nomi-sec/PoC-in-GitHub
1
0 Fork 0
mirror of https://github.com/nomi-sec/PoC-in-GitHub.git synced 2026-11-07 08:30:25 -10:00
Code Issues Packages Projects Releases Wiki Activity

Auto Update 2026/08/08 12:50:17

Browse Source
This commit is contained in:
motikan2010-bot committed 2026-08-08 21:50:18 +09:00
1 parent 2167124039
commit 2f0d7f3eb6
48 files changed
+642 -259
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

2015/CVE-2015-6639.json
+6 -6
View File
@@ -14,12 +14,12 @@
"description": "QSEE Privilege Escalation Exploit using PRDiag* commands (CVE-2015-6639)",
"fork": false,
"created_at": "2016-05-02T12:18:57Z",
"updated_at": "2026-05-13T19:47:12Z",
"updated_at": "2026-08-08T09:13:51Z",
"pushed_at": "2019-08-13T07:14:01Z",
"stargazers_count": 124,
"watchers_count": 124,
"stargazers_count": 125,
"watchers_count": 125,
"has_discussions": false,
"forks_count": 51,
"forks_count": 52,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -27,8 +27,8 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 51,
"watchers": 124,
"forks": 52,
"watchers": 125,
"score": 0,
"subscribers_count": 8
},
2018/CVE-2018-1000529.json
+1 -1
View File
@@ -15,7 +15,7 @@
"fork": false,
"created_at": "2018-05-21T23:43:18Z",
"updated_at": "2018-06-28T20:43:19Z",
"pushed_at": "2018-06-28T20:43:18Z",
"pushed_at": "2026-08-08T11:23:23Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
2019/CVE-2019-1040.json
+2 -2
View File
@@ -179,8 +179,8 @@
"description": "The Windows Print Spooler privilege escalation vulnerability (CVE-2019-1040\/CVE-2019-1019) has been implemented as a Reflective DLL for penetration testing.",
"fork": false,
"created_at": "2025-12-06T19:56:12Z",
"updated_at": "2026-08-08T06:05:26Z",
"pushed_at": "2026-08-08T06:05:21Z",
"updated_at": "2026-08-08T12:15:39Z",
"pushed_at": "2026-08-08T12:15:34Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
2019/CVE-2019-2215.json
+8 -8
View File
@@ -596,10 +596,10 @@
"description": "This is a critical UAF vulnerability exploit that affected the android binder IPC system used in the wild and discovered by P0",
"fork": false,
"created_at": "2024-04-15T06:40:04Z",
"updated_at": "2026-04-17T06:57:26Z",
"updated_at": "2026-08-08T10:10:51Z",
"pushed_at": "2024-04-22T06:36:04Z",
"stargazers_count": 5,
"watchers_count": 5,
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
@@ -610,7 +610,7 @@
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 5,
"watchers": 6,
"score": 0,
"subscribers_count": 1
},
@@ -728,10 +728,10 @@
"description": "CVE-2019-2215 poc for Huawei hardened kernel",
"fork": false,
"created_at": "2025-02-04T08:58:20Z",
"updated_at": "2026-07-11T07:56:04Z",
"updated_at": "2026-08-08T10:09:05Z",
"pushed_at": "2025-02-04T09:16:25Z",
"stargazers_count": 5,
"watchers_count": 5,
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
@@ -742,7 +742,7 @@
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 5,
"watchers": 6,
"score": 0,
"subscribers_count": 1
},
2020/CVE-2020-1472.json
+2 -2
View File
@@ -2383,8 +2383,8 @@
"description": "Zerologon (CVE-2020-1472) Proof-of-Concept application - Critical Active Directory vulnerability exploitation tool.",
"fork": false,
"created_at": "2025-12-06T10:17:38Z",
"updated_at": "2026-08-08T06:00:23Z",
"pushed_at": "2026-08-08T06:00:13Z",
"updated_at": "2026-08-08T12:00:02Z",
"pushed_at": "2026-08-08T11:59:58Z",
"stargazers_count": 4,
"watchers_count": 4,
"has_discussions": false,
2020/CVE-2020-7961.json
+4 -4
View File
@@ -410,10 +410,10 @@
"description": "Security research on Liferay CE 7.0.3 GA4: pre-auth RCE as root (CVE-2020-7961 class) reproduced end-to-end, plus 16 more findings — 8+ with no known CVE. Agentic loop-hunt: 25 generators, 22 judges, 9 live validators on Docker. Evidence trail + one-go checker included.",
"fork": false,
"created_at": "2026-07-28T10:19:06Z",
"updated_at": "2026-07-29T07:50:18Z",
"updated_at": "2026-08-08T11:25:40Z",
"pushed_at": "2026-07-28T10:31:17Z",
"stargazers_count": 5,
"watchers_count": 5,
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -435,7 +435,7 @@
],
"visibility": "public",
"forks": 0,
"watchers": 5,
"watchers": 6,
"score": 0,
"subscribers_count": 0
}
2021/CVE-2021-1931.json
+2 -2
View File
@@ -80,8 +80,8 @@
"description": "Unlock the Meta Quest 1 bootloader and gain root access using GhostLock + CVE-2021-1931.",
"fork": false,
"created_at": "2026-07-31T05:37:56Z",
"updated_at": "2026-08-06T00:36:30Z",
"pushed_at": "2026-07-31T12:18:42Z",
"updated_at": "2026-08-08T11:25:31Z",
"pushed_at": "2026-08-08T11:25:28Z",
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
2021/CVE-2021-33044.json
+2 -2
View File
@@ -212,8 +212,8 @@
"description": "Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.",
"fork": false,
"created_at": "2026-03-28T17:42:44Z",
"updated_at": "2026-08-08T06:09:27Z",
"pushed_at": "2026-08-08T06:09:22Z",
"updated_at": "2026-08-08T12:17:08Z",
"pushed_at": "2026-08-08T12:17:04Z",
"stargazers_count": 4,
"watchers_count": 4,
"has_discussions": false,
2022/CVE-2022-22077.json
+1 -1
View File
@@ -15,7 +15,7 @@
"fork": false,
"created_at": "2025-09-08T21:12:19Z",
"updated_at": "2026-06-19T21:56:25Z",
"pushed_at": "2026-08-03T06:36:36Z",
"pushed_at": "2026-08-08T09:46:57Z",
"stargazers_count": 5,
"watchers_count": 5,
"has_discussions": false,
2022/CVE-2022-40769.json
+2 -2
View File
@@ -52,7 +52,7 @@
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -60,7 +60,7 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"forks": 2,
"watchers": 1,
"score": 0,
"subscribers_count": 0
2023/CVE-2023-20938.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": null,
"fork": false,
"created_at": "2025-06-23T10:54:08Z",
"updated_at": "2026-06-04T02:00:50Z",
"updated_at": "2026-08-08T07:42:24Z",
"pushed_at": "2026-05-12T10:58:41Z",
"stargazers_count": 14,
"watchers_count": 14,
"stargazers_count": 13,
"watchers_count": 13,
"has_discussions": false,
"forks_count": 7,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 7,
"watchers": 14,
"watchers": 13,
"score": 0,
"subscribers_count": 2
},
2023/CVE-2023-23752.json
+6 -6
View File
@@ -1024,12 +1024,12 @@
"description": "A PoC exploit for CVE-2023-23752 - Joomla Improper Access Check in Versions 4.0.0 through 4.2.7",
"fork": false,
"created_at": "2023-12-04T13:05:08Z",
"updated_at": "2026-02-25T03:27:35Z",
"updated_at": "2026-08-08T12:13:47Z",
"pushed_at": "2026-02-01T07:42:09Z",
"stargazers_count": 16,
"watchers_count": 16,
"stargazers_count": 17,
"watchers_count": 17,
"has_discussions": false,
"forks_count": 4,
"forks_count": 5,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -1043,8 +1043,8 @@
"poc"
],
"visibility": "public",
"forks": 4,
"watchers": 16,
"forks": 5,
"watchers": 17,
"score": 0,
"subscribers_count": 2
},
2023/CVE-2023-32233.json
+33
View File
@@ -229,5 +229,38 @@
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327588935,
"name": "CVE-2023-32233-reproduction",
"full_name": "BurnSkyup\/CVE-2023-32233-reproduction",
"owner": {
"login": "BurnSkyup",
"id": 81592655,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/81592655?v=4",
"html_url": "https:\/\/github.com\/BurnSkyup",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/BurnSkyup\/CVE-2023-32233-reproduction",
"description": "A Linux-related vulnerability",
"fork": false,
"created_at": "2026-08-08T09:11:50Z",
"updated_at": "2026-08-08T11:29:22Z",
"pushed_at": "2026-08-08T10:29:18Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2023/CVE-2023-32434.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": "Deterministic kernel exploit based on CVE-2023-32434.",
"fork": false,
"created_at": "2025-03-01T23:07:37Z",
"updated_at": "2026-08-07T19:08:34Z",
"updated_at": "2026-08-08T11:16:15Z",
"pushed_at": "2026-05-14T20:54:50Z",
"stargazers_count": 137,
"watchers_count": 137,
"stargazers_count": 138,
"watchers_count": 138,
"has_discussions": false,
"forks_count": 18,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 18,
"watchers": 137,
"watchers": 138,
"score": 0,
"subscribers_count": 5
},
2023/CVE-2023-38545.json
-33
View File
@@ -262,38 +262,5 @@
"watchers": 0,
"score": 0,
"subscribers_count": 1
},
{
"id": 778652207,
"name": "NS-Project-2024-Spring",
"full_name": "nphuang\/NS-Project-2024-Spring",
"owner": {
"login": "nphuang",
"id": 90141061,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/90141061?v=4",
"html_url": "https:\/\/github.com\/nphuang",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/nphuang\/NS-Project-2024-Spring",
"description": "Network Security Project CVE-2023-38545",
"fork": false,
"created_at": "2024-03-28T06:05:37Z",
"updated_at": "2024-06-25T13:21:48Z",
"pushed_at": "2024-05-30T22:56:06Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 1
}
]
2023/CVE-2023-45866.json
+2 -2
View File
@@ -19,7 +19,7 @@
"stargazers_count": 1886,
"watchers_count": 1886,
"has_discussions": false,
"forks_count": 316,
"forks_count": 317,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -27,7 +27,7 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 316,
"forks": 317,
"watchers": 1886,
"score": 0,
"subscribers_count": 29
2024/CVE-2024-21413.json
+4 -4
View File
@@ -113,10 +113,10 @@
"description": "CVE-2024-21413 PoC for THM Lab",
"fork": false,
"created_at": "2024-02-17T14:52:52Z",
"updated_at": "2026-08-05T21:10:19Z",
"updated_at": "2026-08-08T10:52:06Z",
"pushed_at": "2024-03-13T02:44:28Z",
"stargazers_count": 272,
"watchers_count": 272,
"stargazers_count": 273,
"watchers_count": 273,
"has_discussions": false,
"forks_count": 61,
"allow_forking": true,
@@ -127,7 +127,7 @@
"topics": [],
"visibility": "public",
"forks": 61,
"watchers": 272,
"watchers": 273,
"score": 0,
"subscribers_count": 2
},
2024/CVE-2024-3094.json
+4 -4
View File
@@ -1585,10 +1585,10 @@
"description": "A tutorial on how to detect the CVE 2024-3094",
"fork": false,
"created_at": "2024-04-04T06:40:56Z",
"updated_at": "2024-04-05T10:39:12Z",
"updated_at": "2026-08-08T08:11:10Z",
"pushed_at": "2024-04-05T10:50:45Z",
"stargazers_count": 3,
"watchers_count": 3,
"stargazers_count": 4,
"watchers_count": 4,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -1606,7 +1606,7 @@
],
"visibility": "public",
"forks": 0,
"watchers": 3,
"watchers": 4,
"score": 0,
"subscribers_count": 1
},
2024/CVE-2024-6387.json
+6 -6
View File
@@ -1404,12 +1404,12 @@
"description": "PoC - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (Scanner and Exploit) ",
"fork": false,
"created_at": "2024-07-02T18:32:46Z",
"updated_at": "2026-07-26T20:09:22Z",
"updated_at": "2026-08-08T10:59:13Z",
"pushed_at": "2024-07-05T15:19:28Z",
"stargazers_count": 112,
"watchers_count": 112,
"stargazers_count": 113,
"watchers_count": 113,
"has_discussions": false,
"forks_count": 38,
"forks_count": 39,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -1426,8 +1426,8 @@
"rce"
],
"visibility": "public",
"forks": 38,
"watchers": 112,
"forks": 39,
"watchers": 113,
"score": 0,
"subscribers_count": 3
},
2025/CVE-2025-15521.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": "The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0.",
"fork": false,
"created_at": "2026-04-18T19:53:47Z",
"updated_at": "2026-04-18T19:56:09Z",
"updated_at": "2026-08-08T07:19:42Z",
"pushed_at": "2026-04-18T19:56:04Z",
"stargazers_count": 0,
"watchers_count": 0,
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
}
2025/CVE-2025-21479.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": "CVE-2025-21479 proof-of-concept, I think",
"fork": false,
"created_at": "2025-06-19T19:47:52Z",
"updated_at": "2026-08-06T17:12:25Z",
"updated_at": "2026-08-08T10:27:39Z",
"pushed_at": "2025-08-16T06:52:13Z",
"stargazers_count": 266,
"watchers_count": 266,
"stargazers_count": 267,
"watchers_count": 267,
"has_discussions": false,
"forks_count": 59,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 59,
"watchers": 266,
"watchers": 267,
"score": 0,
"subscribers_count": 2
},
2025/CVE-2025-48804.json
+6 -6
View File
@@ -14,12 +14,12 @@
"description": "Downgrade attack for CVE-2025-48804",
"fork": false,
"created_at": "2026-04-30T13:05:30Z",
"updated_at": "2026-08-07T23:50:59Z",
"updated_at": "2026-08-08T11:55:05Z",
"pushed_at": "2026-07-21T15:59:26Z",
"stargazers_count": 220,
"watchers_count": 220,
"stargazers_count": 221,
"watchers_count": 221,
"has_discussions": false,
"forks_count": 43,
"forks_count": 44,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -31,8 +31,8 @@
"cve-2025-48804"
],
"visibility": "public",
"forks": 43,
"watchers": 220,
"forks": 44,
"watchers": 221,
"score": 0,
"subscribers_count": 3
}
2025/CVE-2025-58726.json
+1 -1
View File
@@ -15,7 +15,7 @@
"fork": false,
"created_at": "2026-03-30T19:34:35Z",
"updated_at": "2026-08-08T04:25:54Z",
"pushed_at": "2026-08-07T18:25:29Z",
"pushed_at": "2026-08-08T12:13:56Z",
"stargazers_count": 33,
"watchers_count": 33,
"has_discussions": false,
2025/CVE-2025-8045.json
+6 -6
View File
@@ -14,12 +14,12 @@
"description": "Dirty Pagetable Exploit for CVE-2025-8045",
"fork": false,
"created_at": "2026-08-06T13:52:33Z",
"updated_at": "2026-08-07T17:08:01Z",
"updated_at": "2026-08-08T09:18:56Z",
"pushed_at": "2026-08-06T14:59:32Z",
"stargazers_count": 1,
"watchers_count": 1,
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -27,8 +27,8 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"forks": 1,
"watchers": 3,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-15409.json
+4 -4
View File
@@ -179,10 +179,10 @@
"description": "Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as couchdb user.",
"fork": false,
"created_at": "2026-08-03T14:59:04Z",
"updated_at": "2026-08-07T16:43:13Z",
"updated_at": "2026-08-08T07:32:05Z",
"pushed_at": "2026-08-03T15:06:00Z",
"stargazers_count": 2,
"watchers_count": 2,
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -209,7 +209,7 @@
],
"visibility": "public",
"forks": 0,
"watchers": 2,
"watchers": 3,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-15430.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": "PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family - xhunter1.sys v2023.12.7.78 and xhunter2.sys v2026.6.1.192 (CVE-2026-15430, CVE-2026-3609).",
"fork": false,
"created_at": "2026-08-05T10:03:50Z",
"updated_at": "2026-08-07T17:04:21Z",
"updated_at": "2026-08-08T10:17:43Z",
"pushed_at": "2026-08-07T07:33:26Z",
"stargazers_count": 8,
"watchers_count": 8,
"stargazers_count": 9,
"watchers_count": 9,
"has_discussions": false,
"forks_count": 5,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 5,
"watchers": 8,
"watchers": 9,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-24061.json
+4 -4
View File
@@ -143,10 +143,10 @@
"description": "CVE-2026-24061 exploit PoC",
"fork": false,
"created_at": "2026-03-08T11:25:39Z",
"updated_at": "2026-08-08T06:40:56Z",
"updated_at": "2026-08-08T12:47:41Z",
"pushed_at": "2026-07-30T15:17:50Z",
"stargazers_count": 606,
"watchers_count": 606,
"stargazers_count": 660,
"watchers_count": 660,
"has_discussions": false,
"forks_count": 15,
"allow_forking": true,
@@ -163,7 +163,7 @@
],
"visibility": "public",
"forks": 15,
"watchers": 606,
"watchers": 660,
"score": 0,
"subscribers_count": 0
},
2026/CVE-2026-27912.json
+6 -6
View File
@@ -14,12 +14,12 @@
"description": "POC tool for ResetNightmare (CVE-2026-27912)",
"fork": false,
"created_at": "2026-08-02T12:36:16Z",
"updated_at": "2026-08-08T00:55:52Z",
"updated_at": "2026-08-08T10:40:15Z",
"pushed_at": "2026-08-02T14:30:24Z",
"stargazers_count": 37,
"watchers_count": 37,
"stargazers_count": 41,
"watchers_count": 41,
"has_discussions": false,
"forks_count": 9,
"forks_count": 10,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -27,8 +27,8 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 9,
"watchers": 37,
"forks": 10,
"watchers": 41,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-3844.json
+33
View File
@@ -64,5 +64,38 @@
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327685508,
"name": "CVE-2026-3844",
"full_name": "AnggaTechI\/CVE-2026-3844",
"owner": {
"login": "AnggaTechI",
"id": 276389265,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/276389265?v=4",
"html_url": "https:\/\/github.com\/AnggaTechI",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/AnggaTechI\/CVE-2026-3844",
"description": "CVE-2026-3844 — Unauthenticated Arbitrary File Upload to RCE in Breeze Cache (WordPress). CVSS 9.8 CRITICAL. Mass scanner + auto shell injector with multi-threading.",
"fork": false,
"created_at": "2026-08-08T11:43:54Z",
"updated_at": "2026-08-08T12:05:40Z",
"pushed_at": "2026-08-08T12:05:37Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2026/CVE-2026-3891.json
+4 -4
View File
@@ -156,10 +156,10 @@
"description": "PoC for CVE-2026-3891 – Unauthenticated File Upload RCE in Pix for WooCommerce ≤ 1.5.0. Automated nonce retrieval, PHP upload, and command execution.",
"fork": false,
"created_at": "2026-08-03T16:01:31Z",
"updated_at": "2026-08-07T16:43:11Z",
"updated_at": "2026-08-08T07:31:56Z",
"pushed_at": "2026-08-03T16:07:43Z",
"stargazers_count": 1,
"watchers_count": 1,
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -183,7 +183,7 @@
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-41089.json
+4 -4
View File
@@ -210,10 +210,10 @@
"description": "Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.",
"fork": false,
"created_at": "2026-07-21T02:05:07Z",
"updated_at": "2026-08-07T08:51:17Z",
"updated_at": "2026-08-08T10:58:25Z",
"pushed_at": "2026-08-07T00:49:48Z",
"stargazers_count": 26,
"watchers_count": 26,
"stargazers_count": 27,
"watchers_count": 27,
"has_discussions": false,
"forks_count": 26,
"allow_forking": true,
@@ -237,7 +237,7 @@
],
"visibility": "public",
"forks": 26,
"watchers": 26,
"watchers": 27,
"score": 0,
"subscribers_count": 0
},
2026/CVE-2026-41293.json
+51
View File
@@ -0,0 +1,51 @@
[
{
"id": 1324789422,
"name": "tomcat-check",
"full_name": "xiaoqiMikko\/tomcat-check",
"owner": {
"login": "xiaoqiMikko",
"id": 37316664,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37316664?v=4",
"html_url": "https:\/\/github.com\/xiaoqiMikko",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/xiaoqiMikko\/tomcat-check",
"description": "查出 Spring Boot 内嵌 Tomcat 的真实版本(pom 里没有),并对每条 2026 年 CVE 同时给出 ASF 官方评级与 GitHub 评级、触发条件、以及这条会不会进 Dependabot 告警 CVE-2026-41293",
"fork": false,
"created_at": "2026-08-06T05:48:01Z",
"updated_at": "2026-08-08T06:54:15Z",
"pushed_at": "2026-08-06T06:20:10Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"apache-tomcat",
"cve",
"cve-2026-41293",
"cve-2026-43512",
"cve-2026-53404",
"cve-2026-55276",
"cve-2026-59083",
"cve-scanner",
"dependabot",
"java",
"security",
"spring-boot",
"tomcat",
"tomcat-embed-core",
"vulnerability-scanner"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2026/CVE-2026-41940.json
+1 -1
View File
@@ -631,7 +631,7 @@
"forks": 39,
"watchers": 313,
"score": 0,
"subscribers_count": 0
"subscribers_count": 9
},
{
"id": 1309488783,
2026/CVE-2026-43499.json
+61 -28
View File
@@ -282,10 +282,10 @@
"description": "CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k",
"fork": false,
"created_at": "2026-07-12T10:15:03Z",
"updated_at": "2026-08-07T20:12:35Z",
"updated_at": "2026-08-08T12:09:08Z",
"pushed_at": "2026-07-15T22:46:59Z",
"stargazers_count": 217,
"watchers_count": 217,
"stargazers_count": 218,
"watchers_count": 218,
"has_discussions": false,
"forks_count": 81,
"allow_forking": true,
@@ -296,7 +296,7 @@
"topics": [],
"visibility": "public",
"forks": 81,
"watchers": 217,
"watchers": 218,
"score": 0,
"subscribers_count": 1
},
@@ -348,10 +348,10 @@
"description": "GhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloader",
"fork": false,
"created_at": "2026-07-12T16:05:24Z",
"updated_at": "2026-08-08T02:17:21Z",
"updated_at": "2026-08-08T12:08:59Z",
"pushed_at": "2026-08-06T09:48:14Z",
"stargazers_count": 225,
"watchers_count": 225,
"stargazers_count": 226,
"watchers_count": 226,
"has_discussions": false,
"forks_count": 46,
"allow_forking": true,
@@ -369,9 +369,9 @@
],
"visibility": "public",
"forks": 46,
"watchers": 225,
"watchers": 226,
"score": 0,
"subscribers_count": 6
"subscribers_count": 8
},
{
"id": 1298678209,
@@ -586,10 +586,10 @@
"description": "Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.",
"fork": false,
"created_at": "2026-07-14T14:21:27Z",
"updated_at": "2026-08-07T07:21:00Z",
"updated_at": "2026-08-08T09:56:44Z",
"pushed_at": "2026-07-30T11:28:07Z",
"stargazers_count": 35,
"watchers_count": 35,
"stargazers_count": 36,
"watchers_count": 36,
"has_discussions": false,
"forks_count": 12,
"allow_forking": true,
@@ -600,7 +600,7 @@
"topics": [],
"visibility": "public",
"forks": 12,
"watchers": 35,
"watchers": 36,
"score": 0,
"subscribers_count": 0
},
@@ -1081,12 +1081,12 @@
"description": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499",
"fork": false,
"created_at": "2026-07-17T14:24:08Z",
"updated_at": "2026-08-08T04:52:41Z",
"updated_at": "2026-08-08T10:17:59Z",
"pushed_at": "2026-08-08T03:30:18Z",
"stargazers_count": 702,
"watchers_count": 702,
"stargazers_count": 707,
"watchers_count": 707,
"has_discussions": false,
"forks_count": 116,
"forks_count": 117,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -1094,10 +1094,10 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 116,
"watchers": 702,
"forks": 117,
"watchers": 707,
"score": 0,
"subscribers_count": 24
"subscribers_count": 28
},
{
"id": 1304629488,
@@ -1628,10 +1628,10 @@
"description": "基于内核漏洞CVE-2026-43499的本地提权适配，集成嵌入式 KernelSU.CVE-2026-43499+KernelSU越狱模式 ",
"fork": false,
"created_at": "2026-07-26T12:39:00Z",
"updated_at": "2026-08-07T17:36:12Z",
"updated_at": "2026-08-08T10:48:19Z",
"pushed_at": "2026-07-26T14:04:57Z",
"stargazers_count": 19,
"watchers_count": 19,
"stargazers_count": 18,
"watchers_count": 18,
"has_discussions": false,
"forks_count": 3,
"allow_forking": true,
@@ -1642,7 +1642,7 @@
"topics": [],
"visibility": "public",
"forks": 3,
"watchers": 19,
"watchers": 18,
"score": 0,
"subscribers_count": 1
},
@@ -2235,10 +2235,10 @@
"description": "ghostlock + tcp-zerocopy hybrid CVE-2026-43499 adaptation for samsung kernel",
"fork": false,
"created_at": "2026-08-07T08:30:56Z",
"updated_at": "2026-08-08T03:51:15Z",
"updated_at": "2026-08-08T12:10:55Z",
"pushed_at": "2026-08-07T18:35:18Z",
"stargazers_count": 5,
"watchers_count": 5,
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -2249,7 +2249,40 @@
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 5,
"watchers": 6,
"score": 0,
"subscribers_count": 1
},
{
"id": 1327683943,
"name": "GhostLock-Galaxy",
"full_name": "wxxsfxyzm\/GhostLock-Galaxy",
"owner": {
"login": "wxxsfxyzm",
"id": 65166044,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/65166044?v=4",
"html_url": "https:\/\/github.com\/wxxsfxyzm",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/wxxsfxyzm\/GhostLock-Galaxy",
"description": "Root your Galaxy using CVE-2026-43499",
"fork": false,
"created_at": "2026-08-08T11:41:33Z",
"updated_at": "2026-08-08T12:29:53Z",
"pushed_at": "2026-08-08T12:09:57Z",
"stargazers_count": 4,
"watchers_count": 4,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 4,
"score": 0,
"subscribers_count": 0
}
2026/CVE-2026-49268.json
+56
View File
@@ -0,0 +1,56 @@
[
{
"id": 1325517855,
"name": "shiro-check",
"full_name": "xiaoqiMikko\/shiro-check",
"owner": {
"login": "xiaoqiMikko",
"id": 37316664,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37316664?v=4",
"html_url": "https:\/\/github.com\/xiaoqiMikko",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/xiaoqiMikko\/shiro-check",
"description": "扫出你实际装的 Apache Shiro 模块与版本,逐条判定官方 26 条 CVE 里哪些真的落在你身上。按「CVE × 模块」判定,零依赖单 jar。 CVE-2026-49268",
"fork": false,
"created_at": "2026-08-06T16:50:12Z",
"updated_at": "2026-08-08T06:54:18Z",
"pushed_at": "2026-08-06T16:58:59Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"apache-shiro",
"authentication-bypass",
"cve",
"cve-2016-4437",
"cve-2020-17510",
"cve-2020-17523",
"cve-2020-1957",
"cve-2022-40664",
"cve-2023-22602",
"cve-2023-34478",
"cve-2026-49268",
"cve-2026-56091",
"cve-2026-56130",
"dependabot",
"java",
"security",
"security-tools",
"shiro",
"spring-boot",
"vulnerability-scanner"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2026/CVE-2026-49844.json
+56
View File
@@ -0,0 +1,56 @@
[
{
"id": 1327068367,
"name": "log4j-check",
"full_name": "xiaoqiMikko\/log4j-check",
"owner": {
"login": "xiaoqiMikko",
"id": 37316664,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37316664?v=4",
"html_url": "https:\/\/github.com\/xiaoqiMikko",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/xiaoqiMikko\/log4j-check",
"description": "log4j 2025\/2026 年 7 条「配置静默失效」CVE 自查:按 CVE×模块 判定 4 个模块,结构化解析 log4j2 配置做 applicability 降噪,并算出该升到哪个版本才一次到位(6 条写 2.25.4,但有一条要 2.25.5,而它 Dependabot 报不出来) CVE-2026-49844 \/ CVE-2026-34477",
"fork": false,
"created_at": "2026-08-07T19:09:13Z",
"updated_at": "2026-08-08T06:54:24Z",
"pushed_at": "2026-08-07T19:10:15Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve",
"cve-2025-68161",
"cve-2026-34477",
"cve-2026-34478",
"cve-2026-34479",
"cve-2026-34480",
"cve-2026-34481",
"cve-2026-49844",
"dependency-check",
"devsecops",
"java",
"log4j",
"log4j-api",
"log4j-core",
"log4j2",
"logging",
"maven",
"sca",
"security-tools",
"vulnerability-scanner"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2026/CVE-2026-54121.json
+4 -4
View File
@@ -14,10 +14,10 @@
"description": "Certighost POC",
"fork": false,
"created_at": "2026-07-23T18:54:34Z",
"updated_at": "2026-08-07T01:24:34Z",
"updated_at": "2026-08-08T11:25:37Z",
"pushed_at": "2026-07-28T15:44:50Z",
"stargazers_count": 309,
"watchers_count": 309,
"stargazers_count": 310,
"watchers_count": 310,
"has_discussions": false,
"forks_count": 75,
"allow_forking": true,
@@ -28,7 +28,7 @@
"topics": [],
"visibility": "public",
"forks": 75,
"watchers": 309,
"watchers": 310,
"score": 0,
"subscribers_count": 0
},
2026/CVE-2026-54515.json
+56
View File
@@ -0,0 +1,56 @@
[
{
"id": 1326276993,
"name": "jackson-check",
"full_name": "xiaoqiMikko\/jackson-check",
"owner": {
"login": "xiaoqiMikko",
"id": 37316664,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37316664?v=4",
"html_url": "https:\/\/github.com\/xiaoqiMikko",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/xiaoqiMikko\/jackson-check",
"description": "jackson-databind 2026 年 11 条安全公告自查:扫源码注解降噪,告诉你真中几条;逐条求交集给出真正到位的版本(2.18.9\/2.21.5\/3.1.5,不是 advisory 上最常见的 2.21.4) CVE-2026-54515 \/ CVE-2026-54512",
"fork": false,
"created_at": "2026-08-07T06:05:53Z",
"updated_at": "2026-08-08T06:54:21Z",
"pushed_at": "2026-08-07T06:06:48Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve",
"cve-2026-50193",
"cve-2026-54512",
"cve-2026-54513",
"cve-2026-54514",
"cve-2026-54515",
"cve-2026-54516",
"cve-2026-54517",
"cve-2026-54518",
"cve-2026-59888",
"cve-2026-59889",
"dependency-check",
"deserialization",
"jackson",
"jackson-databind",
"java",
"jsonview",
"polymorphictypevalidator",
"security",
"vulnerability-scanner"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
2026/CVE-2026-58048.json
+2 -2
View File
@@ -58,8 +58,8 @@
"description": "👾 CVE-2026-58048 – cPanel Root SQL Execution Toolkit (CVSS 9.4) | Full Red\/Blue Team Toolkit suite for unpatched cPanel & WHM 11.x. 2 tools: Safe Checker (audit\/reporting), Weaponized (reverse shell, persistence, UDF RCE, deployment, file read\/write, database operations, mass scan). w\/Python. 🦾 Use Ethically, Stay Legal <3",
"fork": false,
"created_at": "2026-08-06T09:33:49Z",
"updated_at": "2026-08-07T02:59:29Z",
"pushed_at": "2026-08-06T09:45:52Z",
"updated_at": "2026-08-08T11:45:28Z",
"pushed_at": "2026-08-08T11:45:25Z",
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
2026/CVE-2026-59774.json
+2 -2
View File
@@ -14,8 +14,8 @@
"description": "CVE-2026-59774",
"fork": false,
"created_at": "2026-08-06T05:43:33Z",
"updated_at": "2026-08-08T06:46:48Z",
"pushed_at": "2026-08-08T06:46:44Z",
"updated_at": "2026-08-08T07:29:23Z",
"pushed_at": "2026-08-08T07:29:19Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
2026/CVE-2026-63030.json
+13 -13
View File
@@ -14,10 +14,10 @@
"description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain",
"fork": false,
"created_at": "2026-07-17T20:18:33Z",
"updated_at": "2026-08-08T02:05:53Z",
"updated_at": "2026-08-08T11:21:00Z",
"pushed_at": "2026-07-23T09:23:48Z",
"stargazers_count": 722,
"watchers_count": 722,
"stargazers_count": 723,
"watchers_count": 723,
"has_discussions": false,
"forks_count": 163,
"allow_forking": true,
@@ -32,7 +32,7 @@
],
"visibility": "public",
"forks": 163,
"watchers": 722,
"watchers": 723,
"score": 0,
"subscribers_count": 3
},
@@ -1764,10 +1764,10 @@
"description": "CVE-2026-63030 - WordPress REST Batch Route-Confusion SQL Injection Proof of Concept",
"fork": false,
"created_at": "2026-07-20T18:20:41Z",
"updated_at": "2026-07-20T18:41:40Z",
"updated_at": "2026-08-08T07:32:17Z",
"pushed_at": "2026-07-20T18:40:44Z",
"stargazers_count": 1,
"watchers_count": 1,
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -1785,7 +1785,7 @@
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
@@ -2411,10 +2411,10 @@
"description": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept",
"fork": false,
"created_at": "2026-08-05T12:48:03Z",
"updated_at": "2026-08-08T06:48:26Z",
"updated_at": "2026-08-08T12:48:51Z",
"pushed_at": "2026-08-05T15:19:27Z",
"stargazers_count": 235,
"watchers_count": 235,
"stargazers_count": 283,
"watchers_count": 283,
"has_discussions": false,
"forks_count": 22,
"allow_forking": true,
@@ -2432,9 +2432,9 @@
],
"visibility": "public",
"forks": 22,
"watchers": 235,
"watchers": 283,
"score": 0,
"subscribers_count": 0
"subscribers_count": 4
},
{
"id": 1324491169,
2026/CVE-2026-63077.json
+2 -2
View File
@@ -52,7 +52,7 @@
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -60,7 +60,7 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"forks": 2,
"watchers": 1,
"score": 0,
"subscribers_count": 0
2026/CVE-2026-64531.json
+2 -2
View File
@@ -14,8 +14,8 @@
"description": "Tracking OVSwrap (CVE-2026-64531), the Open vSwitch datapath netlink overflow",
"fork": false,
"created_at": "2026-07-29T05:15:24Z",
"updated_at": "2026-08-08T00:59:23Z",
"pushed_at": "2026-08-08T00:59:20Z",
"updated_at": "2026-08-08T08:15:28Z",
"pushed_at": "2026-08-08T08:15:22Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
2026/CVE-2026-64560.json
+6 -6
View File
@@ -14,12 +14,12 @@
"description": null,
"fork": false,
"created_at": "2026-08-03T12:36:27Z",
"updated_at": "2026-08-04T08:05:49Z",
"updated_at": "2026-08-08T09:24:15Z",
"pushed_at": "2026-08-03T12:39:41Z",
"stargazers_count": 0,
"watchers_count": 0,
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -27,8 +27,8 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 1
}
2026/CVE-2026-64638.json
+117 -18
View File
@@ -47,10 +47,10 @@
"description": "XSS2Shell (CVE-2026-64638) PoC — WordPress pre-auth XSS to RCE chain",
"fork": false,
"created_at": "2026-08-07T17:07:17Z",
"updated_at": "2026-08-08T06:30:59Z",
"updated_at": "2026-08-08T11:47:36Z",
"pushed_at": "2026-08-07T17:07:21Z",
"stargazers_count": 1,
"watchers_count": 1,
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -61,7 +61,7 @@
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
@@ -85,7 +85,7 @@
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
@@ -93,7 +93,7 @@
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
@@ -209,13 +209,13 @@
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Linuxhackingid-official\/XSS2Shell-CVE-2026-64638",
"description": null,
"description": "CVE-2026-64638 — WordPress Pre-Auth Reflected XSS → RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC (XSS chain & direct).",
"fork": false,
"created_at": "2026-08-07T22:07:13Z",
"updated_at": "2026-08-07T22:39:34Z",
"pushed_at": "2026-08-07T22:39:31Z",
"stargazers_count": 0,
"watchers_count": 0,
"updated_at": "2026-08-08T11:26:53Z",
"pushed_at": "2026-08-08T08:12:07Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -226,7 +226,7 @@
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
@@ -278,10 +278,10 @@
"description": "Template Nuclei para detecção não-intrusiva do XSS2Shell, um parser differential pré-autenticado no WordPress Core que permite injeção de elementos DOM na página de login, servindo de base para uma cadeia de XSS → RCE.",
"fork": false,
"created_at": "2026-08-07T23:48:18Z",
"updated_at": "2026-08-08T05:06:08Z",
"updated_at": "2026-08-08T10:28:55Z",
"pushed_at": "2026-08-07T23:50:40Z",
"stargazers_count": 1,
"watchers_count": 1,
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
@@ -292,7 +292,7 @@
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
@@ -353,8 +353,107 @@
"description": null,
"fork": false,
"created_at": "2026-08-08T06:10:13Z",
"updated_at": "2026-08-08T06:28:06Z",
"pushed_at": "2026-08-08T06:28:02Z",
"updated_at": "2026-08-08T09:21:00Z",
"pushed_at": "2026-08-08T09:20:53Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327571084,
"name": "CVE-2026-64638",
"full_name": "4minx\/CVE-2026-64638",
"owner": {
"login": "4minx",
"id": 37972730,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37972730?v=4",
"html_url": "https:\/\/github.com\/4minx",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/4minx\/CVE-2026-64638",
"description": "CVE-2026-64638 (XSS2shell) POC.",
"fork": false,
"created_at": "2026-08-08T08:48:02Z",
"updated_at": "2026-08-08T12:02:45Z",
"pushed_at": "2026-08-08T08:58:46Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327573893,
"name": "CVE-2026-64638",
"full_name": "HackSpeak\/CVE-2026-64638",
"owner": {
"login": "HackSpeak",
"id": 312486542,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/312486542?v=4",
"html_url": "https:\/\/github.com\/HackSpeak",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/HackSpeak\/CVE-2026-64638",
"description": "XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing",
"fork": false,
"created_at": "2026-08-08T08:51:12Z",
"updated_at": "2026-08-08T09:07:41Z",
"pushed_at": "2026-08-08T09:07:24Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327693668,
"name": "CVE-2026-64638-PoC-Exploit",
"full_name": "tc4dy\/CVE-2026-64638-PoC-Exploit",
"owner": {
"login": "tc4dy",
"id": 140116264,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/140116264?v=4",
"html_url": "https:\/\/github.com\/tc4dy",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/tc4dy\/CVE-2026-64638-PoC-Exploit",
"description": "🛡️ CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment & advanced analysis modules. 🐍 Safe Check & Exploit, 2 mode. Advanced Blue&Red Team Best 2026-64638 Toolkit, Authorized use only. Stay Legal <3zd",
"fork": false,
"created_at": "2026-08-08T11:53:39Z",
"updated_at": "2026-08-08T11:56:07Z",
"pushed_at": "2026-08-08T11:57:26Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
2026/CVE-2026-66066.json
+4 -4
View File
@@ -80,10 +80,10 @@
"description": null,
"fork": false,
"created_at": "2026-07-30T21:06:00Z",
"updated_at": "2026-08-06T01:27:43Z",
"updated_at": "2026-08-08T10:42:25Z",
"pushed_at": "2026-07-31T15:27:43Z",
"stargazers_count": 23,
"watchers_count": 23,
"stargazers_count": 24,
"watchers_count": 24,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
@@ -94,7 +94,7 @@
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 23,
"watchers": 24,
"score": 0,
"subscribers_count": 0
},
2026/CVE-2026-71554.json
+2 -35
View File
@@ -1,37 +1,4 @@
[
{
"id": 1327166541,
"name": "poc-h2-duplicate-host",
"full_name": "SunandM\/poc-h2-duplicate-host",
"owner": {
"login": "SunandM",
"id": 106249159,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/106249159?v=4",
"html_url": "https:\/\/github.com\/SunandM",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/SunandM\/poc-h2-duplicate-host",
"description": "PoC for CVE-2026-71554 — h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)",
"fork": false,
"created_at": "2026-08-07T21:14:52Z",
"updated_at": "2026-08-07T21:14:53Z",
"pushed_at": "2026-08-07T21:14:53Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327167144,
"name": "poc-h2-CVE-2026-71554",
@@ -47,8 +14,8 @@
"description": "PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)",
"fork": false,
"created_at": "2026-08-07T21:15:48Z",
"updated_at": "2026-08-07T21:19:15Z",
"pushed_at": "2026-08-07T21:19:11Z",
"updated_at": "2026-08-08T12:31:19Z",
"pushed_at": "2026-08-08T12:31:14Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
README.md
+34 -2
View File
@@ -462,6 +462,7 @@
- [rootdirective-sec/CVE-2026-3844-Lab](https://github.com/rootdirective-sec/CVE-2026-3844-Lab)
- [Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution](https://github.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution)
- [AnggaTechI/CVE-2026-3844](https://github.com/AnggaTechI/CVE-2026-3844)
### CVE-2026-3854 (2026-03-10)
@@ -4740,6 +4741,13 @@
- [Giangdurian/CVE-2026-41242](https://github.com/Giangdurian/CVE-2026-41242)
### CVE-2026-41293 (2026-05-12)
<code>Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
</code>
- [xiaoqiMikko/tomcat-check](https://github.com/xiaoqiMikko/tomcat-check)
### CVE-2026-41472 (2026-04-24)
<code>CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
@@ -5144,6 +5152,7 @@
- [eroorvbsyes-hotmail/CVE-2026-43499_x86_Exploit](https://github.com/eroorvbsyes-hotmail/CVE-2026-43499_x86_Exploit)
- [oopnv70-lab/ghostlock-honor-aak](https://github.com/oopnv70-lab/ghostlock-honor-aak)
- [Meowkis/tcp-zerocopy-sm](https://github.com/Meowkis/tcp-zerocopy-sm)
- [wxxsfxyzm/GhostLock-Galaxy](https://github.com/wxxsfxyzm/GhostLock-Galaxy)
### CVE-2026-43500 (2026-05-11)
@@ -6300,6 +6309,13 @@
- [BiiTts/CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass](https://github.com/BiiTts/CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass)
### CVE-2026-49268 (2026-06-17)
<code>A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.\n\nThis issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm\nUpgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
</code>
- [xiaoqiMikko/shiro-check](https://github.com/xiaoqiMikko/shiro-check)
### CVE-2026-49344 (2026-06-19)
<code>Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.
@@ -6379,6 +6395,13 @@
- [xxconi/CVE-2026-49777-CVE-2026-10735](https://github.com/xxconi/CVE-2026-49777-CVE-2026-10735)
- [HORKimhab/CVE-Wordpress](https://github.com/HORKimhab/CVE-Wordpress)
### CVE-2026-49844 (2026-07-10)
<code>Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{&quot;JSON&quot;}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
</code>
- [xiaoqiMikko/log4j-check](https://github.com/xiaoqiMikko/log4j-check)
### CVE-2026-49865
- [cyeezy08/Kimai-CVE-2026-49865-POC](https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC)
@@ -6933,6 +6956,13 @@
- [MichaelAdamGroberman/CVE-2026-54477](https://github.com/MichaelAdamGroberman/CVE-2026-54477)
### CVE-2026-54515 (2026-06-23)
<code>jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
</code>
- [xiaoqiMikko/jackson-check](https://github.com/xiaoqiMikko/jackson-check)
### CVE-2026-54519
- [chaitanyagarware/CVE-2026-54519](https://github.com/chaitanyagarware/CVE-2026-54519)
@@ -7625,6 +7655,9 @@
- [renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell](https://github.com/renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell)
- [imbas007/CVE-2026-64638-POC](https://github.com/imbas007/CVE-2026-64638-POC)
- [yogaGymn/XSS2Shell-CVE-2026-64638](https://github.com/yogaGymn/XSS2Shell-CVE-2026-64638)
- [4minx/CVE-2026-64638](https://github.com/4minx/CVE-2026-64638)
- [HackSpeak/CVE-2026-64638](https://github.com/HackSpeak/CVE-2026-64638)
- [tc4dy/CVE-2026-64638-PoC-Exploit](https://github.com/tc4dy/CVE-2026-64638-PoC-Exploit)
### CVE-2026-64640 (2026-08-06)
@@ -7993,7 +8026,6 @@
<code>h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
</code>
- [SunandM/poc-h2-duplicate-host](https://github.com/SunandM/poc-h2-duplicate-host)
- [SunandM/poc-h2-CVE-2026-71554](https://github.com/SunandM/poc-h2-CVE-2026-71554)
### CVE-2026-71557 (2026-08-07)
@@ -35376,6 +35408,7 @@
- [void0red/CVE-2023-32233](https://github.com/void0red/CVE-2023-32233)
- [Destawell/gemini-2.5-pro-nf-tables-red-teaming](https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teaming)
- [Destawell/gemini-2.5-pro-nf-tables-red-teamin](https://github.com/Destawell/gemini-2.5-pro-nf-tables-red-teamin)
- [BurnSkyup/CVE-2023-32233-reproduction](https://github.com/BurnSkyup/CVE-2023-32233-reproduction)
### CVE-2023-32235 (2023-05-05)
@@ -36968,7 +37001,6 @@
- [bcdannyboy/CVE-2023-38545](https://github.com/bcdannyboy/CVE-2023-38545)
- [d0rb/CVE-2023-38545](https://github.com/d0rb/CVE-2023-38545)
- [Yang-Shun-Yu/CVE-2023-38545](https://github.com/Yang-Shun-Yu/CVE-2023-38545)
- [nphuang/NS-Project-2024-Spring](https://github.com/nphuang/NS-Project-2024-Spring)
### CVE-2023-38571 (2023-07-28)