mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
Just landed
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 0⭐ | 19h ago |  React2Shell_CVE-2025-55182 |
A Proof-of-Concept implementation for CVE-2025-55182, a critical unauthenticated Remote Code Execution… |
| 0⭐ | 1d ago | CVE-2025-60787 | MotionEye OS Command Injection (CVE-2025-60787) |
| 0⭐ | 1d ago | CVE-2025-21065 | A PoC for CVE-2025-21065 that allows any self-attacker to execute commands with Retail Mode privileges (UID… |
| 0⭐ | 2d ago | CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE | GLPI is a free asset and IT management software package. An authenticated user can upload and force the… |
| 0⭐ | 3d ago | CVE-2025-47947 | POC for libapache2-mod-security2 |
| 0⭐ | 3d ago | CVE-2025-8110 |
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
| 1⭐ | 4d ago | CVE-2025-29927 | POC for react2shell |
| 0⭐ | 4d ago | CVE-2025-59528-Poc | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5,… |
| 1⭐ | 4d ago | CVE-2025-31161 |
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin… |
| 0⭐ | 4d ago | cve-2025-30208 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,… |
Trending in 2026
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 6⭐ | 1d ago | cve-2026-103956-loom-unauth | CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is… |
| 115⭐ | 1d ago | cve-2026-41940-PoC |
A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing… |
| 825⭐ | 1d ago | CVE-2026-24061 |
CVE-2026-24061 exploit PoC |
| 3⭐ | 2d ago | CVE-2026-40281-exploit | Gotenberg 8.30.1 unauthenticated RCE exploit |
| 4⭐ | 2d ago | CVE-2026-100520-laranode-path-traversal | Path Traversal -> RCE in Laranode < 1.2.1 (CWE-22). PoC + advisory writeup. |
| 4⭐ | 5d ago | CVE-2026-87902 |
XWP_RCE - CVE-2026-87902 Hacker Console |
| 4⭐ | 5d ago | CVE-2026-41091-PoC-Exploit |
CVE-2026-41091 RedSun / Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\SYSTEM - via… |
| 29⭐ | 5d ago | CVE-2026-54121-PoC-Exploit | CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework / Rogue DC + LDAP spoofing, certificate abuse,… |
| 8⭐ | 5d ago | CVE-2026-24061-PoC-Exploit |
CVE-2026-24061 - GNU inetutils-telnetd Auth Bypass Exploit - Full Control with CRLF injection via NEW_ENVIRON… |
| 6⭐ | 5d ago | watchTowr-vs-Citrix-Netscaler-CVE-2026-88772 |
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before… |
| 45⭐ | 5d ago | CVE-2026-94545 | Next.js RCE |
| 4⭐ | 5d ago | CVE-2026-49869 |
Kestra Unauthenticated RCE |
| 3⭐ | 6d ago | CVE-2026-56096 | Proof of Concept and Write-up for CVE-2026-56096 (Blind Parameter Injection in TYPO3 EXT:solr) |
| 23⭐ | 6d ago | watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 |
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue… |
| 25⭐ | 6d ago | CVE-2026-85706 |
GitLab Unauthenticated Arbitrary File Read |
| 3⭐ | 7d ago | CVE-2026-78006-CVE-2026-78159 | The Events Calendar Wordpress Plugin Mass Exploit CVE-2026-78006 & CVE-2026-78159 |
| 17⭐ | 7d ago | CVE-2026-18963 | Keycloak reset-credentials flow bypass |
| 13⭐ | 7d ago | CVE-2026-88772 |
CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints… |
| 30⭐ | 7d ago | CVE-2026-34990 | CVE-2026-34990 minimal PoC. CUPS <= 2.4.16 local privesc. |
| 13⭐ | 7d ago | CVE-2026-28695 | CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS. |
Trending in 2025
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 7⭐ | 2d ago | CVE-2025-45737 | 利用CVE-2025-45737漏洞，实现提权 |
| 7⭐ | 18d ago | CVE-2025-32432-exploit-by-P34NUT |
Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail |
| 3⭐ | 38d ago | CVE-2025-3248-Langflow-RCE |
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A… |
| 9⭐ | 38d ago | vivo_iqoo_neo_9_root_research_on_CVE-2025-21479 |
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of… |
| 6⭐ | 46d ago | cve-2025-21479_iqooneo8 |
Local root exploit for CVE-2025-21479 (Adreno KGSL) on iQOO Neo8 (SM8475) - physical memory r/w, disables… |
| 3⭐ | 48d ago | vivo_iqoo_neo_9_root_research_on_CVE-2025-21479 |
iQOO Neo9 (PD2338C) 免解锁 Caps-Root 工具** - 基于 CVE-2025-21479 (Adreno GPU SDS) 的任意物理写提权方案 |
| 22⭐ | 55d ago | CVE-2025-7771 | ThrottleStop.sys Arbitrary Physical Memory R/W |
| 6⭐ | 59d ago | CVE-2025-8045 | Dirty Pagetable Exploit for CVE-2025-8045 |
| 7⭐ | 63d ago | SELinux-Permissive-Only-CVE-2025-21479 |
This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the… |
| 4⭐ | 75d ago | CVE-2025-32432 |
Exploit, POC for CVE-2025-32432, CraftCMS2Shell |
| 3⭐ | 76d ago | CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation | CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation |
| 4⭐ | 77d ago | CVE-2025-64512 | CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads |
| 4⭐ | 79d ago | CVE-2025-8110-gogs-poc |
PoC for CVE-2025-8110 - Gogs arbitrary file write via symlink |
| 7⭐ | 88d ago | CVE-2025-30065 | This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It… |
2024, 2023
Trending in 2024
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 17⭐ | 1d ago | CVE-2024-56426 | A PoC of the CVE-2024-56426 vulnerability. |
| 4⭐ | 50d ago | CVE-2024-56426 | CVE-2024-56426 Exynos9830 Bootrom Exploit - SM-G985F |
| 3⭐ | 67d ago | CVE-2024-36104-PoC | PoC for CVE-2024-36104 - unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path… |
Trending in 2023
| Stars | Updated | Repository | Description |
|---|---|---|---|
| 3⭐ | 69d ago | CVE-2023-52076-PoC | PoC exploit for CVE-2023-52076 - zip-slip path traversal in Atril/Xreader (MATE/Cinnamon) enabling arbitrary… |
| 6⭐ | 74d ago | CVE-2023-36003 | PoC for CVE-2023-36003: Windows Exploit Security Feature Bypass Vulnerability in Windows Defender. |
| 4⭐ | 89d ago | cve-2023-4911-exploit-optimized |
Pure C exploit for CVE-2023-4911 (Looney Tunables) - x86_64 & aarch64 implementations. Multi-processing… |
Data
Every file is plain JSON on the CDN. No key, no rate limit.
# everything the index knows about one CVE
curl -s https://pocindex.io/CVE_list.json \
| jq '.[] | select(.cve == "CVE-2021-44228") | {cve, poc: (.poc | length), nuclei, msf, edb, vulhub, collections}'
# every published CVSS assessment plus vetted advisory links
curl -s https://pocindex.io/cve_metadata.json | jq '."CVE-2021-44228"'
# likelihood of exploitation in the next 30 days
curl -s https://pocindex.io/epss.json | jq '."CVE-2021-44228"'
# stars and last push for one PoC repository; repository keys are lowercased
curl -s https://pocindex.io/repo_meta.json | jq '."sfewer-r7/cve-2026-55040"'
What CISA says is being exploited, that also has a PoC here, ranked by how likely each is to be used next:
curl -s https://pocindex.io/kev.json -o kev.json
curl -s https://pocindex.io/epss.json -o epss.json
jq -n --slurpfile kev kev.json --slurpfile epss epss.json \
'[$kev[0] | keys[] | select($epss[0][.]) | {cve: ., epss: $epss[0][.][0]}]
| sort_by(-.epss) | .[:10]'
| Endpoint | Holds |
|---|---|
CVE_list.json |
Every CVE with a linked PoC, its description and its poc, nuclei, msf, edb, vulhub and collections links |
cve_metadata.json |
NVD CVSS v2.0, v3.0, v3.1 and v4.0 assessments with vectors and vetted advisory links |
epss.json |
Exploitation probability and percentile, for nearly every CVE indexed |
nuclei.json |
Template metadata for the CVEs covered by a runnable Nuclei check |
kev.json |
CISA known exploited, keyed by CVE id |
repo_meta.json |
Stars and last push date per PoC repository, keys lowercased |
trending_poc.json |
Trending repositories plus index totals |
cves/2026/CVE-2026-68138.md |
Markdown copy of one CVE, one directory per year |
CVSS rows are [version, score, severity, vector, source, assessment type].
Advisory rows are [URL, NVD reference tags].
Sources
| Source | What it contributes |
|---|---|
| GitHub | Repositories naming a CVE, checked for code before they are linked |
| PoC-in-GitHub | Historical repository candidates, passed through the same code and intent checks |
| Nuclei | Runnable templates that exercise the vulnerability |
| ExploitDB | Archived exploits, mapped by their own CVE column |
| Metasploit | Modules, best ranked first |
| Vulhub | Runnable vulnerable environments and reproduction steps |
| afrog, Vulnerability, 0day, xray | CVE-specific templates, code and reproduction guides inside multi-CVE repositories |
| EPSS | Daily exploitation probability from FIRST |
| CISA KEV | What is being exploited in the wild |
| NVD | CVSS assessments and tagged vendor, third-party, patch and mitigation references |
| CVE Program | The CVE record, publication state and CNA references |
Build
| Job | Cadence | Picks up |
|---|---|---|
| Trending sweep | hourly | Front-page repositories and prior-hour candidates added to the searchable index |
| CVE sync | daily | New CVEs, CNA references and recently pushed GitHub repositories for every CVE year |
| Metadata sync | daily plus weekly full pass | CVSS, advisories, rejected records and current CISA KEV status |
| Nuclei sync | daily | New templates and rating changes |
| Exploit archives | daily | ExploitDB, Metasploit and Vulhub mappings |
| Historical GitHub sync | weekly | Older PoC repositories missed by the recent-push window |
| Path collection sync | weekly | CVE-specific artifacts inside curated multi-CVE repositories |
| Link audit | weekly | Repositories that went dead, dropped from the index |
Contributing
Missing PoC, wrong link, dead repository: open an issue with the CVE id and the repository URL.