nomi-sec/PoC-in-GitHub
1
0 Fork 0
mirror of https://github.com/nomi-sec/PoC-in-GitHub.git synced 2026-11-07 08:30:25 -10:00
Code Issues Packages Projects Releases Wiki Activity
Files
49935f7c86ee94e52098dcdf62147cfce6d82a1e
PoC-in-GitHub/2026/CVE-2026-39987.json
T

1027 lines
36 KiB
JSON
Raw Blame History

[
{
"id": 1208872365,
"name": "CVE-2026-39987",
"full_name": "0xBlackash\/CVE-2026-39987",
"owner": {
"login": "0xBlackash",
"id": 259905299,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/259905299?v=4",
"html_url": "https:\/\/github.com\/0xBlackash",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xBlackash\/CVE-2026-39987",
"description": "CVE-2026-39987",
"fork": false,
"created_at": "2026-04-12T21:12:35Z",
"updated_at": "2026-04-13T07:46:30Z",
"pushed_at": "2026-04-13T07:46:26Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1209724587,
"name": "marimo_CVE-2026-39987_RCE_PoC",
"full_name": "fevar54\/marimo_CVE-2026-39987_RCE_PoC",
"owner": {
"login": "fevar54",
"id": 80516843,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/80516843?v=4",
"html_url": "https:\/\/github.com\/fevar54",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/fevar54\/marimo_CVE-2026-39987_RCE_PoC",
"description": "PoC de CVE-2026-39987: RCE pre-autenticacion via WebSocket en Marimo menor a 0.23.0 (CVSS 9.3).",
"fork": false,
"created_at": "2026-04-13T18:06:46Z",
"updated_at": "2026-08-25T16:45:27Z",
"pushed_at": "2026-04-13T18:14:16Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-pocs"
],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1209930346,
"name": "CVE-2026-39987_exploit",
"full_name": "mki9\/CVE-2026-39987_exploit",
"owner": {
"login": "mki9",
"id": 274941303,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/274941303?v=4",
"html_url": "https:\/\/github.com\/mki9",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mki9\/CVE-2026-39987_exploit",
"description": null,
"fork": false,
"created_at": "2026-04-13T23:34:47Z",
"updated_at": "2026-09-11T15:55:17Z",
"pushed_at": "2026-04-14T01:23:04Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1211261937,
"name": "CVE-2026-39987",
"full_name": "keraattin\/CVE-2026-39987",
"owner": {
"login": "keraattin",
"id": 6709252,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/6709252?v=4",
"html_url": "https:\/\/github.com\/keraattin",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/keraattin\/CVE-2026-39987",
"description": "CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on \/terminal\/ws WebSocket endpoint gives attackers a full PTY shell without any credentials. Exploited in the wild within 10 hours of disclosure. Fixed in Marimo 0.23.0.",
"fork": false,
"created_at": "2026-04-15T08:09:54Z",
"updated_at": "2026-07-28T11:39:38Z",
"pushed_at": "2026-04-15T08:12:41Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-39987",
"cybersecurity",
"marimo",
"nmap-scripts",
"nse-scripts",
"pre-auth-rce",
"python-notebook",
"remote-code-execution",
"vulnerability-detection",
"websocket"
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1214164588,
"name": "CVE-2026-39987",
"full_name": "Nxploited\/CVE-2026-39987",
"owner": {
"login": "Nxploited",
"id": 188819918,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/188819918?v=4",
"html_url": "https:\/\/github.com\/Nxploited",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Nxploited\/CVE-2026-39987",
"description": "marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability",
"fork": false,
"created_at": "2026-04-18T07:46:43Z",
"updated_at": "2026-10-01T11:15:07Z",
"pushed_at": "2026-04-18T07:51:05Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1221025893,
"name": "CVE-2026-39987",
"full_name": "h3raklez\/CVE-2026-39987",
"owner": {
"login": "h3raklez",
"id": 91031916,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/91031916?v=4",
"html_url": "https:\/\/github.com\/h3raklez",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/h3raklez\/CVE-2026-39987",
"description": "Marimo Pre-Auth RCE",
"fork": false,
"created_at": "2026-04-25T16:50:34Z",
"updated_at": "2026-06-01T03:30:31Z",
"pushed_at": "2026-04-25T16:53:05Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1221379929,
"name": "CVE-2026-39987-lab-or-marimo-cve-lab",
"full_name": "Dhiaelhak-Rached\/CVE-2026-39987-lab-or-marimo-cve-lab",
"owner": {
"login": "Dhiaelhak-Rached",
"id": 75325276,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/75325276?v=4",
"html_url": "https:\/\/github.com\/Dhiaelhak-Rached",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Dhiaelhak-Rached\/CVE-2026-39987-lab-or-marimo-cve-lab",
"description": null,
"fork": false,
"created_at": "2026-04-26T05:54:04Z",
"updated_at": "2026-04-26T05:57:47Z",
"pushed_at": "2026-04-26T05:57:44Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1228761041,
"name": "CVE-2026-39987-Lab",
"full_name": "rootdirective-sec\/CVE-2026-39987-Lab",
"owner": {
"login": "rootdirective-sec",
"id": 253299769,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/253299769?v=4",
"html_url": "https:\/\/github.com\/rootdirective-sec",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/rootdirective-sec\/CVE-2026-39987-Lab",
"description": null,
"fork": false,
"created_at": "2026-05-04T10:54:32Z",
"updated_at": "2026-08-05T07:33:31Z",
"pushed_at": "2026-05-04T10:58:01Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1240292298,
"name": "CVE-2026-39987-marimo-rce",
"full_name": "0xdeadroot\/CVE-2026-39987-marimo-rce",
"owner": {
"login": "0xdeadroot",
"id": 273338609,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/273338609?v=4",
"html_url": "https:\/\/github.com\/0xdeadroot",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xdeadroot\/CVE-2026-39987-marimo-rce",
"description": "CVE-2026-39987",
"fork": false,
"created_at": "2026-05-16T01:10:27Z",
"updated_at": "2026-05-16T01:40:10Z",
"pushed_at": "2026-05-16T01:40:06Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1248492916,
"name": "CVE-2026-39987-POC",
"full_name": "M3PH1569\/CVE-2026-39987-POC",
"owner": {
"login": "M3PH1569",
"id": 267661629,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/267661629?v=4",
"html_url": "https:\/\/github.com\/M3PH1569",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/M3PH1569\/CVE-2026-39987-POC",
"description": "CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)",
"fork": false,
"created_at": "2026-05-24T18:00:33Z",
"updated_at": "2026-09-09T23:13:51Z",
"pushed_at": "2026-07-19T11:04:27Z",
"stargazers_count": 5,
"watchers_count": 5,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 5,
"score": 0,
"subscribers_count": 0
},
{
"id": 1254147873,
"name": "CVE-2026-39987",
"full_name": "HORKimhab\/CVE-2026-39987",
"owner": {
"login": "HORKimhab",
"id": 41143106,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/41143106?v=4",
"html_url": "https:\/\/github.com\/HORKimhab",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/HORKimhab\/CVE-2026-39987",
"description": "CVE-2026-39987 - Draft",
"fork": false,
"created_at": "2026-05-30T07:40:54Z",
"updated_at": "2026-05-30T07:41:01Z",
"pushed_at": "2026-05-30T07:40:57Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1320039561,
"name": "CVE-2026-39987",
"full_name": "gbuyssens\/CVE-2026-39987",
"owner": {
"login": "gbuyssens",
"id": 306151405,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/306151405?v=4",
"html_url": "https:\/\/github.com\/gbuyssens",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/gbuyssens\/CVE-2026-39987",
"description": "Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : \/terminal\/ws.",
"fork": false,
"created_at": "2026-08-02T10:05:44Z",
"updated_at": "2026-08-02T11:01:27Z",
"pushed_at": "2026-08-02T11:01:02Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1320257096,
"name": "CVE-2026-39987",
"full_name": "jasonbernier\/CVE-2026-39987",
"owner": {
"login": "jasonbernier",
"id": 24844372,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/24844372?v=4",
"html_url": "https:\/\/github.com\/jasonbernier",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/jasonbernier\/CVE-2026-39987",
"description": "Simple POC for CVE-2026-39987",
"fork": false,
"created_at": "2026-08-02T14:22:20Z",
"updated_at": "2026-08-04T18:03:26Z",
"pushed_at": "2026-08-04T18:03:09Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1320436385,
"name": "CVE-2026-39987",
"full_name": "vanhari\/CVE-2026-39987",
"owner": {
"login": "vanhari",
"id": 163671161,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/163671161?v=4",
"html_url": "https:\/\/github.com\/vanhari",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/vanhari\/CVE-2026-39987",
"description": "CVE-2026-39987 poc",
"fork": false,
"created_at": "2026-08-02T17:34:07Z",
"updated_at": "2026-08-03T10:41:07Z",
"pushed_at": "2026-08-02T17:40:28Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1321328198,
"name": "CVE-2026-39987_PoC",
"full_name": "Wind010\/CVE-2026-39987_PoC",
"owner": {
"login": "Wind010",
"id": 17187851,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/17187851?v=4",
"html_url": "https:\/\/github.com\/Wind010",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Wind010\/CVE-2026-39987_PoC",
"description": "A proof-of-concept for CVE-2026-39987",
"fork": false,
"created_at": "2026-08-03T06:32:49Z",
"updated_at": "2026-08-04T10:30:00Z",
"pushed_at": "2026-08-03T07:23:58Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1326324049,
"name": "CVE-2026-39987",
"full_name": "alreadyClosed\/CVE-2026-39987",
"owner": {
"login": "alreadyClosed",
"id": 95873185,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/95873185?v=4",
"html_url": "https:\/\/github.com\/alreadyClosed",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/alreadyClosed\/CVE-2026-39987",
"description": "CVE-2026-39987 for marimo 0.20.4 PoC",
"fork": false,
"created_at": "2026-08-07T07:04:38Z",
"updated_at": "2026-08-07T07:34:35Z",
"pushed_at": "2026-08-07T07:33:03Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"ctf",
"cve",
"cve-2026-39987",
"educational",
"marimo",
"tool"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1327892194,
"name": "cohort-htb",
"full_name": "iapetus12\/cohort-htb",
"owner": {
"login": "iapetus12",
"id": 24455759,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/24455759?v=4",
"html_url": "https:\/\/github.com\/iapetus12",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/iapetus12\/cohort-htb",
"description": "HTB Cohort - SSRF, Marimo pre-auth RCE (CVE-2026-39987) y PackageKit privesc (CVE-2026-41651)",
"fork": false,
"created_at": "2026-08-08T15:27:14Z",
"updated_at": "2026-09-11T15:38:03Z",
"pushed_at": "2026-08-08T15:27:17Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1329339990,
"name": "CVE-2026-39987-Poc",
"full_name": "MADA0L\/CVE-2026-39987-Poc",
"owner": {
"login": "MADA0L",
"id": 192711315,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/192711315?v=4",
"html_url": "https:\/\/github.com\/MADA0L",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/MADA0L\/CVE-2026-39987-Poc",
"description": "Proof of Concept (PoC) WebSocket client for CVE-2026-39987 (Marimo Pre-Auth RCE), intended for authorized security testing.",
"fork": false,
"created_at": "2026-08-10T02:08:03Z",
"updated_at": "2026-08-11T14:33:56Z",
"pushed_at": "2026-08-10T03:52:23Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1332366389,
"name": "cve-2026-39987",
"full_name": "matesz44\/cve-2026-39987",
"owner": {
"login": "matesz44",
"id": 29248278,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/29248278?v=4",
"html_url": "https:\/\/github.com\/matesz44",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/matesz44\/cve-2026-39987",
"description": "CVE-2026-39987 PoC: Marimo<0.23.0 Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass",
"fork": false,
"created_at": "2026-08-12T19:12:11Z",
"updated_at": "2026-08-12T19:17:10Z",
"pushed_at": "2026-08-12T19:17:05Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1341074100,
"name": "CVE-2026-39987.py",
"full_name": "dodeepsink\/CVE-2026-39987.py",
"owner": {
"login": "dodeepsink",
"id": 271619649,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/271619649?v=4",
"html_url": "https:\/\/github.com\/dodeepsink",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/dodeepsink\/CVE-2026-39987.py",
"description": "This python script exploit the vulnerable marimo \/terminal\/ws endpoint and returns a interactive shell.",
"fork": false,
"created_at": "2026-08-20T19:25:00Z",
"updated_at": "2026-08-23T03:00:02Z",
"pushed_at": "2026-08-23T02:59:55Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1354051475,
"name": "CVE-2026-39987",
"full_name": "Ghxstsec\/CVE-2026-39987",
"owner": {
"login": "Ghxstsec",
"id": 138116684,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/138116684?v=4",
"html_url": "https:\/\/github.com\/Ghxstsec",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Ghxstsec\/CVE-2026-39987",
"description": null,
"fork": false,
"created_at": "2026-09-01T21:40:03Z",
"updated_at": "2026-09-02T06:48:53Z",
"pushed_at": "2026-09-01T21:56:13Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1360626651,
"name": "CVE-2026-39987-PoC",
"full_name": "stapat1245\/CVE-2026-39987-PoC",
"owner": {
"login": "stapat1245",
"id": 85617297,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/85617297?v=4",
"html_url": "https:\/\/github.com\/stapat1245",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/stapat1245\/CVE-2026-39987-PoC",
"description": "CVE-2026-39987 Proof of Concept",
"fork": false,
"created_at": "2026-09-07T20:09:31Z",
"updated_at": "2026-09-07T20:10:36Z",
"pushed_at": "2026-09-07T20:10:23Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1361836240,
"name": "CVE-2026-39987",
"full_name": "Th3Purge\/CVE-2026-39987",
"owner": {
"login": "Th3Purge",
"id": 325773251,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/325773251?v=4",
"html_url": "https:\/\/github.com\/Th3Purge",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Th3Purge\/CVE-2026-39987",
"description": "Marimo Pre Authentication RCE",
"fork": false,
"created_at": "2026-09-08T19:44:20Z",
"updated_at": "2026-10-02T13:41:56Z",
"pushed_at": "2026-09-08T19:46:00Z",
"stargazers_count": 9,
"watchers_count": 9,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 9,
"score": 0,
"subscribers_count": 0
},
{
"id": 1366563971,
"name": "CVE-2026-39987_POC",
"full_name": "julichaan\/CVE-2026-39987_POC",
"owner": {
"login": "julichaan",
"id": 179177178,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/179177178?v=4",
"html_url": "https:\/\/github.com\/julichaan",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/julichaan\/CVE-2026-39987_POC",
"description": "Marimo WS Preauth RCE",
"fork": false,
"created_at": "2026-09-11T18:29:42Z",
"updated_at": "2026-09-11T18:30:35Z",
"pushed_at": "2026-09-11T18:30:31Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1378322671,
"name": "CVE-2026-39987_RCE_PoC",
"full_name": "mfahdk\/CVE-2026-39987_RCE_PoC",
"owner": {
"login": "mfahdk",
"id": 158589984,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/158589984?v=4",
"html_url": "https:\/\/github.com\/mfahdk",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mfahdk\/CVE-2026-39987_RCE_PoC",
"description": null,
"fork": false,
"created_at": "2026-09-20T12:40:18Z",
"updated_at": "2026-09-20T12:44:26Z",
"pushed_at": "2026-09-20T12:44:22Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1390670815,
"name": "CVE-2026-39987-Marimo-RCE-SOC-Detection",
"full_name": "LaRemontada12\/CVE-2026-39987-Marimo-RCE-SOC-Detection",
"owner": {
"login": "LaRemontada12",
"id": 188646803,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/188646803?v=4",
"html_url": "https:\/\/github.com\/LaRemontada12",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/LaRemontada12\/CVE-2026-39987-Marimo-RCE-SOC-Detection",
"description": "Security research and SOC investigation of CVE-2026-39987 using Docker, Nginx, Linux process monitoring, Splunk SIEM, and SPL detection rules.",
"fork": false,
"created_at": "2026-09-27T11:07:39Z",
"updated_at": "2026-11-06T13:37:57Z",
"pushed_at": "2026-11-06T13:33:27Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"blue-team",
"cve",
"cybersecurity",
"detection-engineering",
"docker",
"incident-response",
"marimo",
"pentesting",
"security-research",
"soc",
"splunk",
"websocket"
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1422705079,
"name": "CVE-2026-39987-Marimo-RCE",
"full_name": "Industri4l-H3ll-Xpl0it3rs\/CVE-2026-39987-Marimo-RCE",
"owner": {
"login": "Industri4l-H3ll-Xpl0it3rs",
"id": 262636091,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/262636091?v=4",
"html_url": "https:\/\/github.com\/Industri4l-H3ll-Xpl0it3rs",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Industri4l-H3ll-Xpl0it3rs\/CVE-2026-39987-Marimo-RCE",
"description": "CVE-2026-39987 Exploit | by infrar3d",
"fork": false,
"created_at": "2026-10-16T21:52:53Z",
"updated_at": "2026-10-16T21:54:35Z",
"pushed_at": "2026-10-16T21:53:57Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"exploit"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1427653165,
"name": "MARABUSE",
"full_name": "dntaskmehow\/MARABUSE",
"owner": {
"login": "dntaskmehow",
"id": 277892110,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/277892110?v=4",
"html_url": "https:\/\/github.com\/dntaskmehow",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/dntaskmehow\/MARABUSE",
"description": "MARIMO RCE & NKABUSE EXPLOIT FRAMEWORK (CVE-2026-39987) - RE-WEAPONIZED - This framework exploits CVE-2026-39987, a critical Remote Code Execution (RCE) vulnerability in Marimo, a popular Python-based data visualization tool. Attackers actively exploit this flaw to deploy NKAbuse, a blockchain-based botnet malware.",
"fork": false,
"created_at": "2026-10-20T23:06:33Z",
"updated_at": "2026-10-21T18:49:03Z",
"pushed_at": "2026-10-21T18:48:59Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1431870475,
"name": "CVE-2026-39987-POC-Marimo",
"full_name": "lunacysoft\/CVE-2026-39987-POC-Marimo",
"owner": {
"login": "lunacysoft",
"id": 9068969,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/9068969?v=4",
"html_url": "https:\/\/github.com\/lunacysoft",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/lunacysoft\/CVE-2026-39987-POC-Marimo",
"description": "CVE-2026-39987 POC Marimo",
"fork": false,
"created_at": "2026-10-24T06:04:58Z",
"updated_at": "2026-10-24T06:23:21Z",
"pushed_at": "2026-10-24T06:23:17Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1444994772,
"name": "HTB-Cohort",
"full_name": "1nt1m4cy\/HTB-Cohort",
"owner": {
"login": "1nt1m4cy",
"id": 210791352,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/210791352?v=4",
"html_url": "https:\/\/github.com\/1nt1m4cy",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/1nt1m4cy\/HTB-Cohort",
"description": "HTB Cohort writeup -- SSRF, Marimo CVE-2026-39987, PackageKit CVE-2026-41651",
"fork": false,
"created_at": "2026-11-04T00:45:03Z",
"updated_at": "2026-11-06T15:18:48Z",
"pushed_at": "2026-11-04T01:14:47Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 2,
"score": 0,
"subscribers_count": 0
}
]
Reference in new issue View Git Blame Copy Permalink