From 61c85a254bcde78fcf2d2f284e1ede352c8f9865 Mon Sep 17 00:00:00 2001 From: motikan2010-bot Date: Tue, 18 Aug 2026 09:50:13 +0900 Subject: [PATCH] Auto Update 2026/08/18 00:50:13 --- 2014/CVE-2014-1106691.json | 35 +++++++ 2016/CVE-2016-5195.json | 8 +- 2018/CVE-2018-8611.json | 4 +- 2019/CVE-2019-17558.json | 2 +- 2019/CVE-2019-2618.json | 8 +- 2020/CVE-2020-14882.json | 2 +- 2020/CVE-2020-14883.json | 8 +- 2020/CVE-2020-4463.json | 8 +- 2021/CVE-2021-21972.json | 24 ++--- 2021/CVE-2021-21974.json | 8 +- 2021/CVE-2021-22005.json | 8 +- 2021/CVE-2021-22986.json | 8 +- 2021/CVE-2021-25646.json | 8 +- 2021/CVE-2021-3129.json | 8 +- 2021/CVE-2021-3156.json | 8 +- 2021/CVE-2021-33044.json | 4 +- 2021/CVE-2021-3560.json | 8 +- 2021/CVE-2021-4034.json | 74 +++++++------- 2021/CVE-2021-44228.json | 24 ++--- 2022/CVE-2022-22954.json | 8 +- 2023/CVE-2023-20696.json | 4 +- 2023/CVE-2023-21752.json | 8 +- 2024/CVE-2024-56145.json | 8 +- 2025/CVE-2025-24813.json | 8 +- 2025/CVE-2025-54424.json | 4 +- 2025/CVE-2025-55182.json | 8 +- 2025/CVE-2025-66398.json | 4 +- 2025/CVE-2025-7771.json | 12 +-- 2026/CVE-2026-13934.json | 14 +-- ...VE-2026-51788.json => CVE-2026-15826.json} | 24 ++--- 2026/CVE-2026-17543.json | 8 +- 2026/CVE-2026-19650.json | 35 +++++++ 2026/CVE-2026-20217.json | 35 +++++++ 2026/CVE-2026-20841.json | 4 +- 2026/CVE-2026-22747.json | 4 +- 2026/CVE-2026-24061.json | 4 +- 2026/CVE-2026-31431.json | 8 +- 2026/CVE-2026-40345.json | 8 +- 2026/CVE-2026-41089.json | 4 +- 2026/CVE-2026-43499.json | 77 ++++++++++----- 2026/CVE-2026-44578.json | 8 +- 2026/CVE-2026-47301.json | 8 +- 2026/CVE-2026-52217.json | 35 ------- 2026/CVE-2026-53359.json | 33 ------- 2026/CVE-2026-56876.json | 35 ------- 2026/CVE-2026-57517.json | 46 --------- 2026/CVE-2026-62737.json | 4 +- 2026/CVE-2026-63030.json | 12 +-- 2026/CVE-2026-70376.json | 8 +- 2026/CVE-2026-71518.json | 35 +++++++ 2026/CVE-2026-8452.json | 12 +-- 2026/CVE-2026-9830.json | 8 +- README.md | 99 ++++++++++++------- 53 files changed, 472 insertions(+), 417 deletions(-) create mode 100644 2014/CVE-2014-1106691.json rename 2026/{CVE-2026-51788.json => CVE-2026-15826.json} (52%) create mode 100644 2026/CVE-2026-19650.json create mode 100644 2026/CVE-2026-20217.json delete mode 100644 2026/CVE-2026-52217.json delete mode 100644 2026/CVE-2026-56876.json delete mode 100644 2026/CVE-2026-57517.json create mode 100644 2026/CVE-2026-71518.json diff --git a/2014/CVE-2014-1106691.json b/2014/CVE-2014-1106691.json new file mode 100644 index 0000000000..cd4985921f --- /dev/null +++ b/2014/CVE-2014-1106691.json @@ -0,0 +1,35 @@ +[ + { + "id": 1337507684, + "name": "java-sms-aye", + "full_name": "lucauL2dlek\/java-sms-aye", + "owner": { + "login": "lucauL2dlek", + "id": 312728471, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/312728471?v=4", + "html_url": "https:\/\/github.com\/lucauL2dlek", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/lucauL2dlek\/java-sms-aye", + "description": "This is a way to create Using code-breaking and compiler shortcuts to switch between presets in CVE-2014-1106691, however on desktop shortcuts can be made without nvim.", + "fork": false, + "created_at": "2026-08-17T18:24:45Z", + "updated_at": "2026-08-17T18:29:04Z", + "pushed_at": "2026-08-17T18:26:19Z", + "stargazers_count": 0, + "watchers_count": 0, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 0, + "score": 0, + "subscribers_count": 0 + } +] \ No newline at end of file diff --git a/2016/CVE-2016-5195.json b/2016/CVE-2016-5195.json index 0146cdee31..ac0cc02929 100644 --- a/2016/CVE-2016-5195.json +++ b/2016/CVE-2016-5195.json @@ -490,10 +490,10 @@ "description": "Dirty Cow exploit - CVE-2016-5195", "fork": false, "created_at": "2016-11-25T21:08:01Z", - "updated_at": "2026-07-08T22:01:43Z", + "updated_at": "2026-08-17T19:44:43Z", "pushed_at": "2025-07-30T11:31:24Z", - "stargazers_count": 937, - "watchers_count": 937, + "stargazers_count": 936, + "watchers_count": 936, "has_discussions": false, "forks_count": 424, "allow_forking": true, @@ -508,7 +508,7 @@ ], "visibility": "public", "forks": 424, - "watchers": 937, + "watchers": 936, "score": 0, "subscribers_count": 1 }, diff --git a/2018/CVE-2018-8611.json b/2018/CVE-2018-8611.json index 8191b23538..8c7698476d 100644 --- a/2018/CVE-2018-8611.json +++ b/2018/CVE-2018-8611.json @@ -47,8 +47,8 @@ "description": "CVE-2018-8611 PrivEsc Exploit", "fork": false, "created_at": "2026-08-17T04:20:38Z", - "updated_at": "2026-08-17T11:41:37Z", - "pushed_at": "2026-08-17T04:22:49Z", + "updated_at": "2026-08-17T23:09:59Z", + "pushed_at": "2026-08-17T23:09:47Z", "stargazers_count": 1, "watchers_count": 1, "has_discussions": false, diff --git a/2019/CVE-2019-17558.json b/2019/CVE-2019-17558.json index 3e4552a58b..cce1e1e885 100644 --- a/2019/CVE-2019-17558.json +++ b/2019/CVE-2019-17558.json @@ -47,7 +47,7 @@ "description": "Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340", "fork": false, "created_at": "2020-04-01T09:33:35Z", - "updated_at": "2026-08-15T11:21:12Z", + "updated_at": "2026-08-17T19:49:26Z", "pushed_at": "2021-04-04T09:13:57Z", "stargazers_count": 4291, "watchers_count": 4291, diff --git a/2019/CVE-2019-2618.json b/2019/CVE-2019-2618.json index e5ce123455..834af67c34 100644 --- a/2019/CVE-2019-2618.json +++ b/2019/CVE-2019-2618.json @@ -113,10 +113,10 @@ "description": "增强版WeblogicScan、检测结果更精确、插件化、添加CVE-2019-2618，CVE-2019-2729检测，Python3支持", "fork": false, "created_at": "2019-06-21T09:22:43Z", - "updated_at": "2026-08-04T08:00:32Z", + "updated_at": "2026-08-17T19:44:27Z", "pushed_at": "2024-06-16T15:35:20Z", - "stargazers_count": 964, - "watchers_count": 964, + "stargazers_count": 963, + "watchers_count": 963, "has_discussions": false, "forks_count": 181, "allow_forking": true, @@ -127,7 +127,7 @@ "topics": [], "visibility": "public", "forks": 181, - "watchers": 964, + "watchers": 963, "score": 0, "subscribers_count": 17 }, diff --git a/2020/CVE-2020-14882.json b/2020/CVE-2020-14882.json index d9d9458a5a..9cfad61e77 100644 --- a/2020/CVE-2020-14882.json +++ b/2020/CVE-2020-14882.json @@ -14,7 +14,7 @@ "description": "Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340", "fork": false, "created_at": "2020-04-01T09:33:35Z", - "updated_at": "2026-08-15T11:21:12Z", + "updated_at": "2026-08-17T19:49:26Z", "pushed_at": "2021-04-04T09:13:57Z", "stargazers_count": 4291, "watchers_count": 4291, diff --git a/2020/CVE-2020-14883.json b/2020/CVE-2020-14883.json index 3269305bb8..64c0fc6e8f 100644 --- a/2020/CVE-2020-14883.json +++ b/2020/CVE-2020-14883.json @@ -148,10 +148,10 @@ "description": "Alibaba-Nacos-Unauthorized\/ApacheDruid-RCE_CVE-2021-25646\/MS-Exchange-SSRF-CVE-2021-26885\/Oracle-WebLogic-CVE-2021-2109_RCE\/RG-CNVD-2021-14536\/RJ-SSL-VPN-UltraVires\/Redis-Unauthorized-RCE\/TDOA-V11.7-GetOnlineCookie\/VMware-vCenter-GetAnyFile\/yongyou-GRP-U8-XXE\/Oracle-WebLogic-CVE-2020-14883\/Oracle-WebLogic-CVE-2020-14882\/Apache-Solr-GetAnyFile\/F5-BIG-IP-CVE-2021-22986\/Sonicwall-SSL-VPN-RCE\/GitLab-Graphql-CNVD-2021-14193\/D-Link-DCS-CVE-2020-25078\/WLAN-AP-WEA453e-RCE\/360TianQing-Unauthorized\/360TianQing-SQLinjection\/FanWeiOA-V8-SQLinjection\/QiZhiBaoLeiJi-AnyUserLogin\/QiAnXin-WangKangFirewall-RCE\/金山-V8-终端安全系统\/NCCloud-SQLinjection\/ShowDoc-RCE", "fork": false, "created_at": "2021-03-11T22:49:17Z", - "updated_at": "2026-08-15T17:20:58Z", + "updated_at": "2026-08-17T19:47:49Z", "pushed_at": "2023-05-11T14:36:58Z", - "stargazers_count": 1076, - "watchers_count": 1076, + "stargazers_count": 1075, + "watchers_count": 1075, "has_discussions": false, "forks_count": 313, "allow_forking": true, @@ -166,7 +166,7 @@ ], "visibility": "public", "forks": 313, - "watchers": 1076, + "watchers": 1075, "score": 0, "subscribers_count": 34 }, diff --git a/2020/CVE-2020-4463.json b/2020/CVE-2020-4463.json index 92e108f338..f77ca3c5c4 100644 --- a/2020/CVE-2020-4463.json +++ b/2020/CVE-2020-4463.json @@ -14,10 +14,10 @@ "description": "IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability (CVE-2020-4463)", "fork": false, "created_at": "2020-08-13T09:03:40Z", - "updated_at": "2025-11-17T20:21:52Z", + "updated_at": "2026-08-17T19:47:46Z", "pushed_at": "2023-09-19T10:38:28Z", - "stargazers_count": 52, - "watchers_count": 52, + "stargazers_count": 51, + "watchers_count": 51, "has_discussions": false, "forks_count": 17, "allow_forking": true, @@ -34,7 +34,7 @@ ], "visibility": "public", "forks": 17, - "watchers": 52, + "watchers": 51, "score": 0, "subscribers_count": 1 } diff --git a/2021/CVE-2021-21972.json b/2021/CVE-2021-21972.json index 1d591c955e..c849d1926e 100644 --- a/2021/CVE-2021-21972.json +++ b/2021/CVE-2021-21972.json @@ -97,10 +97,10 @@ "description": "CVE-2021-21972 Exploit", "fork": false, "created_at": "2021-02-24T11:14:58Z", - "updated_at": "2026-08-04T08:01:07Z", + "updated_at": "2026-08-17T19:45:38Z", "pushed_at": "2023-06-08T04:01:33Z", - "stargazers_count": 499, - "watchers_count": 499, + "stargazers_count": 498, + "watchers_count": 498, "has_discussions": false, "forks_count": 138, "allow_forking": true, @@ -113,7 +113,7 @@ ], "visibility": "public", "forks": 138, - "watchers": 499, + "watchers": 498, "score": 0, "subscribers_count": 6 }, @@ -165,10 +165,10 @@ "description": "Proof of Concept Exploit for vCenter CVE-2021-21972", "fork": false, "created_at": "2021-02-24T16:31:34Z", - "updated_at": "2026-08-04T08:01:07Z", + "updated_at": "2026-08-17T19:42:41Z", "pushed_at": "2021-02-25T16:05:02Z", - "stargazers_count": 270, - "watchers_count": 270, + "stargazers_count": 269, + "watchers_count": 269, "has_discussions": false, "forks_count": 83, "allow_forking": true, @@ -179,7 +179,7 @@ "topics": [], "visibility": "public", "forks": 83, - "watchers": 270, + "watchers": 269, "score": 0, "subscribers_count": 6 }, @@ -836,10 +836,10 @@ "description": "一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972\/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密连接", "fork": false, "created_at": "2022-10-04T03:39:27Z", - "updated_at": "2026-08-17T02:19:39Z", + "updated_at": "2026-08-17T19:43:58Z", "pushed_at": "2024-04-25T06:09:38Z", - "stargazers_count": 1484, - "watchers_count": 1484, + "stargazers_count": 1483, + "watchers_count": 1483, "has_discussions": false, "forks_count": 166, "allow_forking": true, @@ -857,7 +857,7 @@ ], "visibility": "public", "forks": 166, - "watchers": 1484, + "watchers": 1483, "score": 0, "subscribers_count": 14 }, diff --git a/2021/CVE-2021-21974.json b/2021/CVE-2021-21974.json index 707a3acf2c..3f14984239 100644 --- a/2021/CVE-2021-21974.json +++ b/2021/CVE-2021-21974.json @@ -14,10 +14,10 @@ "description": "POC for CVE-2021-21974 VMWare ESXi RCE Exploit", "fork": false, "created_at": "2021-05-25T17:14:38Z", - "updated_at": "2026-08-14T21:01:00Z", + "updated_at": "2026-08-17T19:46:08Z", "pushed_at": "2026-03-10T23:37:24Z", - "stargazers_count": 186, - "watchers_count": 186, + "stargazers_count": 185, + "watchers_count": 185, "has_discussions": false, "forks_count": 42, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 42, - "watchers": 186, + "watchers": 185, "score": 0, "subscribers_count": 2 }, diff --git a/2021/CVE-2021-22005.json b/2021/CVE-2021-22005.json index a757ed9ab0..100117a158 100644 --- a/2021/CVE-2021-22005.json +++ b/2021/CVE-2021-22005.json @@ -311,10 +311,10 @@ "description": null, "fork": false, "created_at": "2021-12-18T08:18:50Z", - "updated_at": "2026-07-26T15:50:07Z", + "updated_at": "2026-08-17T19:43:24Z", "pushed_at": "2021-12-22T10:32:37Z", - "stargazers_count": 196, - "watchers_count": 196, + "stargazers_count": 195, + "watchers_count": 195, "has_discussions": false, "forks_count": 45, "allow_forking": true, @@ -325,7 +325,7 @@ "topics": [], "visibility": "public", "forks": 45, - "watchers": 196, + "watchers": 195, "score": 0, "subscribers_count": 2 }, diff --git a/2021/CVE-2021-22986.json b/2021/CVE-2021-22986.json index 696998f968..b2050cd76e 100644 --- a/2021/CVE-2021-22986.json +++ b/2021/CVE-2021-22986.json @@ -47,10 +47,10 @@ "description": "cve-2021-22986 f5 rce 漏洞批量检测 poc", "fork": false, "created_at": "2021-03-19T18:50:22Z", - "updated_at": "2024-08-12T20:11:21Z", + "updated_at": "2026-08-17T19:47:41Z", "pushed_at": "2021-03-27T10:02:59Z", - "stargazers_count": 27, - "watchers_count": 27, + "stargazers_count": 26, + "watchers_count": 26, "has_discussions": false, "forks_count": 4, "allow_forking": true, @@ -61,7 +61,7 @@ "topics": [], "visibility": "public", "forks": 4, - "watchers": 27, + "watchers": 26, "score": 0, "subscribers_count": 2 }, diff --git a/2021/CVE-2021-25646.json b/2021/CVE-2021-25646.json index 0019acfc63..245a06a1d6 100644 --- a/2021/CVE-2021-25646.json +++ b/2021/CVE-2021-25646.json @@ -146,10 +146,10 @@ "description": "Alibaba-Nacos-Unauthorized\/ApacheDruid-RCE_CVE-2021-25646\/MS-Exchange-SSRF-CVE-2021-26885\/Oracle-WebLogic-CVE-2021-2109_RCE\/RG-CNVD-2021-14536\/RJ-SSL-VPN-UltraVires\/Redis-Unauthorized-RCE\/TDOA-V11.7-GetOnlineCookie\/VMware-vCenter-GetAnyFile\/yongyou-GRP-U8-XXE\/Oracle-WebLogic-CVE-2020-14883\/Oracle-WebLogic-CVE-2020-14882\/Apache-Solr-GetAnyFile\/F5-BIG-IP-CVE-2021-22986\/Sonicwall-SSL-VPN-RCE\/GitLab-Graphql-CNVD-2021-14193\/D-Link-DCS-CVE-2020-25078\/WLAN-AP-WEA453e-RCE\/360TianQing-Unauthorized\/360TianQing-SQLinjection\/FanWeiOA-V8-SQLinjection\/QiZhiBaoLeiJi-AnyUserLogin\/QiAnXin-WangKangFirewall-RCE\/金山-V8-终端安全系统\/NCCloud-SQLinjection\/ShowDoc-RCE", "fork": false, "created_at": "2021-03-11T22:49:17Z", - "updated_at": "2026-08-15T17:20:58Z", + "updated_at": "2026-08-17T19:47:49Z", "pushed_at": "2023-05-11T14:36:58Z", - "stargazers_count": 1076, - "watchers_count": 1076, + "stargazers_count": 1075, + "watchers_count": 1075, "has_discussions": false, "forks_count": 313, "allow_forking": true, @@ -164,7 +164,7 @@ ], "visibility": "public", "forks": 313, - "watchers": 1076, + "watchers": 1075, "score": 0, "subscribers_count": 34 }, diff --git a/2021/CVE-2021-3129.json b/2021/CVE-2021-3129.json index 8d62c0b5e7..cef574a46b 100644 --- a/2021/CVE-2021-3129.json +++ b/2021/CVE-2021-3129.json @@ -348,10 +348,10 @@ "description": "Laravel RCE Exploit PoC - CVE-2021-3129 (user-friendly with automatic log path detection)", "fork": false, "created_at": "2022-04-16T17:22:55Z", - "updated_at": "2026-07-21T17:54:50Z", + "updated_at": "2026-08-18T00:18:47Z", "pushed_at": "2026-05-21T06:40:47Z", - "stargazers_count": 148, - "watchers_count": 148, + "stargazers_count": 149, + "watchers_count": 149, "has_discussions": false, "forks_count": 26, "allow_forking": true, @@ -377,7 +377,7 @@ ], "visibility": "public", "forks": 26, - "watchers": 148, + "watchers": 149, "score": 0, "subscribers_count": 1 }, diff --git a/2021/CVE-2021-3156.json b/2021/CVE-2021-3156.json index 6d7596df53..9ad15e66a7 100644 --- a/2021/CVE-2021-3156.json +++ b/2021/CVE-2021-3156.json @@ -1114,10 +1114,10 @@ "description": "Sudo Baron Samedit Exploit", "fork": false, "created_at": "2021-03-15T17:37:02Z", - "updated_at": "2026-08-14T17:15:09Z", + "updated_at": "2026-08-17T19:43:49Z", "pushed_at": "2022-01-13T05:48:01Z", - "stargazers_count": 807, - "watchers_count": 807, + "stargazers_count": 806, + "watchers_count": 806, "has_discussions": false, "forks_count": 175, "allow_forking": true, @@ -1128,7 +1128,7 @@ "topics": [], "visibility": "public", "forks": 175, - "watchers": 807, + "watchers": 806, "score": 0, "subscribers_count": 10 }, diff --git a/2021/CVE-2021-33044.json b/2021/CVE-2021-33044.json index f44ee6afdf..fbe69e7a4a 100644 --- a/2021/CVE-2021-33044.json +++ b/2021/CVE-2021-33044.json @@ -212,8 +212,8 @@ "description": "Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.", "fork": false, "created_at": "2026-03-28T17:42:44Z", - "updated_at": "2026-08-17T18:02:51Z", - "pushed_at": "2026-08-17T18:01:27Z", + "updated_at": "2026-08-18T00:23:44Z", + "pushed_at": "2026-08-18T00:23:40Z", "stargazers_count": 4, "watchers_count": 4, "has_discussions": false, diff --git a/2021/CVE-2021-3560.json b/2021/CVE-2021-3560.json index c797fedf94..01caf33968 100644 --- a/2021/CVE-2021-3560.json +++ b/2021/CVE-2021-3560.json @@ -699,10 +699,10 @@ "description": "Exploitation Script for CVE-2021-3560", "fork": false, "created_at": "2025-02-18T09:35:40Z", - "updated_at": "2025-02-18T09:48:45Z", + "updated_at": "2026-08-17T20:07:57Z", "pushed_at": "2025-02-18T09:48:42Z", - "stargazers_count": 0, - "watchers_count": 0, + "stargazers_count": 1, + "watchers_count": 1, "has_discussions": false, "forks_count": 0, "allow_forking": true, @@ -713,7 +713,7 @@ "topics": [], "visibility": "public", "forks": 0, - "watchers": 0, + "watchers": 1, "score": 0, "subscribers_count": 1 }, diff --git a/2021/CVE-2021-4034.json b/2021/CVE-2021-4034.json index a079fec4b6..a1951e33c2 100644 --- a/2021/CVE-2021-4034.json +++ b/2021/CVE-2021-4034.json @@ -1,4 +1,37 @@ [ + { + "id": 452081015, + "name": "CVE-2021-4034", + "full_name": "berdav\/CVE-2021-4034", + "owner": { + "login": "berdav", + "id": 1332095, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/1332095?v=4", + "html_url": "https:\/\/github.com\/berdav", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/berdav\/CVE-2021-4034", + "description": "CVE-2021-4034 1day", + "fork": false, + "created_at": "2022-01-25T23:51:37Z", + "updated_at": "2026-08-10T14:45:01Z", + "pushed_at": "2022-06-08T04:00:28Z", + "stargazers_count": 2044, + "watchers_count": 2044, + "has_discussions": false, + "forks_count": 507, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 507, + "watchers": 2044, + "score": 0, + "subscribers_count": 18 + }, { "id": 452094681, "name": "CVE-2021-4034", @@ -2253,10 +2286,10 @@ "description": "El exploit para obtener root usado la vulnerabilidad del CVE-2021-4034 o tambien llamado PwnKit el cual permite teniendo un shell hacer una escalada de privilegios siempre y cuando la version de pkexec sea = o < que la v0.105", "fork": false, "created_at": "2026-06-22T16:01:50Z", - "updated_at": "2026-06-22T17:45:59Z", + "updated_at": "2026-08-17T21:57:58Z", "pushed_at": "2026-06-22T17:04:59Z", - "stargazers_count": 1, - "watchers_count": 1, + "stargazers_count": 2, + "watchers_count": 2, "has_discussions": false, "forks_count": 0, "allow_forking": true, @@ -2273,7 +2306,7 @@ ], "visibility": "public", "forks": 0, - "watchers": 1, + "watchers": 2, "score": 0, "subscribers_count": 0 }, @@ -2342,38 +2375,5 @@ "watchers": 0, "score": 0, "subscribers_count": 0 - }, - { - "id": 1337507899, - "name": "CVE-2021-4034-PwnKit", - "full_name": "jeffmarlonmandela\/CVE-2021-4034-PwnKit", - "owner": { - "login": "jeffmarlonmandela", - "id": 316770501, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/316770501?v=4", - "html_url": "https:\/\/github.com\/jeffmarlonmandela", - "user_view_type": "public" - }, - "html_url": "https:\/\/github.com\/jeffmarlonmandela\/CVE-2021-4034-PwnKit", - "description": null, - "fork": false, - "created_at": "2026-08-17T18:24:56Z", - "updated_at": "2026-08-17T18:25:41Z", - "pushed_at": "2026-08-17T18:25:03Z", - "stargazers_count": 0, - "watchers_count": 0, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "has_pull_requests": true, - "pull_request_creation_policy": "all", - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 0, - "score": 0, - "subscribers_count": 0 } ] \ No newline at end of file diff --git a/2021/CVE-2021-44228.json b/2021/CVE-2021-44228.json index de0688b4c5..9a68cba4ed 100644 --- a/2021/CVE-2021-44228.json +++ b/2021/CVE-2021-44228.json @@ -3873,10 +3873,10 @@ "description": "A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228 ", "fork": false, "created_at": "2021-12-13T03:57:50Z", - "updated_at": "2026-08-14T20:44:19Z", + "updated_at": "2026-08-17T19:46:43Z", "pushed_at": "2022-11-23T18:23:24Z", - "stargazers_count": 3422, - "watchers_count": 3422, + "stargazers_count": 3421, + "watchers_count": 3421, "has_discussions": true, "forks_count": 725, "allow_forking": true, @@ -3887,7 +3887,7 @@ "topics": [], "visibility": "public", "forks": 725, - "watchers": 3422, + "watchers": 3421, "score": 0, "subscribers_count": 54 }, @@ -4412,10 +4412,10 @@ "description": "Burp extension to scan Log4Shell (CVE-2021-44228) vulnerability pre and post auth.", "fork": false, "created_at": "2021-12-13T11:06:46Z", - "updated_at": "2025-12-03T02:13:52Z", + "updated_at": "2026-08-17T19:46:32Z", "pushed_at": "2021-12-26T09:58:06Z", - "stargazers_count": 102, - "watchers_count": 102, + "stargazers_count": 101, + "watchers_count": 101, "has_discussions": false, "forks_count": 24, "allow_forking": true, @@ -4426,7 +4426,7 @@ "topics": [], "visibility": "public", "forks": 24, - "watchers": 102, + "watchers": 101, "score": 0, "subscribers_count": 7 }, @@ -9281,10 +9281,10 @@ "description": "Exploiting CVE-2021-44228 in vCenter for remote code execution and more. ", "fork": false, "created_at": "2021-12-19T14:48:30Z", - "updated_at": "2026-08-04T08:01:20Z", + "updated_at": "2026-08-17T19:46:06Z", "pushed_at": "2021-12-22T15:56:21Z", - "stargazers_count": 105, - "watchers_count": 105, + "stargazers_count": 104, + "watchers_count": 104, "has_discussions": false, "forks_count": 19, "allow_forking": true, @@ -9295,7 +9295,7 @@ "topics": [], "visibility": "public", "forks": 19, - "watchers": 105, + "watchers": 104, "score": 0, "subscribers_count": 4 }, diff --git a/2022/CVE-2022-22954.json b/2022/CVE-2022-22954.json index 6c161205b0..2abd770ef5 100644 --- a/2022/CVE-2022-22954.json +++ b/2022/CVE-2022-22954.json @@ -809,10 +809,10 @@ "description": "一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972\/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密连接", "fork": false, "created_at": "2022-10-04T03:39:27Z", - "updated_at": "2026-08-17T02:19:39Z", + "updated_at": "2026-08-17T19:43:58Z", "pushed_at": "2024-04-25T06:09:38Z", - "stargazers_count": 1484, - "watchers_count": 1484, + "stargazers_count": 1483, + "watchers_count": 1483, "has_discussions": false, "forks_count": 166, "allow_forking": true, @@ -830,7 +830,7 @@ ], "visibility": "public", "forks": 166, - "watchers": 1484, + "watchers": 1483, "score": 0, "subscribers_count": 14 }, diff --git a/2023/CVE-2023-20696.json b/2023/CVE-2023-20696.json index dfaa391131..fd15ded16d 100644 --- a/2023/CVE-2023-20696.json +++ b/2023/CVE-2023-20696.json @@ -52,7 +52,7 @@ "stargazers_count": 6, "watchers_count": 6, "has_discussions": false, - "forks_count": 51, + "forks_count": 50, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -60,7 +60,7 @@ "pull_request_creation_policy": "all", "topics": [], "visibility": "public", - "forks": 51, + "forks": 50, "watchers": 6, "score": 0, "subscribers_count": 0 diff --git a/2023/CVE-2023-21752.json b/2023/CVE-2023-21752.json index e31a4866f5..57286ee716 100644 --- a/2023/CVE-2023-21752.json +++ b/2023/CVE-2023-21752.json @@ -14,10 +14,10 @@ "description": null, "fork": false, "created_at": "2023-01-10T15:59:26Z", - "updated_at": "2026-07-18T05:48:17Z", + "updated_at": "2026-08-18T00:26:37Z", "pushed_at": "2023-01-13T09:01:20Z", - "stargazers_count": 326, - "watchers_count": 326, + "stargazers_count": 327, + "watchers_count": 327, "has_discussions": false, "forks_count": 65, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 65, - "watchers": 326, + "watchers": 327, "score": 0, "subscribers_count": 2 }, diff --git a/2024/CVE-2024-56145.json b/2024/CVE-2024-56145.json index 8c094f0b7b..712bb19330 100644 --- a/2024/CVE-2024-56145.json +++ b/2024/CVE-2024-56145.json @@ -14,10 +14,10 @@ "description": "Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled", "fork": false, "created_at": "2024-12-20T03:34:01Z", - "updated_at": "2026-08-10T14:45:12Z", + "updated_at": "2026-08-17T19:13:19Z", "pushed_at": "2024-12-23T12:51:54Z", - "stargazers_count": 47, - "watchers_count": 47, + "stargazers_count": 48, + "watchers_count": 48, "has_discussions": false, "forks_count": 12, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 12, - "watchers": 47, + "watchers": 48, "score": 0, "subscribers_count": 1 }, diff --git a/2025/CVE-2025-24813.json b/2025/CVE-2025-24813.json index 70a4fe58f8..45e577969a 100644 --- a/2025/CVE-2025-24813.json +++ b/2025/CVE-2025-24813.json @@ -14,10 +14,10 @@ "description": "Apache Tomcat 远程代码执行漏洞批量检测脚本(CVE-2025-24813)", "fork": false, "created_at": "2025-03-13T10:00:03Z", - "updated_at": "2026-07-03T16:52:10Z", + "updated_at": "2026-08-17T19:42:27Z", "pushed_at": "2025-04-02T01:23:16Z", - "stargazers_count": 98, - "watchers_count": 98, + "stargazers_count": 97, + "watchers_count": 97, "has_discussions": false, "forks_count": 28, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 28, - "watchers": 98, + "watchers": 97, "score": 0, "subscribers_count": 3 }, diff --git a/2025/CVE-2025-54424.json b/2025/CVE-2025-54424.json index d0400089b0..ef24d764b5 100644 --- a/2025/CVE-2025-54424.json +++ b/2025/CVE-2025-54424.json @@ -53,8 +53,8 @@ "description": "CVE-2025-54424: 1Panel TLS client cert bypass enables RCE via forged CN 'panel_client' using a bundled scanning and exploitation tool. Affected: <= v2.0.5. 🔐", "fork": false, "created_at": "2025-08-14T05:16:16Z", - "updated_at": "2026-08-17T12:59:46Z", - "pushed_at": "2026-08-17T12:56:42Z", + "updated_at": "2026-08-17T19:47:21Z", + "pushed_at": "2026-08-17T19:43:55Z", "stargazers_count": 3, "watchers_count": 3, "has_discussions": false, diff --git a/2025/CVE-2025-55182.json b/2025/CVE-2025-55182.json index 4e5d698b8a..0e7ab228bc 100644 --- a/2025/CVE-2025-55182.json +++ b/2025/CVE-2025-55182.json @@ -14,8 +14,8 @@ "description": "🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect critical vulnerabilities in your applications.", "fork": false, "created_at": "2022-06-17T10:19:10Z", - "updated_at": "2026-08-17T13:13:55Z", - "pushed_at": "2026-08-17T13:10:30Z", + "updated_at": "2026-08-17T19:58:44Z", + "pushed_at": "2026-08-17T19:57:36Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, @@ -11693,8 +11693,8 @@ "description": "🛡️ Explore CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol, demonstrating exploitation techniques and mitigation strategies.", "fork": false, "created_at": "2025-12-24T14:48:19Z", - "updated_at": "2026-08-17T13:13:04Z", - "pushed_at": "2026-08-17T13:10:29Z", + "updated_at": "2026-08-17T19:59:05Z", + "pushed_at": "2026-08-17T19:57:41Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2025/CVE-2025-66398.json b/2025/CVE-2025-66398.json index 13a7bfdc68..cd01fc2991 100644 --- a/2025/CVE-2025-66398.json +++ b/2025/CVE-2025-66398.json @@ -64,8 +64,8 @@ "description": "Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.", "fork": false, "created_at": "2026-03-23T09:09:21Z", - "updated_at": "2026-08-17T13:32:19Z", - "pushed_at": "2026-08-17T13:27:42Z", + "updated_at": "2026-08-17T20:14:34Z", + "pushed_at": "2026-08-17T20:13:56Z", "stargazers_count": 1, "watchers_count": 1, "has_discussions": false, diff --git a/2025/CVE-2025-7771.json b/2025/CVE-2025-7771.json index 22c99084a1..e1e5f7e038 100644 --- a/2025/CVE-2025-7771.json +++ b/2025/CVE-2025-7771.json @@ -261,7 +261,7 @@ "stargazers_count": 50, "watchers_count": 50, "has_discussions": false, - "forks_count": 5, + "forks_count": 4, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -285,7 +285,7 @@ "vulnerable-driver" ], "visibility": "public", - "forks": 5, + "forks": 4, "watchers": 50, "score": 0, "subscribers_count": 1 @@ -371,10 +371,10 @@ "description": "ThrottleStop.sys Arbitrary Physical Memory R\/W", "fork": false, "created_at": "2026-08-10T23:15:36Z", - "updated_at": "2026-08-17T13:55:21Z", + "updated_at": "2026-08-17T21:57:21Z", "pushed_at": "2026-08-10T23:15:39Z", - "stargazers_count": 16, - "watchers_count": 16, + "stargazers_count": 17, + "watchers_count": 17, "has_discussions": false, "forks_count": 1, "allow_forking": true, @@ -385,7 +385,7 @@ "topics": [], "visibility": "public", "forks": 1, - "watchers": 16, + "watchers": 17, "score": 0, "subscribers_count": 0 } diff --git a/2026/CVE-2026-13934.json b/2026/CVE-2026-13934.json index 61c18ef335..facb947442 100644 --- a/2026/CVE-2026-13934.json +++ b/2026/CVE-2026-13934.json @@ -2,19 +2,19 @@ { "id": 1322370900, "name": "cve-2026-13934", - "full_name": "ArtWide\/cve-2026-13934", + "full_name": "ArtWideRobo\/cve-2026-13934", "owner": { - "login": "ArtWide", - "id": 35958480, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/35958480?v=4", - "html_url": "https:\/\/github.com\/ArtWide", + "login": "ArtWideRobo", + "id": 279370441, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/279370441?v=4", + "html_url": "https:\/\/github.com\/ArtWideRobo", "user_view_type": "public" }, - "html_url": "https:\/\/github.com\/ArtWide\/cve-2026-13934", + "html_url": "https:\/\/github.com\/ArtWideRobo\/cve-2026-13934", "description": "CVE-2026-13934", "fork": false, "created_at": "2026-08-04T01:12:23Z", - "updated_at": "2026-08-05T08:19:49Z", + "updated_at": "2026-08-18T00:07:36Z", "pushed_at": "2026-08-05T08:16:53Z", "stargazers_count": 0, "watchers_count": 0, diff --git a/2026/CVE-2026-51788.json b/2026/CVE-2026-15826.json similarity index 52% rename from 2026/CVE-2026-51788.json rename to 2026/CVE-2026-15826.json index ae8efa977b..3e30885fd3 100644 --- a/2026/CVE-2026-51788.json +++ b/2026/CVE-2026-15826.json @@ -1,21 +1,21 @@ [ { - "id": 1293905942, - "name": "CVE-2026-51788", - "full_name": "aykhan32\/CVE-2026-51788", + "id": 1337763999, + "name": "CVE-2026-15826-CVE-2026-15748", + "full_name": "HORKimhab\/CVE-2026-15826-CVE-2026-15748", "owner": { - "login": "aykhan32", - "id": 89598470, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/89598470?v=4", - "html_url": "https:\/\/github.com\/aykhan32", + "login": "HORKimhab", + "id": 41143106, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/41143106?v=4", + "html_url": "https:\/\/github.com\/HORKimhab", "user_view_type": "public" }, - "html_url": "https:\/\/github.com\/aykhan32\/CVE-2026-51788", - "description": null, + "html_url": "https:\/\/github.com\/HORKimhab\/CVE-2026-15826-CVE-2026-15748", + "description": "CVE-2026-15826, CVE-2026-15748", "fork": false, - "created_at": "2026-07-08T16:46:45Z", - "updated_at": "2026-07-09T13:52:38Z", - "pushed_at": "2026-07-09T13:52:22Z", + "created_at": "2026-08-17T23:20:31Z", + "updated_at": "2026-08-17T23:30:11Z", + "pushed_at": "2026-08-17T23:30:04Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2026/CVE-2026-17543.json b/2026/CVE-2026-17543.json index 177334fb11..9f9e27a80d 100644 --- a/2026/CVE-2026-17543.json +++ b/2026/CVE-2026-17543.json @@ -47,10 +47,10 @@ "description": null, "fork": false, "created_at": "2026-08-06T17:05:08Z", - "updated_at": "2026-08-14T07:39:42Z", + "updated_at": "2026-08-17T22:11:35Z", "pushed_at": "2026-08-06T17:08:12Z", - "stargazers_count": 1, - "watchers_count": 1, + "stargazers_count": 2, + "watchers_count": 2, "has_discussions": false, "forks_count": 1, "allow_forking": true, @@ -61,7 +61,7 @@ "topics": [], "visibility": "public", "forks": 1, - "watchers": 1, + "watchers": 2, "score": 0, "subscribers_count": 0 } diff --git a/2026/CVE-2026-19650.json b/2026/CVE-2026-19650.json new file mode 100644 index 0000000000..ccb117f69e --- /dev/null +++ b/2026/CVE-2026-19650.json @@ -0,0 +1,35 @@ +[ + { + "id": 1337772988, + "name": "CVE-2026-19650-CVE-2026-19478", + "full_name": "HORKimhab\/CVE-2026-19650-CVE-2026-19478", + "owner": { + "login": "HORKimhab", + "id": 41143106, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/41143106?v=4", + "html_url": "https:\/\/github.com\/HORKimhab", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/HORKimhab\/CVE-2026-19650-CVE-2026-19478", + "description": "CVE-2026-19650, CVE-2026-19478 - Draft or TODO", + "fork": false, + "created_at": "2026-08-17T23:32:50Z", + "updated_at": "2026-08-17T23:33:28Z", + "pushed_at": "2026-08-17T23:32:54Z", + "stargazers_count": 0, + "watchers_count": 0, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 0, + "score": 0, + "subscribers_count": 0 + } +] \ No newline at end of file diff --git a/2026/CVE-2026-20217.json b/2026/CVE-2026-20217.json new file mode 100644 index 0000000000..56e446921a --- /dev/null +++ b/2026/CVE-2026-20217.json @@ -0,0 +1,35 @@ +[ + { + "id": 1337718549, + "name": "CVE-2026-20217", + "full_name": "securifera\/CVE-2026-20217", + "owner": { + "login": "securifera", + "id": 12126525, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/12126525?v=4", + "html_url": "https:\/\/github.com\/securifera", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/securifera\/CVE-2026-20217", + "description": "ZendTo unauthenticated ClamAV CVE-2026-20217 RCE and default-profile root escalation reproduction", + "fork": false, + "created_at": "2026-08-17T22:20:38Z", + "updated_at": "2026-08-17T22:22:41Z", + "pushed_at": "2026-08-17T22:20:57Z", + "stargazers_count": 0, + "watchers_count": 0, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 0, + "score": 0, + "subscribers_count": 0 + } +] \ No newline at end of file diff --git a/2026/CVE-2026-20841.json b/2026/CVE-2026-20841.json index cd08bd9b90..43e41e6aa1 100644 --- a/2026/CVE-2026-20841.json +++ b/2026/CVE-2026-20841.json @@ -66,8 +66,8 @@ "description": "🛠 Demonstrate remote code execution in Windows Notepad versions below 11.2510 using the CVE-2026-20841 proof of concept.", "fork": false, "created_at": "2026-02-26T05:21:28Z", - "updated_at": "2026-08-17T13:24:13Z", - "pushed_at": "2026-08-17T13:22:00Z", + "updated_at": "2026-08-17T20:08:53Z", + "pushed_at": "2026-08-17T20:08:25Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2026/CVE-2026-22747.json b/2026/CVE-2026-22747.json index b05f1fd877..19e4feb860 100644 --- a/2026/CVE-2026-22747.json +++ b/2026/CVE-2026-22747.json @@ -14,8 +14,8 @@ "description": null, "fork": false, "created_at": "2026-08-09T17:08:46Z", - "updated_at": "2026-08-16T17:22:54Z", - "pushed_at": "2026-08-16T17:23:20Z", + "updated_at": "2026-08-17T23:22:42Z", + "pushed_at": "2026-08-17T23:21:20Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2026/CVE-2026-24061.json b/2026/CVE-2026-24061.json index 23c00293b3..f122d795bd 100644 --- a/2026/CVE-2026-24061.json +++ b/2026/CVE-2026-24061.json @@ -101,8 +101,8 @@ "description": "🚨 Exploit CVE-2026-24061, a critical remote authentication bypass in GNU inetutils-telnetd, for instant root shell access without authentication.", "fork": false, "created_at": "2026-02-03T19:46:10Z", - "updated_at": "2026-08-17T13:21:49Z", - "pushed_at": "2026-08-17T13:18:40Z", + "updated_at": "2026-08-17T20:06:50Z", + "pushed_at": "2026-08-17T20:05:05Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2026/CVE-2026-31431.json b/2026/CVE-2026-31431.json index 05c4e149f4..1007b74489 100644 --- a/2026/CVE-2026-31431.json +++ b/2026/CVE-2026-31431.json @@ -724,8 +724,8 @@ "description": "Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.", "fork": false, "created_at": "2026-05-05T04:58:21Z", - "updated_at": "2026-08-15T06:00:48Z", - "pushed_at": "2026-08-15T06:00:28Z", + "updated_at": "2026-08-17T20:21:30Z", + "pushed_at": "2026-08-17T20:21:04Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, @@ -899,8 +899,8 @@ "description": "Vulnerability detection and mitigation tool for Copy Fail and Dirty Frag bugs (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500)", "fork": false, "created_at": "2026-05-08T17:54:04Z", - "updated_at": "2026-08-03T15:06:55Z", - "pushed_at": "2026-08-17T08:24:27Z", + "updated_at": "2026-08-17T21:47:33Z", + "pushed_at": "2026-08-17T21:48:10Z", "stargazers_count": 2, "watchers_count": 2, "has_discussions": false, diff --git a/2026/CVE-2026-40345.json b/2026/CVE-2026-40345.json index 82bb870a3e..96fd75304d 100644 --- a/2026/CVE-2026-40345.json +++ b/2026/CVE-2026-40345.json @@ -14,10 +14,10 @@ "description": "A poc and write-up for CVE-2026-40345", "fork": false, "created_at": "2026-08-17T14:06:41Z", - "updated_at": "2026-08-17T14:51:38Z", + "updated_at": "2026-08-18T00:38:05Z", "pushed_at": "2026-08-17T14:08:41Z", - "stargazers_count": 1, - "watchers_count": 1, + "stargazers_count": 2, + "watchers_count": 2, "has_discussions": false, "forks_count": 0, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 0, - "watchers": 1, + "watchers": 2, "score": 0, "subscribers_count": 0 } diff --git a/2026/CVE-2026-41089.json b/2026/CVE-2026-41089.json index 7d58330d3e..4e647b6d8e 100644 --- a/2026/CVE-2026-41089.json +++ b/2026/CVE-2026-41089.json @@ -256,8 +256,8 @@ "description": "Scan Windows Domain Controllers for CVE-2026-41089 to detect unauthenticated remote code execution vulnerabilities in the Netlogon service.", "fork": false, "created_at": "2026-07-22T15:40:18Z", - "updated_at": "2026-08-15T06:07:05Z", - "pushed_at": "2026-08-15T06:07:01Z", + "updated_at": "2026-08-17T20:28:36Z", + "pushed_at": "2026-08-17T20:27:41Z", "stargazers_count": 1, "watchers_count": 1, "has_discussions": false, diff --git a/2026/CVE-2026-43499.json b/2026/CVE-2026-43499.json index 810c346501..196ba1839e 100644 --- a/2026/CVE-2026-43499.json +++ b/2026/CVE-2026-43499.json @@ -14,10 +14,10 @@ "description": "CVE-2026-43499 PoC", "fork": false, "created_at": "2026-06-27T04:09:11Z", - "updated_at": "2026-08-15T11:44:37Z", + "updated_at": "2026-08-17T22:34:58Z", "pushed_at": "2026-06-27T05:04:04Z", - "stargazers_count": 146, - "watchers_count": 146, + "stargazers_count": 148, + "watchers_count": 148, "has_discussions": false, "forks_count": 37, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 37, - "watchers": 146, + "watchers": 148, "score": 0, "subscribers_count": 1 }, @@ -315,10 +315,10 @@ "description": "GhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloader", "fork": false, "created_at": "2026-07-12T16:05:24Z", - "updated_at": "2026-08-17T13:14:46Z", + "updated_at": "2026-08-17T19:59:22Z", "pushed_at": "2026-08-17T05:30:42Z", - "stargazers_count": 264, - "watchers_count": 264, + "stargazers_count": 265, + "watchers_count": 265, "has_discussions": false, "forks_count": 53, "allow_forking": true, @@ -336,7 +336,7 @@ ], "visibility": "public", "forks": 53, - "watchers": 264, + "watchers": 265, "score": 0, "subscribers_count": 10 }, @@ -487,10 +487,10 @@ "description": "Android version CVE-2026-43499 tester", "fork": false, "created_at": "2026-07-13T13:31:55Z", - "updated_at": "2026-08-17T13:08:53Z", + "updated_at": "2026-08-17T20:39:29Z", "pushed_at": "2026-07-20T07:22:42Z", - "stargazers_count": 51, - "watchers_count": 51, + "stargazers_count": 52, + "watchers_count": 52, "has_discussions": false, "forks_count": 8, "allow_forking": true, @@ -501,7 +501,7 @@ "topics": [], "visibility": "public", "forks": 8, - "watchers": 51, + "watchers": 52, "score": 0, "subscribers_count": 0 }, @@ -1048,12 +1048,12 @@ "description": "KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499", "fork": false, "created_at": "2026-07-17T14:24:08Z", - "updated_at": "2026-08-17T17:41:44Z", + "updated_at": "2026-08-17T23:53:56Z", "pushed_at": "2026-08-09T05:13:42Z", - "stargazers_count": 847, - "watchers_count": 847, + "stargazers_count": 853, + "watchers_count": 853, "has_discussions": false, - "forks_count": 159, + "forks_count": 160, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -1061,8 +1061,8 @@ "pull_request_creation_policy": "all", "topics": [], "visibility": "public", - "forks": 159, - "watchers": 847, + "forks": 160, + "watchers": 853, "score": 0, "subscribers_count": 27 }, @@ -2440,10 +2440,10 @@ "description": "SM-F9360 (Galaxy Z Fold4, q4q) locked-bootloader KernelSU root — CVE-2026-43499 temp root → LD_PRELOAD DEFEX bypass → no-LTO clang-12 kernelsu.ko. Device-verified 2026-08-12.", "fork": false, "created_at": "2026-08-12T08:10:15Z", - "updated_at": "2026-08-15T03:31:31Z", + "updated_at": "2026-08-17T20:41:54Z", "pushed_at": "2026-08-12T08:11:04Z", - "stargazers_count": 2, - "watchers_count": 2, + "stargazers_count": 3, + "watchers_count": 3, "has_discussions": false, "forks_count": 0, "allow_forking": true, @@ -2454,7 +2454,7 @@ "topics": [], "visibility": "public", "forks": 0, - "watchers": 2, + "watchers": 3, "score": 0, "subscribers_count": 0 }, @@ -2798,5 +2798,38 @@ "watchers": 2, "score": 0, "subscribers_count": 0 + }, + { + "id": 1337417655, + "name": "GhostLock-5.10", + "full_name": "R0rt1z2\/GhostLock-5.10", + "owner": { + "login": "R0rt1z2", + "id": 39171306, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/39171306?v=4", + "html_url": "https:\/\/github.com\/R0rt1z2", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/R0rt1z2\/GhostLock-5.10", + "description": "Kernel root exploit (CVE-2026-43499) for some 5.X devices (mostly Amazon)", + "fork": false, + "created_at": "2026-08-17T16:57:57Z", + "updated_at": "2026-08-18T00:41:21Z", + "pushed_at": "2026-08-18T00:41:17Z", + "stargazers_count": 1, + "watchers_count": 1, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 1, + "score": 0, + "subscribers_count": 0 } ] \ No newline at end of file diff --git a/2026/CVE-2026-44578.json b/2026/CVE-2026-44578.json index 31ca84520f..9b63a135d2 100644 --- a/2026/CVE-2026-44578.json +++ b/2026/CVE-2026-44578.json @@ -47,10 +47,10 @@ "description": "NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF", "fork": false, "created_at": "2026-05-15T05:02:38Z", - "updated_at": "2026-08-09T22:56:27Z", + "updated_at": "2026-08-17T22:23:50Z", "pushed_at": "2026-05-15T05:09:54Z", - "stargazers_count": 76, - "watchers_count": 76, + "stargazers_count": 77, + "watchers_count": 77, "has_discussions": false, "forks_count": 20, "allow_forking": true, @@ -61,7 +61,7 @@ "topics": [], "visibility": "public", "forks": 20, - "watchers": 76, + "watchers": 77, "score": 0, "subscribers_count": 0 }, diff --git a/2026/CVE-2026-47301.json b/2026/CVE-2026-47301.json index 7bb1c3f671..f73f94e84a 100644 --- a/2026/CVE-2026-47301.json +++ b/2026/CVE-2026-47301.json @@ -14,10 +14,10 @@ "description": "Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.", "fork": false, "created_at": "2026-08-03T15:29:22Z", - "updated_at": "2026-08-17T08:34:52Z", + "updated_at": "2026-08-17T19:11:45Z", "pushed_at": "2026-08-16T22:34:33Z", - "stargazers_count": 79, - "watchers_count": 79, + "stargazers_count": 80, + "watchers_count": 80, "has_discussions": false, "forks_count": 7, "allow_forking": true, @@ -28,7 +28,7 @@ "topics": [], "visibility": "public", "forks": 7, - "watchers": 79, + "watchers": 80, "score": 0, "subscribers_count": 0 } diff --git a/2026/CVE-2026-52217.json b/2026/CVE-2026-52217.json deleted file mode 100644 index b3d6c39965..0000000000 --- a/2026/CVE-2026-52217.json +++ /dev/null @@ -1,35 +0,0 @@ -[ - { - "id": 1287565357, - "name": "CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR", - "full_name": "teteco\/CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR", - "owner": { - "login": "teteco", - "id": 110571215, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/110571215?v=4", - "html_url": "https:\/\/github.com\/teteco", - "user_view_type": "public" - }, - "html_url": "https:\/\/github.com\/teteco\/CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR", - "description": "The VTEX Checkout Service exposes OrderForm data through the endpoints `\/api\/checkout\/pub\/orderForm\/{orderFormId}` and `\/attachments\/*`. These endpoints do not validate the tenant (store account) of the authenticated session against the ownership of the requested OrderForm.", - "fork": false, - "created_at": "2026-07-02T20:06:01Z", - "updated_at": "2026-07-09T18:09:28Z", - "pushed_at": "2026-07-09T18:08:48Z", - "stargazers_count": 0, - "watchers_count": 0, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "has_pull_requests": true, - "pull_request_creation_policy": "all", - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 0, - "score": 0, - "subscribers_count": 0 - } -] \ No newline at end of file diff --git a/2026/CVE-2026-53359.json b/2026/CVE-2026-53359.json index fe8ec10531..027dd51f6a 100644 --- a/2026/CVE-2026-53359.json +++ b/2026/CVE-2026-53359.json @@ -36,39 +36,6 @@ "score": 0, "subscribers_count": 0 }, - { - "id": 1295645815, - "name": "KVM-Januscape", - "full_name": "xj2268-TA\/KVM-Januscape", - "owner": { - "login": "xj2268-TA", - "id": 109901538, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/109901538?v=4", - "html_url": "https:\/\/github.com\/xj2268-TA", - "user_view_type": "public" - }, - "html_url": "https:\/\/github.com\/xj2268-TA\/KVM-Januscape", - "description": "CVE-2026-53359漏洞补丁", - "fork": false, - "created_at": "2026-07-09T18:21:47Z", - "updated_at": "2026-07-15T11:18:19Z", - "pushed_at": "2026-07-09T19:02:31Z", - "stargazers_count": 2, - "watchers_count": 2, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "has_pull_requests": true, - "pull_request_creation_policy": "all", - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 2, - "score": 0, - "subscribers_count": 0 - }, { "id": 1301509648, "name": "CVE-2026-53359", diff --git a/2026/CVE-2026-56876.json b/2026/CVE-2026-56876.json deleted file mode 100644 index 82245184da..0000000000 --- a/2026/CVE-2026-56876.json +++ /dev/null @@ -1,35 +0,0 @@ -[ - { - "id": 1295292179, - "name": "CVE-2026-56876-POC", - "full_name": "ziad626\/CVE-2026-56876-POC", - "owner": { - "login": "ziad626", - "id": 213093969, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/213093969?v=4", - "html_url": "https:\/\/github.com\/ziad626", - "user_view_type": "public" - }, - "html_url": "https:\/\/github.com\/ziad626\/CVE-2026-56876-POC", - "description": "Offical PoC for this cve", - "fork": false, - "created_at": "2026-07-09T13:33:13Z", - "updated_at": "2026-07-11T13:02:44Z", - "pushed_at": "2026-07-09T13:35:33Z", - "stargazers_count": 1, - "watchers_count": 1, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "has_pull_requests": true, - "pull_request_creation_policy": "all", - "topics": [], - "visibility": "public", - "forks": 0, - "watchers": 1, - "score": 0, - "subscribers_count": 0 - } -] \ No newline at end of file diff --git a/2026/CVE-2026-57517.json b/2026/CVE-2026-57517.json deleted file mode 100644 index 722f1bfeda..0000000000 --- a/2026/CVE-2026-57517.json +++ /dev/null @@ -1,46 +0,0 @@ -[ - { - "id": 1295565313, - "name": "CVE-2026-57517-CWP", - "full_name": "gagaltotal\/CVE-2026-57517-CWP", - "owner": { - "login": "gagaltotal", - "id": 23299078, - "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/23299078?v=4", - "html_url": "https:\/\/github.com\/gagaltotal", - "user_view_type": "public" - }, - "html_url": "https:\/\/github.com\/gagaltotal\/CVE-2026-57517-CWP", - "description": "Control Web Panel (CWP) vulnerability scenario related to CVE-2026-57517", - "fork": false, - "created_at": "2026-07-09T16:58:21Z", - "updated_at": "2026-07-09T17:25:24Z", - "pushed_at": "2026-07-09T17:25:13Z", - "stargazers_count": 0, - "watchers_count": 0, - "has_discussions": false, - "forks_count": 0, - "allow_forking": true, - "is_template": false, - "web_commit_signoff_required": false, - "has_pull_requests": true, - "pull_request_creation_policy": "all", - "topics": [ - "blind-sql-injection", - "control-web-panel", - "cve", - "cve-scanning", - "cwp", - "go", - "golang", - "golang-cli", - "rce", - "rce-exploit" - ], - "visibility": "public", - "forks": 0, - "watchers": 0, - "score": 0, - "subscribers_count": 0 - } -] \ No newline at end of file diff --git a/2026/CVE-2026-62737.json b/2026/CVE-2026-62737.json index f5cc24d49a..bdec79414e 100644 --- a/2026/CVE-2026-62737.json +++ b/2026/CVE-2026-62737.json @@ -47,8 +47,8 @@ "description": null, "fork": false, "created_at": "2026-08-17T17:34:31Z", - "updated_at": "2026-08-17T18:43:27Z", - "pushed_at": "2026-08-17T18:43:05Z", + "updated_at": "2026-08-17T22:41:42Z", + "pushed_at": "2026-08-17T22:41:36Z", "stargazers_count": 0, "watchers_count": 0, "has_discussions": false, diff --git a/2026/CVE-2026-63030.json b/2026/CVE-2026-63030.json index 45a638d677..ad2c21edf3 100644 --- a/2026/CVE-2026-63030.json +++ b/2026/CVE-2026-63030.json @@ -2411,12 +2411,12 @@ "description": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept", "fork": false, "created_at": "2026-08-05T12:48:03Z", - "updated_at": "2026-08-17T18:59:30Z", + "updated_at": "2026-08-18T00:39:47Z", "pushed_at": "2026-08-13T15:04:07Z", - "stargazers_count": 608, - "watchers_count": 608, + "stargazers_count": 648, + "watchers_count": 648, "has_discussions": false, - "forks_count": 108, + "forks_count": 118, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -2431,8 +2431,8 @@ "wp2shell-poc" ], "visibility": "public", - "forks": 108, - "watchers": 608, + "forks": 118, + "watchers": 648, "score": 0, "subscribers_count": 5 }, diff --git a/2026/CVE-2026-70376.json b/2026/CVE-2026-70376.json index ad173fce83..561e5b0e5a 100644 --- a/2026/CVE-2026-70376.json +++ b/2026/CVE-2026-70376.json @@ -1,8 +1,8 @@ [ { "id": 1331972403, - "name": "PluckCMS-CSRF-RCE", - "full_name": "IlhomjonR\/PluckCMS-CSRF-RCE", + "name": "CVE-2026-70376", + "full_name": "IlhomjonR\/CVE-2026-70376", "owner": { "login": "IlhomjonR", "id": 143179506, @@ -10,11 +10,11 @@ "html_url": "https:\/\/github.com\/IlhomjonR", "user_view_type": "public" }, - "html_url": "https:\/\/github.com\/IlhomjonR\/PluckCMS-CSRF-RCE", + "html_url": "https:\/\/github.com\/IlhomjonR\/CVE-2026-70376", "description": "CVE-2026-70376 — Pluck CMS site-wide CSRF (fail-open Referer check) → RCE via double-extension upload. CWE-352\/434, CVSS 8.0. Advisory + PoC by @IlhomjonR.", "fork": false, "created_at": "2026-08-12T11:53:33Z", - "updated_at": "2026-08-12T12:02:34Z", + "updated_at": "2026-08-17T22:23:39Z", "pushed_at": "2026-08-12T12:02:18Z", "stargazers_count": 0, "watchers_count": 0, diff --git a/2026/CVE-2026-71518.json b/2026/CVE-2026-71518.json new file mode 100644 index 0000000000..c7ecb99ac9 --- /dev/null +++ b/2026/CVE-2026-71518.json @@ -0,0 +1,35 @@ +[ + { + "id": 1337717340, + "name": "CVE-2026-71518", + "full_name": "IlhomjonR\/CVE-2026-71518", + "owner": { + "login": "IlhomjonR", + "id": 143179506, + "avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/143179506?v=4", + "html_url": "https:\/\/github.com\/IlhomjonR", + "user_view_type": "public" + }, + "html_url": "https:\/\/github.com\/IlhomjonR\/CVE-2026-71518", + "description": "CVE-2026-71518 — Typemill <2.26.0 unauthenticated authorization bypass in media file download (path-equivalent URL variants). Advisory + PoC.", + "fork": false, + "created_at": "2026-08-17T22:19:00Z", + "updated_at": "2026-08-17T23:09:54Z", + "pushed_at": "2026-08-17T22:23:38Z", + "stargazers_count": 1, + "watchers_count": 1, + "has_discussions": false, + "forks_count": 0, + "allow_forking": true, + "is_template": false, + "web_commit_signoff_required": false, + "has_pull_requests": true, + "pull_request_creation_policy": "all", + "topics": [], + "visibility": "public", + "forks": 0, + "watchers": 1, + "score": 0, + "subscribers_count": 0 + } +] \ No newline at end of file diff --git a/2026/CVE-2026-8452.json b/2026/CVE-2026-8452.json index 4a1f4301f8..7c266c8637 100644 --- a/2026/CVE-2026-8452.json +++ b/2026/CVE-2026-8452.json @@ -14,12 +14,12 @@ "description": "CVE-2026-8452 PreAuth RCE", "fork": false, "created_at": "2026-08-14T15:01:25Z", - "updated_at": "2026-08-17T18:18:32Z", + "updated_at": "2026-08-17T22:20:21Z", "pushed_at": "2026-08-14T15:08:55Z", - "stargazers_count": 47, - "watchers_count": 47, + "stargazers_count": 51, + "watchers_count": 51, "has_discussions": false, - "forks_count": 9, + "forks_count": 10, "allow_forking": true, "is_template": false, "web_commit_signoff_required": false, @@ -27,8 +27,8 @@ "pull_request_creation_policy": "all", "topics": [], "visibility": "public", - "forks": 9, - "watchers": 47, + "forks": 10, + "watchers": 51, "score": 0, "subscribers_count": 0 } diff --git a/2026/CVE-2026-9830.json b/2026/CVE-2026-9830.json index 1bba703e1a..3724138b73 100644 --- a/2026/CVE-2026-9830.json +++ b/2026/CVE-2026-9830.json @@ -47,10 +47,10 @@ "description": "CVE-2026-9830 Proof of Concept", "fork": false, "created_at": "2026-08-15T20:57:13Z", - "updated_at": "2026-08-17T18:49:26Z", + "updated_at": "2026-08-17T22:04:14Z", "pushed_at": "2026-08-15T22:39:12Z", - "stargazers_count": 204, - "watchers_count": 204, + "stargazers_count": 206, + "watchers_count": 206, "has_discussions": false, "forks_count": 1, "allow_forking": true, @@ -72,7 +72,7 @@ ], "visibility": "public", "forks": 1, - "watchers": 204, + "watchers": 206, "score": 0, "subscribers_count": 0 } diff --git a/README.md b/README.md index 9cd05d6fa9..d2d28d0920 100644 --- a/README.md +++ b/README.md @@ -1978,7 +1978,7 @@ Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) -- [ArtWide/cve-2026-13934](https://github.com/ArtWide/cve-2026-13934) +- [ArtWideRobo/cve-2026-13934](https://github.com/ArtWideRobo/cve-2026-13934) ### CVE-2026-14266 (2026-07-29) @@ -2132,6 +2132,13 @@ ### CVE-2026-15706 - [musana/CVE-2026-15706](https://github.com/musana/CVE-2026-15706) +### CVE-2026-15826 (2026-08-15) + +The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site. + + +- [HORKimhab/CVE-2026-15826-CVE-2026-15748](https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748) + ### CVE-2026-15964 (2026-08-01) The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover. @@ -2323,6 +2330,13 @@ - [DarkLycn1976/CVE-2026-19264](https://github.com/DarkLycn1976/CVE-2026-19264) +### CVE-2026-19650 (2026-08-17) + +GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. + + +- [HORKimhab/CVE-2026-19650-CVE-2026-19478](https://github.com/HORKimhab/CVE-2026-19650-CVE-2026-19478) + ### CVE-2026-20079 (2026-03-04) A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp;\r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow&nbsp;root access to the device.&nbsp; @@ -2368,6 +2382,13 @@ - [NSIDE-ATTACK-LOGIC/CIMCown](https://github.com/NSIDE-ATTACK-LOGIC/CIMCown) +### CVE-2026-20217 (2026-07-01) + +A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device.\r\n\r\nThis vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software. + + +- [securifera/CVE-2026-20217](https://github.com/securifera/CVE-2026-20217) + ### CVE-2026-20223 (2026-05-20) A vulnerability in the&nbsp;access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the&nbsp;Site Admin role.\r\n\r\nThis vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the&nbsp;Site Admin user.&nbsp; @@ -3541,7 +3562,7 @@ ### CVE-2026-28990 (2026-05-11) -The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory. +The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory. - [Billy-Ellis/exr-imageio-poc](https://github.com/Billy-Ellis/exr-imageio-poc) @@ -4354,7 +4375,11 @@ ### CVE-2026-38053 - [Crypte1/CVE-2026-38053---Remove-PPL](https://github.com/Crypte1/CVE-2026-38053---Remove-PPL) -### CVE-2026-38165 +### CVE-2026-38165 (2026-08-17) + +A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression. + + - [AT190510-Cuong/CVE-2026-38165-SSTI-](https://github.com/AT190510-Cuong/CVE-2026-38165-SSTI-) ### CVE-2026-38194 @@ -5217,6 +5242,7 @@ - [CamsShaft/IonStack-S22-cve-2026-43499](https://github.com/CamsShaft/IonStack-S22-cve-2026-43499) - [knowlily/cve-2026-43499-honor](https://github.com/knowlily/cve-2026-43499-honor) - [NanoTurtle1145/root-my-s9280](https://github.com/NanoTurtle1145/root-my-s9280) +- [R0rt1z2/GhostLock-5.10](https://github.com/R0rt1z2/GhostLock-5.10) ### CVE-2026-43500 (2026-05-11) @@ -5278,14 +5304,14 @@ ### CVE-2026-43700 (2026-06-29) -A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information. +A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information. - [dem0ns/CVE-2026-43700](https://github.com/dem0ns/CVE-2026-43700) ### CVE-2026-43724 (2026-06-29) -The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory. +The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory. - [gracecondition/DirtySlide](https://github.com/gracecondition/DirtySlide) @@ -6608,9 +6634,6 @@ ### CVE-2026-51592 - [ardakrg/CVE-2026-51592](https://github.com/ardakrg/CVE-2026-51592) -### CVE-2026-51788 -- [aykhan32/CVE-2026-51788](https://github.com/aykhan32/CVE-2026-51788) - ### CVE-2026-51833 (2026-07-17) Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or expose the original IP address of the server. @@ -6645,9 +6668,6 @@ - [lamaper/CVE-2026-52199](https://github.com/lamaper/CVE-2026-52199) -### CVE-2026-52217 -- [teteco/CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR](https://github.com/teteco/CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR) - ### CVE-2026-52504 - [fadingminibus69/advisory001](https://github.com/fadingminibus69/advisory001) @@ -6705,7 +6725,11 @@ - [v3s9er/CVE-2026-52885](https://github.com/v3s9er/CVE-2026-52885) -### CVE-2026-52886 +### CVE-2026-52886 (2026-08-17) + +Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab. This issue is fixed in version 8.9.7. + + - [v3s9er/CVE-2026-52886](https://github.com/v3s9er/CVE-2026-52886) ### CVE-2026-52887 (2026-07-15) @@ -6749,7 +6773,6 @@ - [suominen/januscape](https://github.com/suominen/januscape) -- [xj2268-TA/KVM-Januscape](https://github.com/xj2268-TA/KVM-Januscape) - [ndouglas-cloudsmith/CVE-2026-53359](https://github.com/ndouglas-cloudsmith/CVE-2026-53359) ### CVE-2026-53361 (2026-07-04) @@ -6905,7 +6928,11 @@ ### CVE-2026-54337 - [4qu4r1um/CVE-2026-54337-PoC](https://github.com/4qu4r1um/CVE-2026-54337-PoC) -### CVE-2026-54356 +### CVE-2026-54356 (2026-08-17) + +Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials. This issue is fixed in version 3.41.3. + + - [KovachVL/CVE-2026-54356](https://github.com/KovachVL/CVE-2026-54356) ### CVE-2026-54390 (2026-06-18) @@ -7156,13 +7183,6 @@ - [katekeiroz-dev/golang-x-text](https://github.com/katekeiroz-dev/golang-x-text) -### CVE-2026-56876 (2026-06-26) - -extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files. - - -- [ziad626/CVE-2026-56876-POC](https://github.com/ziad626/CVE-2026-56876-POC) - ### CVE-2026-57155 - [babyshen/CVE-2026-57155](https://github.com/babyshen/CVE-2026-57155) @@ -7173,13 +7193,6 @@ - [Paradoxis/CVE-2026-57239](https://github.com/Paradoxis/CVE-2026-57239) -### CVE-2026-57517 (2026-07-01) - -Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account. - - -- [gagaltotal/CVE-2026-57517-CWP](https://github.com/gagaltotal/CVE-2026-57517-CWP) - ### CVE-2026-57588 (2026-06-25) A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. @@ -7692,14 +7705,14 @@ ### CVE-2026-64725 (2026-07-27) -An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service. +An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service. - [altvist/cve-2026-64725-poc](https://github.com/altvist/cve-2026-64725-poc) ### CVE-2026-64747 (2026-07-27) -A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges. +A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to execute arbitrary code with kernel privileges. - [jiuyi155/agxprobe](https://github.com/jiuyi155/agxprobe) @@ -7733,7 +7746,11 @@ - [IamDremig/CVE-2026-65591](https://github.com/IamDremig/CVE-2026-65591) -### CVE-2026-65640 +### CVE-2026-65640 (2026-08-17) + +WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.\n\nPrerequisites:\n* Imagick and Ghostscript in use on the server\n* A malicious user with the `upload_files` capability\n\nThis issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. + + - [jobusa755-a11y/CVE-2026-65640-](https://github.com/jobusa755-a11y/CVE-2026-65640-) ### CVE-2026-65650 (2026-07-22) @@ -8030,7 +8047,11 @@ ### CVE-2026-67846 - [duan528/CVE-2026-67846-BOOM-NBDTLB](https://github.com/duan528/CVE-2026-67846-BOOM-NBDTLB) -### CVE-2026-68004 +### CVE-2026-68004 (2026-08-17) + +An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration (security.enabled), SrsSecurity::check(), trunk/src/app/srs_app_security.cpp, and SRS RTMP listener components + + - [xuwu-xuwu/CVE-2026-68004](https://github.com/xuwu-xuwu/CVE-2026-68004) ### CVE-2026-68138 (2026-08-10) @@ -8114,7 +8135,7 @@ Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. -- [IlhomjonR/PluckCMS-CSRF-RCE](https://github.com/IlhomjonR/PluckCMS-CSRF-RCE) +- [IlhomjonR/CVE-2026-70376](https://github.com/IlhomjonR/CVE-2026-70376) ### CVE-2026-70481 (2026-08-04) @@ -8186,6 +8207,13 @@ - [dinosn/cve-2026-71362-magento-lab](https://github.com/dinosn/cve-2026-71362-magento-lab) +### CVE-2026-71518 (2026-08-17) + +Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials. + + +- [IlhomjonR/CVE-2026-71518](https://github.com/IlhomjonR/CVE-2026-71518) + ### CVE-2026-71554 (2026-08-06) h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1. @@ -48664,6 +48692,7 @@ A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. +- [berdav/CVE-2021-4034](https://github.com/berdav/CVE-2021-4034) - [arthepsy/CVE-2021-4034](https://github.com/arthepsy/CVE-2021-4034) - [Y3A/CVE-2021-4034](https://github.com/Y3A/CVE-2021-4034) - [ly4k/PwnKit](https://github.com/ly4k/PwnKit) @@ -48733,7 +48762,6 @@ - [ropydev/CVE-2021-4034-PwnKit](https://github.com/ropydev/CVE-2021-4034-PwnKit) - [krleejihyeong/WHS4_CVE-2021-4034](https://github.com/krleejihyeong/WHS4_CVE-2021-4034) - [nicoibarburu/CVE-2021-4034](https://github.com/nicoibarburu/CVE-2021-4034) -- [jeffmarlonmandela/CVE-2021-4034-PwnKit](https://github.com/jeffmarlonmandela/CVE-2021-4034-PwnKit) ### CVE-2021-4044 (2021-12-14) @@ -74475,6 +74503,9 @@ ### CVE-2014-91371 - [jamaal001/CVE-2014-91371-Wordpress-](https://github.com/jamaal001/CVE-2014-91371-Wordpress-) +### CVE-2014-1106691 +- [lucauL2dlek/java-sms-aye](https://github.com/lucauL2dlek/java-sms-aye) + ## 2013 ### CVE-2013-0007 (2013-01-09)