",
"desc": "OpenSTAManager v2.9.8 and earlier versions contain a critical OS Command Injection vulnerability in the P7M (signed XML) file decoding function.",
"pushed": "2026-07-02T20:41:12Z",
"created": "2026-06-30T13:38:40Z",
"cve": "CVE-2025-69212",
"kev": false
},
{
"year": 2025,
"stars": 3,
"name": "CVE-2025-57819",
"url": "https://github.com/K3ysTr0K3R/CVE-2025-57819",
"desc": "CVE-2025-57819 - FreePBX Unauthenticated Remote Code Execution (RCE)",
"pushed": "2026-07-02T19:17:51Z",
"created": "2026-07-02T19:07:36Z",
"cve": "CVE-2025-57819",
"kev": true
},
{
"year": 2025,
"stars": 4,
"name": "CVE-2025-69212-PoC",
"url": "https://github.com/tohib09/CVE-2025-69212-PoC",
"desc": "OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.",
"pushed": "2026-06-27T23:56:25Z",
"created": "2026-06-27T23:54:57Z",
"cve": "CVE-2025-69212",
"kev": false
},
{
"year": 2025,
"stars": 5,
"name": "CVE-2025-8110",
"url": "https://github.com/joaquinrrr/CVE-2025-8110",
"desc": "PoC exploit for CVE-2025-8110",
"pushed": "2026-06-25T16:53:11Z",
"created": "2026-06-25T16:48:18Z",
"cve": "CVE-2025-8110",
"kev": true
},
{
"year": 2024,
"stars": 17,
"name": "CVE-2024-56426",
"url": "https://github.com/Creeeeger/CVE-2024-56426",
"desc": "A PoC of the CVE-2024-56426 vulnerability.",
"pushed": "2026-08-16T15:12:56Z",
"created": "2026-04-07T12:02:52Z",
"cve": "CVE-2024-56426",
"kev": false
},
{
"year": 2024,
"stars": 4,
"name": "CVE-2024-56426",
"url": "https://github.com/xcracker000/CVE-2024-56426",
"desc": "CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F",
"pushed": "2026-08-15T06:21:41Z",
"created": "2026-08-15T06:12:04Z",
"cve": "CVE-2024-56426",
"kev": false
},
{
"year": 2024,
"stars": 3,
"name": "CVE-2024-36104-PoC",
"url": "https://github.com/Groppoxx/CVE-2024-36104-PoC",
"desc": "PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport",
"pushed": "2026-07-29T21:15:12Z",
"created": "2026-07-29T19:59:36Z",
"cve": "CVE-2024-36104",
"kev": false
},
{
"year": 2023,
"stars": 3,
"name": "CVE-2023-52076-PoC",
"url": "https://github.com/Groppoxx/CVE-2023-52076-PoC",
"desc": "PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only.",
"pushed": "2026-07-27T07:00:54Z",
"created": "2026-07-27T06:51:21Z",
"cve": "CVE-2023-52076",
"kev": false
},
{
"year": 2023,
"stars": 6,
"name": "CVE-2023-36003",
"url": "https://github.com/johnnygreeme/CVE-2023-36003",
"desc": "PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender.",
"pushed": "2026-07-22T19:46:33Z",
"created": "2026-07-22T19:43:34Z",
"cve": "CVE-2023-36003",
"kev": false
},
{
"year": 2023,
"stars": 4,
"name": "cve-2023-4911-exploit-optimized",
"url": "https://github.com/jarpex/cve-2023-4911-exploit-optimized",
"desc": "Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing brute-forcing, dynamic calibration, integrated ELF parser.",
"pushed": "2026-07-07T21:02:04Z",
"created": "2026-06-29T21:05:09Z",
"cve": "CVE-2023-4911",
"kev": true
},
{
"year": 2023,
"stars": 15,
"name": "CVE-2023-32315-EXPLOIT",
"url": "https://github.com/K3ysTr0K3R/CVE-2023-32315-EXPLOIT",
"desc": "A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass",
"pushed": "2026-07-05T17:29:00Z",
"created": "2023-12-15T16:30:51Z",
"cve": "CVE-2023-32315",
"kev": true
},
{
"year": 2025,
"stars": 1,
"name": "Flowise-RCE-CVE-2025-59528",
"url": "https://github.com/arensballiu/Flowise-RCE-CVE-2025-59528",
"desc": "Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability in the /api/v1/node-load-method/customMCP endpoint to execute arbitrary system commands via Node.js child_process.execSync(). Includes full PoC script and remediation steps.",
"pushed": "2026-09-19T19:44:25Z",
"created": "2026-04-15T12:47:25Z",
"cve": "CVE-2025-59528",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 1,
"name": "Flowise-CVE-2025-58434-PasswordReset",
"url": "https://github.com/arensballiu/Flowise-CVE-2025-58434-PasswordReset",
"desc": "Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password without prior authentication. Includes a proof-of-concept script and mitigation guidelines.",
"pushed": "2026-09-19T19:41:07Z",
"created": "2026-04-15T12:40:16Z",
"cve": "CVE-2025-58434",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 0,
"name": "CVE-2025-20260",
"url": "https://github.com/keyuraghao/CVE-2025-20260",
"desc": "First public PoC for CVE-2025-20260 (CVSS 9.8) - a ClamAV PDF-scanning buffer overflow, with core-dump analysis.",
"pushed": "2026-09-18T18:51:39Z",
"created": "2025-11-13T00:24:05Z",
"cve": "CVE-2025-20260",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 1,
"name": "CVE-2026-31802",
"url": "https://github.com/Recorded-texteditor120/CVE-2026-31802",
"desc": "Demonstrate and analyze the CVE-2026-31802 path traversal vulnerability in npm tar, enabling arbitrary file overwrite via symlink extraction.",
"pushed": "2026-09-18T06:50:49Z",
"created": "2026-03-28T20:49:46Z",
"cve": "CVE-2026-31802",
"kev": false,
"landed": true
},
{
"year": 2026,
"stars": 2,
"name": "CVE-2026-93453",
"url": "https://github.com/Faceless0x7/CVE-2026-93453",
"desc": "CVE-2026-93453 Exploit - SOGo password reset link poisoning via attacker-controlled Origin header, enabling password reset token interception and account takeover.",
"pushed": "2026-09-18T02:00:00Z",
"created": "2026-09-18T06:40:15Z",
"cve": "CVE-2026-93453",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 0,
"name": "lenovo_y700_tb320fc_on_CVE-2025-21479",
"url": "https://github.com/xjoker/lenovo_y700_tb320fc_on_CVE-2025-21479",
"desc": "Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.",
"pushed": "2026-09-17T23:13:37Z",
"created": "2026-09-16T11:58:06Z",
"cve": "CVE-2025-21479",
"kev": true,
"landed": true
},
{
"year": 2025,
"stars": 1,
"name": "CVE-2025-57231",
"url": "https://github.com/anirbala98/CVE-2025-57231",
"desc": "Docmost < 0.22.0 - Arbitrary File Read",
"pushed": "2026-09-16T11:12:10Z",
"created": "2026-09-12T12:17:38Z",
"cve": "CVE-2025-57231",
"kev": false,
"landed": true
},
{
"year": 2025,
"stars": 0,
"name": "Langflow-RCE-CVE-2025-3248",
"url": "https://github.com/LeotheGGman/Langflow-RCE-CVE-2025-3248",
"desc": "Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode.",
"pushed": "2026-09-15T23:49:56Z",
"created": "2026-09-05T03:01:58Z",
"cve": "CVE-2025-3248",
"kev": true,
"landed": true
},
{
"year": 2026,
"stars": 2,
"name": "CVE-2026-82329-PoC-Exploit",
"url": "https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit",
"desc": "🧰 CVE-2026-82329 - JFrog Artifactory Auth Bypass Toolkit (CVSS 9.8) / Red/Blue Team suite for self-hosted Artifactory 7.x (111-161). 2 tools: Full Exploit (JWTforge, admin token, user create, mass scan, stealth, interactive menu, resistence, WAF bypass etc.), SafeChecker (version detect, audit, JSON report). 🦾 Use Ethically, Stay Legal :V",
"pushed": "2026-09-15T20:28:01Z",
"created": "2026-09-15T20:15:28Z",
"cve": "CVE-2026-82329",
"kev": true,
"landed": true
},
{
"year": 2026,
"stars": 1,
"name": "langflow-CVE-2026-17633-PoC",
"url": "https://github.com/Oscar-Collado/langflow-CVE-2026-17633-PoC",
"desc": "PoC for CVE-2026-17633 - Authenticated RCE in IBM Langflow OSS 1.0.0-1.10.3 via custom_component endpoint. Includes CVE-2026-17632 AST scanner bypass research.",
"pushed": "2026-09-15T18:09:12Z",
"created": "2026-09-15T16:06:55Z",
"cve": "CVE-2026-17633",
"kev": false,
"landed": true
}
]
Reference in new issue View Git Blame Copy Permalink