mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
563 lines
26 KiB
JSON
563 lines
26 KiB
JSON
[
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "CVE-2026-87902",
|
|
"url": "https://github.com/tonydelouvre/CVE-2026-87902",
|
|
"desc": "XWP_RCE - CVE-2026-87902 Hacker Console",
|
|
"pushed": "2026-09-29T20:16:39Z",
|
|
"created": "2026-09-29T20:17:47Z",
|
|
"cve": "CVE-2026-87902",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 4,
|
|
"name": "CVE-2026-41091-PoC-Exploit",
|
|
"url": "https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit",
|
|
"desc": "CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\\SYSTEM - via Cloud Files API + NTFS junction trickery. Forces Defender to write malicious payloads to System32 with SYSTEM rights - Actively exploited in wild. CVSS 7.8. Patch: Defender Engine 1.1.26040.8. Educational & Legal uses only.",
|
|
"pushed": "2026-09-29T15:56:10Z",
|
|
"created": "2026-06-20T10:25:34Z",
|
|
"cve": "CVE-2026-41091",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 29,
|
|
"name": "CVE-2026-54121-PoC-Exploit",
|
|
"url": "https://github.com/tc4dy/CVE-2026-54121-PoC-Exploit",
|
|
"desc": "CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse, PKINIT hash extraction, auto DCSync. Safe Checker + full exploit, multi-threaded mass scan, Shodan integration, JSON/CSV/JSONL output. CVSS 8.8 High. Use Ethically, Stay Legal :v",
|
|
"pushed": "2026-09-29T15:28:31Z",
|
|
"created": "2026-07-25T18:01:04Z",
|
|
"cve": "CVE-2026-54121",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 7,
|
|
"name": "CVE-2026-24061-PoC-Exploit",
|
|
"url": "https://github.com/tc4dy/CVE-2026-24061-PoC-Exploit",
|
|
"desc": "CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON leads to auth bypass & instant root shell. Single/Mass exploitation, multi-threading, custom port/user, pipe mode, session keep-alive, colored output, retries, timeout support. Python & Bash versions. Critical CVSS 9.8.",
|
|
"pushed": "2026-09-29T15:16:57Z",
|
|
"created": "2026-06-06T12:38:43Z",
|
|
"cve": "CVE-2026-24061",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 6,
|
|
"name": "watchTowr-vs-Citrix-Netscaler-CVE-2026-88772",
|
|
"url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772",
|
|
"desc": "Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service",
|
|
"pushed": "2026-09-29T13:42:03Z",
|
|
"created": "2026-09-27T18:15:55Z",
|
|
"cve": "CVE-2026-88772",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 43,
|
|
"name": "CVE-2026-94545",
|
|
"url": "https://github.com/EQSTLab/CVE-2026-94545",
|
|
"desc": "Next.js RCE",
|
|
"pushed": "2026-09-29T07:52:23Z",
|
|
"created": "2026-09-29T07:57:18Z",
|
|
"cve": "CVE-2026-94545",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "CVE-2026-49869",
|
|
"url": "https://github.com/EQSTLab/CVE-2026-49869",
|
|
"desc": "Kestra Unauthenticated RCE",
|
|
"pushed": "2026-09-29T06:07:38Z",
|
|
"created": "2026-09-29T05:24:33Z",
|
|
"cve": "CVE-2026-49869",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "CVE-2026-56096",
|
|
"url": "https://github.com/yairHinkis/CVE-2026-56096",
|
|
"desc": "Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr)",
|
|
"pushed": "2026-09-28T10:14:29Z",
|
|
"created": "2026-09-16T15:40:17Z",
|
|
"cve": "CVE-2026-56096",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 23,
|
|
"name": "watchTowr-vs-Citrix-Netscaler-CVE-2026-88771",
|
|
"url": "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771",
|
|
"desc": "Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.",
|
|
"pushed": "2026-09-28T09:24:46Z",
|
|
"created": "2026-09-27T18:15:38Z",
|
|
"cve": "CVE-2026-88771",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 25,
|
|
"name": "CVE-2026-85706",
|
|
"url": "https://github.com/EQSTLab/CVE-2026-85706",
|
|
"desc": "GitLab Unauthenticated Arbitrary File Read",
|
|
"pushed": "2026-09-28T05:17:40Z",
|
|
"created": "2026-09-28T04:47:10Z",
|
|
"cve": "CVE-2026-85706",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "CVE-2026-78006-CVE-2026-78159",
|
|
"url": "https://github.com/antid00t/CVE-2026-78006-CVE-2026-78159",
|
|
"desc": "The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159",
|
|
"pushed": "2026-09-28T03:09:04Z",
|
|
"created": "2026-09-28T00:45:37Z",
|
|
"cve": "CVE-2026-78006",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 17,
|
|
"name": "CVE-2026-18963",
|
|
"url": "https://github.com/EQSTLab/CVE-2026-18963",
|
|
"desc": "Keycloak reset-credentials flow bypass",
|
|
"pushed": "2026-09-28T01:52:59Z",
|
|
"created": "2026-09-01T09:08:39Z",
|
|
"cve": "CVE-2026-18963",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 13,
|
|
"name": "CVE-2026-88772",
|
|
"url": "https://github.com/murrez/CVE-2026-88772",
|
|
"desc": "CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772",
|
|
"pushed": "2026-09-27T20:26:06Z",
|
|
"created": "2026-09-27T20:24:56Z",
|
|
"cve": "CVE-2026-88772",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 29,
|
|
"name": "CVE-2026-34990",
|
|
"url": "https://github.com/predyy/CVE-2026-34990",
|
|
"desc": "CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc.",
|
|
"pushed": "2026-09-27T19:48:09Z",
|
|
"created": "2026-09-27T19:41:06Z",
|
|
"cve": "CVE-2026-34990",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 13,
|
|
"name": "CVE-2026-28695",
|
|
"url": "https://github.com/predyy/CVE-2026-28695",
|
|
"desc": "CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS.",
|
|
"pushed": "2026-09-27T18:22:03Z",
|
|
"created": "2026-09-27T18:15:52Z",
|
|
"cve": "CVE-2026-28695",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "mediawiki-CVE-2026-100382",
|
|
"url": "https://github.com/nth347/mediawiki-CVE-2026-100382",
|
|
"desc": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.",
|
|
"pushed": "2026-09-27T15:20:01Z",
|
|
"created": "2026-09-27T15:31:44Z",
|
|
"cve": "CVE-2026-100382",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 5,
|
|
"name": "opace6-cve-2026-64560",
|
|
"url": "https://github.com/qingle009/opace6-cve-2026-64560",
|
|
"desc": "OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address",
|
|
"pushed": "2026-09-27T15:19:49Z",
|
|
"created": "2026-09-26T12:31:39Z",
|
|
"cve": "CVE-2026-64560",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 3,
|
|
"name": "CVE-2026-48842",
|
|
"url": "https://github.com/4minx/CVE-2026-48842",
|
|
"desc": "CVE-2026-48842 PoC - Roundcube virtuser_query pre-auth SQLi",
|
|
"pushed": "2026-09-27T11:35:45Z",
|
|
"created": "2026-09-27T11:26:19Z",
|
|
"cve": "CVE-2026-48842",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 10,
|
|
"name": "CVE-2026-87902-Toolkit",
|
|
"url": "https://github.com/tc4dy/CVE-2026-87902-Toolkit",
|
|
"desc": "CVE-2026-87902 - WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7-7.1.1. / 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). Use Ethically & Authorized Enviorement, Stay Legal <3",
|
|
"pushed": "2026-09-27T10:47:37Z",
|
|
"created": "2026-09-23T19:21:48Z",
|
|
"cve": "CVE-2026-87902",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2026,
|
|
"stars": 10,
|
|
"name": "op13-cve-2026-64560",
|
|
"url": "https://github.com/a23bc/op13-cve-2026-64560",
|
|
"desc": "In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is \"harmless\" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p->sighand = NULL; sh = lock_task_sighand(p) sighand = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p->sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems with mt exec\") added a temporary workaround for that in 2010 which surv ---truncated---",
|
|
"pushed": "2026-09-27T09:21:01Z",
|
|
"created": "2026-09-24T17:36:00Z",
|
|
"cve": "CVE-2026-64560",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 5,
|
|
"name": "CVE-2025-45737",
|
|
"url": "https://github.com/Shinn-Home/CVE-2025-45737",
|
|
"desc": "利用CVE-2025-45737漏洞，实现提权",
|
|
"pushed": "2026-10-02T13:52:42Z",
|
|
"created": "2026-10-02T13:48:22Z",
|
|
"cve": "CVE-2025-45737",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 7,
|
|
"name": "CVE-2025-32432-exploit-by-P34NUT",
|
|
"url": "https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT",
|
|
"desc": "Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail",
|
|
"pushed": "2026-09-17T02:22:58Z",
|
|
"created": "2026-09-16T23:32:09Z",
|
|
"cve": "CVE-2025-32432",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 3,
|
|
"name": "CVE-2025-3248-Langflow-RCE",
|
|
"url": "https://github.com/hideki233/CVE-2025-3248-Langflow-RCE",
|
|
"desc": "Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode.",
|
|
"pushed": "2026-08-28T00:05:41Z",
|
|
"created": "2026-08-28T00:05:42Z",
|
|
"cve": "CVE-2025-3248",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 9,
|
|
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
|
|
"url": "https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
|
|
"desc": "Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.",
|
|
"pushed": "2026-08-27T07:13:42Z",
|
|
"created": "2026-08-19T09:39:46Z",
|
|
"cve": "CVE-2025-21479",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 6,
|
|
"name": "cve-2025-21479_iqooneo8",
|
|
"url": "https://github.com/Qingizi7/cve-2025-21479_iqooneo8",
|
|
"desc": "Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables SELinux, spawns root shell",
|
|
"pushed": "2026-08-20T01:33:10Z",
|
|
"created": "2026-08-20T01:13:39Z",
|
|
"cve": "CVE-2025-21479",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 3,
|
|
"name": "vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
|
|
"url": "https://github.com/reaizuguo/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479",
|
|
"desc": "iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案",
|
|
"pushed": "2026-08-18T01:40:18Z",
|
|
"created": "2026-08-18T02:31:53Z",
|
|
"cve": "CVE-2025-21479",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 22,
|
|
"name": "CVE-2025-7771",
|
|
"url": "https://github.com/enessakircolak/CVE-2025-7771",
|
|
"desc": "ThrottleStop.sys Arbitrary Physical Memory R/W",
|
|
"pushed": "2026-08-10T23:15:22Z",
|
|
"created": "2026-08-10T23:15:36Z",
|
|
"cve": "CVE-2025-7771",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 6,
|
|
"name": "CVE-2025-8045",
|
|
"url": "https://github.com/kuzeyardabulut/CVE-2025-8045",
|
|
"desc": "Dirty Pagetable Exploit for CVE-2025-8045",
|
|
"pushed": "2026-08-06T14:58:53Z",
|
|
"created": "2026-08-06T13:52:33Z",
|
|
"cve": "CVE-2025-8045",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 7,
|
|
"name": "SELinux-Permissive-Only-CVE-2025-21479",
|
|
"url": "https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479",
|
|
"desc": "This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices",
|
|
"pushed": "2026-08-02T06:48:32Z",
|
|
"created": "2026-07-28T06:41:38Z",
|
|
"cve": "CVE-2025-21479",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 4,
|
|
"name": "CVE-2025-32432",
|
|
"url": "https://github.com/c0gnit00/CVE-2025-32432",
|
|
"desc": "Exploit, POC for CVE-2025-32432, CraftCMS2Shell",
|
|
"pushed": "2026-07-21T16:55:33Z",
|
|
"created": "2026-07-21T16:52:22Z",
|
|
"cve": "CVE-2025-32432",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 3,
|
|
"name": "CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation",
|
|
"url": "https://github.com/JM00NJ/CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation",
|
|
"desc": "CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation",
|
|
"pushed": "2026-07-20T13:33:10Z",
|
|
"created": "2026-02-13T22:26:25Z",
|
|
"cve": "CVE-2025-6019",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 4,
|
|
"name": "CVE-2025-64512",
|
|
"url": "https://github.com/matesz44/CVE-2025-64512",
|
|
"desc": "CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads",
|
|
"pushed": "2026-07-19T11:00:00Z",
|
|
"created": "2026-07-19T10:49:05Z",
|
|
"cve": "CVE-2025-64512",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 4,
|
|
"name": "CVE-2025-8110-gogs-poc",
|
|
"url": "https://github.com/Shirouuu/CVE-2025-8110-gogs-poc",
|
|
"desc": "PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink",
|
|
"pushed": "2026-07-17T13:55:11Z",
|
|
"created": "2026-07-17T13:46:16Z",
|
|
"cve": "CVE-2025-8110",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 7,
|
|
"name": "CVE-2025-30065",
|
|
"url": "https://github.com/h3st4k3r/CVE-2025-30065",
|
|
"desc": "This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantiate arbitrary record types during parsing, enabling code execution when untrusted data is processed without proper controls.",
|
|
"pushed": "2026-07-08T08:01:25Z",
|
|
"created": "2025-04-04T08:45:24Z",
|
|
"cve": "CVE-2025-30065",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2024,
|
|
"stars": 17,
|
|
"name": "CVE-2024-56426",
|
|
"url": "https://github.com/Creeeeger/CVE-2024-56426",
|
|
"desc": "A PoC of the CVE-2024-56426 vulnerability.",
|
|
"pushed": "2026-10-03T08:14:17Z",
|
|
"created": "2026-04-07T12:02:52Z",
|
|
"cve": "CVE-2024-56426",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2024,
|
|
"stars": 4,
|
|
"name": "CVE-2024-56426",
|
|
"url": "https://github.com/xcracker000/CVE-2024-56426",
|
|
"desc": "CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F",
|
|
"pushed": "2026-08-15T06:21:41Z",
|
|
"created": "2026-08-15T06:12:04Z",
|
|
"cve": "CVE-2024-56426",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2024,
|
|
"stars": 3,
|
|
"name": "CVE-2024-36104-PoC",
|
|
"url": "https://github.com/Groppoxx/CVE-2024-36104-PoC",
|
|
"desc": "PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport",
|
|
"pushed": "2026-07-29T21:15:12Z",
|
|
"created": "2026-07-29T19:59:36Z",
|
|
"cve": "CVE-2024-36104",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2023,
|
|
"stars": 3,
|
|
"name": "CVE-2023-52076-PoC",
|
|
"url": "https://github.com/Groppoxx/CVE-2023-52076-PoC",
|
|
"desc": "PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary file write and RCE via crafted EPUB. Authorized security testing only.",
|
|
"pushed": "2026-07-27T07:00:54Z",
|
|
"created": "2026-07-27T06:51:21Z",
|
|
"cve": "CVE-2023-52076",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2023,
|
|
"stars": 6,
|
|
"name": "CVE-2023-36003",
|
|
"url": "https://github.com/johnnygreeme/CVE-2023-36003",
|
|
"desc": "PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender.",
|
|
"pushed": "2026-07-22T19:46:33Z",
|
|
"created": "2026-07-22T19:43:34Z",
|
|
"cve": "CVE-2023-36003",
|
|
"kev": false
|
|
},
|
|
{
|
|
"year": 2023,
|
|
"stars": 4,
|
|
"name": "cve-2023-4911-exploit-optimized",
|
|
"url": "https://github.com/jarpex/cve-2023-4911-exploit-optimized",
|
|
"desc": "Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing brute-forcing, dynamic calibration, integrated ELF parser.",
|
|
"pushed": "2026-07-07T21:02:04Z",
|
|
"created": "2026-06-29T21:05:09Z",
|
|
"cve": "CVE-2023-4911",
|
|
"kev": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE",
|
|
"url": "https://github.com/kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE",
|
|
"desc": "GLPI is a free asset and IT management software package. An authenticated user can upload and force the execution of *.php files located on the GLPI server. This vulnerability is fixed in 10.0.18.",
|
|
"pushed": "2026-10-02T12:08:56Z",
|
|
"created": "2026-10-02T12:08:15Z",
|
|
"cve": "CVE-2025-24801",
|
|
"kev": false,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-47947",
|
|
"url": "https://github.com/yel1337/CVE-2025-47947",
|
|
"desc": "POC for libapache2-mod-security2",
|
|
"pushed": "2026-10-01T18:25:11Z",
|
|
"created": "2026-10-01T18:20:00Z",
|
|
"cve": "CVE-2025-47947",
|
|
"kev": false,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-8110",
|
|
"url": "https://github.com/Makis6/CVE-2025-8110",
|
|
"desc": "Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.",
|
|
"pushed": "2026-10-01T09:59:49Z",
|
|
"created": "2026-10-01T10:01:48Z",
|
|
"cve": "CVE-2025-8110",
|
|
"kev": true,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 1,
|
|
"name": "CVE-2025-29927",
|
|
"url": "https://github.com/vulnace/CVE-2025-29927",
|
|
"desc": "POC for react2shell",
|
|
"pushed": "2026-09-30T18:06:48Z",
|
|
"created": "2026-09-30T18:05:58Z",
|
|
"cve": "CVE-2025-29927",
|
|
"kev": false,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-59528-Poc",
|
|
"url": "https://github.com/Amoru-Bek/CVE-2025-59528-Poc",
|
|
"desc": "Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided mcpServerConfig string to build the MCP server configuration. However, during this process, it executes JavaScript code without any security validation. Specifically, inside the convertToValidJSONString function, user input is directly passed to the Function() constructor, which evaluates and executes the input as JavaScript code. Since this runs with full Node.js runtime privileges, it can access dangerous modules such as child_process and fs. This issue has been patched in version 3.0.6.",
|
|
"pushed": "2026-09-30T16:51:44Z",
|
|
"created": "2026-09-30T16:46:38Z",
|
|
"cve": "CVE-2025-59528",
|
|
"kev": false,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 1,
|
|
"name": "CVE-2025-31161",
|
|
"url": "https://github.com/0xBlackash/CVE-2025-31161",
|
|
"desc": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.",
|
|
"pushed": "2026-09-30T11:18:33Z",
|
|
"created": "2026-04-20T13:27:09Z",
|
|
"cve": "CVE-2025-31161",
|
|
"kev": true,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "cve-2025-30208",
|
|
"url": "https://github.com/Minseo9503/cve-2025-30208",
|
|
"desc": "Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.",
|
|
"pushed": "2026-09-30T07:28:28Z",
|
|
"created": "2026-09-29T02:06:08Z",
|
|
"cve": "CVE-2025-30208",
|
|
"kev": false,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-32463",
|
|
"url": "https://github.com/klvlo/CVE-2025-32463",
|
|
"desc": "PoC / Exploit for CVE-2025-32463(sudo LPE)",
|
|
"pushed": "2026-09-29T13:05:44Z",
|
|
"created": "2026-09-29T12:58:42Z",
|
|
"cve": "CVE-2025-32463",
|
|
"kev": true,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-8088-WinRAR-PoC-3",
|
|
"url": "https://github.com/roof1948576qwd/CVE-2025-8088-WinRAR-PoC-3",
|
|
"desc": "A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.",
|
|
"pushed": "2026-09-29T09:46:43Z",
|
|
"created": "2026-09-29T09:46:25Z",
|
|
"cve": "CVE-2025-8088",
|
|
"kev": true,
|
|
"landed": true
|
|
},
|
|
{
|
|
"year": 2025,
|
|
"stars": 0,
|
|
"name": "CVE-2025-8088-WinRAR-PoC-2",
|
|
"url": "https://github.com/roof1948576qwd/CVE-2025-8088-WinRAR-PoC-2",
|
|
"desc": "A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.",
|
|
"pushed": "2026-09-29T09:45:59Z",
|
|
"created": "2026-09-29T09:45:40Z",
|
|
"cve": "CVE-2025-8088",
|
|
"kev": true,
|
|
"landed": true
|
|
}
|
|
]
|