Skip to content

Releases: projectdiscovery/nuclei-templates

Release list

Nuclei Templates v10.4.7 - Release Notes

Nuclei Templates v10.4.7 - Release Notes Latest
Latest

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 03 Aug 07:21
v10.4.7
83234ce

New Templates Added: 122 | CVEs Added: 49 | First-time contributions: 23

🔥 Release Highlights 🔥

  • [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion (@slcyber, @mielverkerken, @pdteam, @FLX-0x00) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-60004] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥
  • [CVE-2026-58455] Dockwatch <= 0.6.567 - OS Command Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56291] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload (@nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-56290] Page Builder CK <= 3.5.10 - Unauth File Upload (@panchiko-p, @0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-48908] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-46442] Flowise < 3.1.2 - node-custom-function Unauth RCE (@dhiyaneshdk, @princechaddha) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-44825] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials (@pdteam, @0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-16232] Check Point Security Management Server - SmartConsole Authentication Bypass (@sfewer-r7, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-15409] SonicWall SMA1000 - Server-Side Request Forgery (@dhiyaneshdk, @rapid7) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-9282] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥
  • [CVE-2026-8732] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-8713] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-6875] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE (@pdteam, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-3296] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-71334] Flowise - Path Traversal (@theamanrawat) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-68493] Apache Struts XWork - XML External Entity Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
  • [CVE-2025-54988] Apache Tika - XXE Injection (@tx1ee) [critical] 🔥
  • [CVE-2025-6389] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func (@dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2025-2505] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion (@pussycat0x) [critical] (kev) (vKEV) 🔥
  • [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal (@ChrisJr404) [critical] 🔥
  • [CVE-2023-34992] Fortinet FortiSIEM - Unauth Command Injection (@Thacien) [critical] 🔥

What's Changed

Bug Fixes

  • Stopped credential-stuffing and token-spray templates from sending their first request when no username, password or token is supplied (PR #16589, Issue #11238).
  • Restored missing matcher and extractor values in four templates that silently no-op'd, including CVE-2021-44228, CVE-2021-45046 and CVE-2026-42281 (PR #16661).
  • Replaced an unsupported RE2 lookahead that stopped home-env-permission.yaml from loading at all (PR #16664).
  • Added the missing capture group to three regex extractors (PR #16665).
  • Corrected the extractor part in portal-api-ssrf from interactsh to interactsh_request (PR #16667).
  • Corrected the DSL variable in thinkphp6-arbitrary-write from status_2 to status_code_2 (PR #16668).
  • Unhid two extractors marked internal that nothing consumed (PR #16669).
  • Marked the setup-stage matchers in CVE-2025-2075 as internal (PR #16671).
  • Removed an AWS access key ID from a reference URL in CVE-2024-51482.yaml (PR #16616).
  • Fixed an intrusive tag typo in CVE-2023-34124.yaml (PR #16675).
  • Corrected the id and filename for the IBM DB2 Server template (PR #16688).
  • Fixed the severity in directory-listing-no-host-header.yaml (PR #16614).
  • Corrected the author field for CVE-2024-23108 (PR #16620).
  • Moved CVE-2025-29635 from javascript to http to fix its classification (PR #16636).
  • Moved CVE-2021-27877.yaml to the correct folder (PR #16591).
  • Renamed Wix-detect.yaml to wix-detect.yaml (PR #16731) and renamed a CVE file to match the naming convention (PR #16730).
  • Renamed CVE-2021-45046 to CVE-2021-45046-DAST (PR #16685) and smb-default-creds to smb-default-login (PR #16592).
  • Removed superseded and redundant templates: geovision-geowebserver-lfi.yaml (PR #16687), geovision-geowebserver-xss.yaml (PR #16686) and config-json.yaml (PR #16680).

False Negatives

  • Fixed mongodb-unauth failing on MongoDB 6.0+ by switching from the removed OP_QUERY opcode to OP_MSG (PR #16454, Issue #16294).
  • Fixed CVE-2026-23550 missing WordPress canonical redirects that carry a trailing slash (PR #16566, Issue #16554).
  • Improved CVE-2026-63030 with safe route-confusion detection (PR #16658, Issue #16629).
  • Reduced false negatives in the exposed-zookeeper template (PR #16579, Issue #11076).
  • Extended the unauthenticated-jenkins matcher to cover both dashboard title variants (PR #16575).
  • Fixed the langfuse-panel health matcher, which checked the wrong response part (PR #16574).
  • Updated twitter-phish.yaml matchers to the current X/Twitter login page markup (PR #16362).

False Positives

  • Reduced false positives and improved accuracy in the following templates:
  • nfs-v3-exposed, which treated an RPC PROG_UNAVAIL reply as a valid hit (PR #16672, Issue #16662).
  • Mailpit < 1.28.2 SMTP CRLF injection, CVE-2026-23829 (PR #16580, Issue #16576).
  • CVE-2025-32969, by removing an incorrect content_type matcher (PR #16704).
  • CVE-2023-50839, by adding a plugin fingerprint before flagging (PR #16526).
  • kiali-panel (PR #16628).
  • dameng-detect, switched to a positive signature (PR #16468).
  • open-proxy-portscan, now rejects HTML bodies returned by WAFs (PR #16588).

Enhancements

  • Refactored airflow-detect.yaml to add an /openapi.json check with stop-at-first-match (PR #16703).
  • Added body fuzzing plus POST/PUT method support to the DAST templates (PR #15947).
  • Reworked CVE-2024-22476 into a flow-based check with randomised markers (PR #16590).
  • Improved the CVE-2026-63030 request payload and tightened its matchers (PR #16682).
  • Updated htaccess-config.yaml with .htaccess.bak, .txt and .old paths, dropping stale ones (PR #16706).
  • Enriched four Perforce templates with CVE-2026-6043 metadata and references (PR #16349).
  • Converted geovision-geowebserver LFI/XSS templates to CVE-2021-47795 (PR #16160, Issue #15275).
  • Converted the Bitrix open redirect template to CVE-2008-2052 (PR #16301, Issue #15275).
  • Updated the Wix subdomain takeover fingerprint (PR #16551).
  • Added the Arista VeloCloud favicon hash to favicon-detect (PR #16677).
  • Updated tags in CVE-2026-16232.yaml (PR #16689).

Templates Added

Read more

Contributors

nick, anupamme, and 49 other contributors
Assets 3
Loading

Nuclei Templates v10.4.6 - Release Notes

Nuclei Templates v10.4.6 - Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 16 Jul 18:54
v10.4.6
7d66fa0

New Templates Added: 74 | CVEs Added: 23 | First-time contributions: 6

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

  • Fixed invalid matcher type in CVE-2025-29635 (PR #16506).
  • Corrected incorrect delay seconds in the time-based SQL injection check (PR #16469).
  • Fixed typo in tags from 'okiko' to 'okiok' (PR #16425).
  • Corrected severity and description in concrete5-installer.yaml (PR #16523).
  • Updated GitHub Pages takeover detection templates to reflect the new GitHub policy (Issue #10514).
  • Fixed checksum generation ordering so it runs after template signing completes (PR #16450).
  • Removed duplicate and obsolete templates: Tomcat exposed-panels duplicates (PR #16530), mikrotik-routeros-old.yaml (PR #16527), and 3dprint-arbitrary-file-upload.yaml (PR #16426).
  • Corrected template names and file paths across a set of templates — nuuo-network-login (PR #16547), fuji-xerox-internet-service (PR #16546), trino-unauth-cluster (PR #16560), echo-detect (PR #16559), XOOPS installer (PR #16531), osticket-installer (PR #16529), zoneminder-system-log (PR #16498), unauth-opcache-control-panel (PR #16424), fortiadc-panel (PR #16525), Checkmarx panel (PR #16519), Cisco TelePresence MCU / ServiceGrid / ACE 4710 panels (PRs #16522, #16521, #16520), Avaya Aura System Manager and Communication Manager panels (PRs #16518, #16517), joomla-com-fabrik-lfi (PR #16549), CVE-2016-9299 (PR #16548), and CVE-2025-47188 (PR #16433).

False Negatives

  • Fixed regex in CVE-2026-1731 that failed on targets returning company instead of default_company (PR #16545, Issue #16544).
  • Extended the Spring Boot heap dump template to cover additional BBO endpoints, catching instances previously missed (PR #16503, Issue #11653).
  • Added more selectors to dkim-record-detect.yaml to reduce missed records (PR #16535).
  • Added additional Keycloak admin panel paths (PR #16495, Issue #16376).
  • Added another Spring Boot Actuator HTTP path (PR #16571).

False Positives

  • Reduced false positives and improved accuracy in the following templates:
  • CVE-2024-37881 — excluded multiple WordPress endpoints and generic redirects (PRs #16494, #16504, Issue #16423)
  • CVE-2024-34351 — corrected wrong detection (PR #16500, Issue #11641)
  • Time-based SQL injection detection (PR #16510)
  • Casbin MCP Gateway default login (PR #16477)
  • dns/caa — now matches only the ANSWER section (PR #16453)
  • apache-mod-negotiation-listing.yaml - incorrect severity (Issue #16540)
  • CVE-2019-5544 (Issue #16484)

Enhancements

  • Improved Inertia.js detection with proximity-bound matchers and additional adapters (PR #16435).
  • Refactored the SMB shares enumeration script (PR #16507).
  • Updated MinIO default login configuration (PR #16541).
  • Updated details, tags, and descriptions in MyBB installer (PR #16528), DzzOffice installer panel (PR #16524), and CVE-2010-4282 remediation (PR #16427).
  • Added reference links for CVE-2026-28496 (PR #16514) and CVE-2026-50751 (PR #16550).
  • Bumped actions/checkout from 4 to 7 (PR #16444).

Templates Added

  • [CVE-2026-59801] 9Router - Unauth LLM Provider API Exposure (@0x_Akoko) [critical]
  • [CVE-2026-56782] Gorse < 0.5.10 - Unauth Database Dump (@0x_Akoko) [critical]
  • [CVE-2026-52815] Gogs < 0.14.3 - Unauth Organization Teams Disclosure (@0x_Akoko) [low] 🔥
  • [CVE-2026-52774] YesWiki Bazar Widget - Reflected XSS via 'id' Parameter (@0x_Akoko) [medium]
  • [CVE-2026-50229] Apache Tomcat - Cross-Site Scripting (@yshahinzadeh, @AmirMSafari) [medium] 🔥
  • [CVE-2026-48611] phpBB < 3.3.17 - Auth Bypass (@aikido, @dhiyaneshdk) [critical] 🔥
  • [CVE-2026-48313] ColdFusion - Path Traversal (@watchtowr, @dhiyaneshdk) [high] 🔥
  • [CVE-2026-48282] Adobe ColdFusion - RDS Arbitrary File Write (@watchtowr, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-46339] 9Router <= 0.4.36 - Unauth RCE (@0x_Akoko) [critical]
  • [CVE-2026-44381] MISP < 2.5.37 - SQL Injection (@malcha) [medium] 🔥
  • [CVE-2026-34413] Xerte Online Toolkits <= 3.15 - Remote Code Execution (@Aryu-RU) [critical]
  • [CVE-2026-30958] OneUptime < 10.0.21 - Path Traversal (@ashvinctrl, @iconnnjka) [high]
  • [CVE-2026-28496] FOSSBilling - Server-Side Template Injection (@dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2026-24207] NVIDIA Triton Inference Server <= 26.02 - Auth Bypass (@VixianSchool) [critical] 🔥
  • [CVE-2026-22778] vLLM 0.8.3 - 0.14.0 - Information Disclosure (@kenlacroix) [critical] 🔥
  • [CVE-2026-13731] WPBot <= 8.4.9 - Cross-Site Scripting (@0x_Akoko) [high] (vKEV) 🔥
  • [CVE-2026-10823] YMC Filter WordPress - Unauth Post Disclosure (@Hardik-369) [high]
  • [CVE-2026-8386] WP Go Maps < 10.0.10 - Unauth Marker Information Disclosure (@0x_Akoko) [medium] 🔥
  • [CVE-2026-8383] LearnPress < 4.3.7 - Information Disclosure (@0x_Akoko) [medium] 🔥
  • [CVE-2026-8037] Progress ADC LoadMaster - Command Injection (@watchtowr, @dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2026-3326] XStore Theme < 9.7.3 - SQL Injection (@VixianSchool) [high] 🔥
  • [CVE-2026-1890] LeadConnector < 3.0.22 - Unauth Arbitrary Data Write (@0x_Akoko) [medium] (vKEV) 🔥
  • [CVE-2025-29635] D-Link DIR-823X set_prohibiting - Command Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
  • [dns-internal-ip-disclosure] Public DNS Resolving to Private IP Addresses (@infosec-asish, @DevamShah) [info]
  • [dahua-icc-default-login] Dahua ICC Default Login (@dhiyaneshdk) [high]
  • [array-networks-ssl-vpn-panel] Array Networks SSL VPN - Login Panel (@rxerium) [info]
  • [aruba-via-vpn-panel] Aruba VIA VPN - Login Panel (@rxerium) [info]
  • [cradlepoint-gateway-panel] CradlePoint Gateway - Login Panel (@rxerium) [info]
  • [ctrlpanel-panel] CtrlPanel Login Panel - Detect (@theamanrawat) [info]
  • [cyberoam-firewall-panel] Cyberoam Firewall - Login Panel (@rxerium) [info]
  • [ddwrt-panel] DD-WRT - Router Panel (@rxerium) [info]
  • [ecessa-panel] Ecessa WANworX - Login Panel (@rxerium) [info]
  • [elfiq-panel] Elfiq Link Balancer - Login Panel (@rxerium) [info]
  • [endian-firewall-panel] Endian Firewall - Login Panel (@rxerium) [info]
  • [featherpanel-panel] FeatherPanel Panel - Detect (@Th3l0newolf) [info]
  • [firemon-asset-manager-panel] FireMon Asset Manager - Login Panel (@rxerium) [info]
  • [fortinet-fortianalyzer-panel] Fortinet FortiAnalyzer - Login Panel (@rxerium) [info]
  • [headscale-panel] Headscale - Login Panel (@rxerium) [info]
  • [hillstone-ssl-vpn-panel] Hillstone Networks SSL VPN - Login Panel (@rxerium) [info]
  • [jotty-page-login-panel] jotty·page Login - Panel Detect (@Th3l0newolf) [info]
  • [kestra-panel] Kestra Login - Panel Detect (@Th3l0newolf) [info]
  • [maxkb-panel] MaxKB Panel - Detect (@rxerium) [info]
  • [netgate-pfsenseplus-panel] Netgate pfSense Plus - Login Panel (@rxerium) [info]
  • [netsweeper-webadmin-panel] Netsweeper WebAdmin - Login Panel (@rxerium) [info]
  • [nuage-networks-vsp-panel] Nokia Nuage Networks VSP - Dashboard Panel (@rxerium) [info]
  • [ocserv-panel] OpenConnect VPN Server (ocserv) - Detect (@rxerium) [info]
  • [peplink-incontrol-panel] Peplink InControl - Login Panel (@rxerium) [info]
  • [qualys-cloud-platform-login] Qualys Cloud Platform Login Panel - Detect (@rxerium) [info]
  • [sangfor-iam-panel] Sangfor Internet Access Management - Login Panel (@rxerium) [info]
  • [sangfor-ngaf-panel] Sangfor Next-Generation Application Firewall (NGAF) - Login Panel (@rxerium) [info]
  • [silver-peak-edgeconnect-panel] Silver Peak / HPE Aruba EdgeConnect - Orchestrator Panel (@rxerium) [info]
  • [sma-opcon-panel] SMA OpCon Panel - Detect (@righettod) [info]
  • [smoothwall-firewall-panel] Smoothwall Firewall - Login Panel (@rxerium) [info]
  • [sonicwall-analytics-panel] SonicWall Analytics - Login Panel (@rxerium) [info]
  • [sophos-utm-panel] Sophos UTM User Portal - Login Panel (@rxerium) [info]
  • [stormshield-network-security-panel] Stormshield Network Security - Login Panel (@rxerium) [info]
  • [thegreenbowvpn-panel] TheGreenBow VPN - Login Panel (@rxerium) [info]
  • [trend-micro-deep-security-panel] Trend Micro Deep Security Manager - Login Panel (@rxerium) [info]
  • [ubiquiti-edgerouter-panel] Ubiquiti EdgeRouter - Login Panel (@rxerium) [info]
  • [unifi-securitygateway-panel] Ubiquiti UniFi Security Gateway - Login Panel (@rxerium) [info]
  • [wg-easy-panel] WireGuard Easy (wg-easy) - Login Panel (@rxerium) [info]
  • [zywall-usg-pa...
Read more

Contributors

righettod, aikido, and 22 other contributors
Loading

Nuclei Templates v10.4.5 - Release Notes

Nuclei Templates v10.4.5 - Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 23 Jun 19:17
v10.4.5
e5a0fba

New Templates Added: 86 | CVEs Added: 64 | First-time contributions: 22

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

  • Fixed invalid double-port URL construction in hpe-autopass-panel where {{Hostname}} was used instead of {{Host}}, producing malformed URLs like hostname:6274:5814/autopass (PR #16316, Issue #16315).
  • Fixed incorrect CVE assignment in a contributed template, correcting the CVE ID to match the actual vulnerability (PR #16397, Issue #16388).
  • Fixed username variable syntax error in CVE-2026-44551.yaml causing broken authentication attempts (PR #16341).
  • Corrected broken reference links in CVE-2020-27361.yaml (PR #16403).
  • Fixed typo in tags field of wp-jetpack-ssrf.yaml (PR #16347).
  • Moved CVE-2020-14644.yaml to the correct folder in the repository structure (PR #16432).

False Negatives

  • Fixed a broken regex in the waf-detect BIG-IP ASM matcher that used start-of-response anchors (\A, ^) against a blob beginning with the HTTP status line — the Set-Cookie: TS… header could never match, causing BIG-IP hosts to be reported as "no WAF" (PR #16437).
  • Fixed exposed-dockerd.yaml which could never produce a result because it probed a non-existent endpoint; Docker's Server: header only appears on valid endpoint responses such as /_ping (PR #16332).
  • Added detection for CVE-2018-11776 (Apache Struts2 S2-057) configurations that respond with a 302 redirect and embed OGNL output in the Location header, which the template previously missed entirely (PR #16406).
  • Fixed false negative detection in CVE-2025-51586 template (PR #16264).

False Positives

  • Fixed false positives in CVE-2026-10795 (UpdraftPlus UpdraftCentral auth bypass) where the template incorrectly flagged non-WordPress hosts such as Zimbra webmail servers (PR #16418).
  • Fixed false positives in CVE-2020-5776 (Magnolia CMS) template (PR #16408, Issue #16323).
  • Fixed false positives in app-manager-default-login where the strings Super Administrator and Add Application appear on the unauthenticated login page, causing the template to fire even when default credentials fail (PR #16398, Issue #12959).
  • Fixed ikev2-transforms-enum matcher that always triggered regardless of target (PR #16352, Issue #16351).
  • Tightened janitza-umg-panel matcher that was matching on the generic string UMG alone, now requiring Janitza electronics in combination (PR #16344, Issue #16330).
  • Added negative matcher to trace-axd-expose.yaml to suppress false positives when ASP.NET returns a 403 (trace endpoint blocked, not exposed) (PR #16329).
  • Tightened matcher in aveva-intouch-access-anywhere-panel to eliminate false positives on unrelated hosts (PR #16295).
  • Tightened matcher in trendmicro-apexone-panel to prevent false positives on non-Apex One targets (PR #16265).
  • Replaced single-request time-based detection in CVE-2023-5652 (WP Hotel Booking) with differential timing to eliminate false positives on high-latency servers (PR #15954).

Enhancements

  • Converted the brightsign-dsdws-ssrf workflow template to a properly classified CVE-2020-36884 code template with complete CVE metadata, references, and classification tags while preserving existing detection logic (PR #16260).

Templates Added

Read more

Contributors

aushack, neonbunny, and 38 other contributors
Loading

Nuclei Templates v10.4.4 - Release Notes

Nuclei Templates v10.4.4 - Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 28 May 15:17
v10.4.4
db956bc

New Templates Added: 179 | CVEs Added: 43 | First-time contributions: 20

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

  • Corrected the classification.cve-id mismatch in the CVE-2024-38856 template, which was pointing to CVE-2024-32113 (PR #16277).
  • Fixed a YAML parsing failure in gradio-image-ssrf caused by an unclosed string literal in DSL matchers, after the stricter govaluate fork surfaced it (PRs #16171, #16210, #16243).
  • Added the missing cve-id classification to CVE-2023-2745 (PR #16152).
  • Added the missing words key in CVE-2023-46347, which previously caused a YAML syntax error and prevented execution (PR #16097).
  • Resolved a duplicate template id conflict for fortisandbox-panel by renaming the Fortinet-scoped template (PR #16070) and removed the leftover duplicate plus stray contrastapi recon templates as release-prep cleanup (PR #16118).
  • Renamed the malware template id from ransomware_windows_hydracrypt for consistency (PR #16114).
  • Renamed the eol-magento template id to magento-eol to follow naming conventions (PR #16154).
  • Relocated opendcim-detect.yaml out of the non-existent http/detect folder (PR #16266).
  • Removed unused extractors from CVE-2025-13418 (PR #16204).

False Negatives
- CVE-2023-2745: removed an unnecessary authentication requirement so the template fires against unauthenticated targets (Issue #16133, PR #16139).
- CVE-2021-40438: added support for custom Interactsh server hostnames so detection no longer requires the oast* naming convention (Issue #12074, PR #16052).

False Positives
- CVE-2026-3844 (Issue #16124, PR #16161).
- CVE-2025-22457 (Issue #15955, PR #16162).
- http-missing-security-headers: dropped the clear-site-data matcher on the base URL (Issue #12008, PR #16050) and unanchored the Content-Type regexes so matches are position-independent (PR #16125).
- workspace-one-uem panel: removed a matcher that misfired on paths placed inside content="" attributes (PR #16117).

Enhancements

  • Enhanced CVE-2026-33017 by removing the redundant build_public_tmp exploit request that relied on a null flow UUID (Issue #16134, PR #16149).
  • Converted legacy http/vulnerabilities templates to CVE templates as part of the broader cleanup tracked in Issue #15275: sar2html RCE → CVE-2025-34030 (PR #16144), Cloudlog SQLi → CVE-2024-48259 (PR #16146), beward-ipcamera-disclosure → CVE-2019-25246 (PR #16248), bems-api-lfi → CVE-2021-4463 (PR #16249), ozeki-10-sms-gateway → CVE-2023-7327 (PR #16250), and watchguard credentials disclosure → CVE-2020-10532 (PR #16251).
  • Normalized classification.cwe-id metadata across HTTP exposure and misconfiguration templates (PR #16062).
  • Updated CVE-2022-0218 metadata to remove inaccurate stored-XSS framing and reflect the broken access control nature of the check (PR #16203).
  • Updated CVE-2025-62168 template (PR #16242).
  • Added the passive tag to CVE-2026-38361 (PR #16202).
  • Added redirect options to nginx-eol.yaml (PR #16199).
  • Expanded the MSSQL default-login wordlist (PR #16198).
  • Added a success-message confirmation for FTP anonymous login (PR #16197).
  • Switched the polycom-hdx-web-exposure matcher from contains_all to contains_any for broader coverage (PR #16196).
  • Added a 403 status matcher to trace-axd-detect.yaml (PR #16140).
  • Migrated the Nuclei GitHub Action workflow to native Node.js (PR #16113).

Templates Added

Read more

Contributors

roberto, geeknik, and 47 other contributors
Loading

Nuclei Templates v10.4.3 - Release Notes

Nuclei Templates v10.4.3 - Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 05 May 17:02
v10.4.3
c586483

New Templates Added: 105 | CVEs Added: 62 | First-time contributions: 12

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

  • CI: migrated nuclei GitHub action to native Node.js runtime (PR #16061, PR #16049).
  • Removed duplicate template for BeyondTrust (PR #16024).
  • Removed duplicate matcher line in roundcube-log-disclosure.yaml (PR #16042).
  • Corrected invalid cve-id classification field values across templates (PR #16023).
  • Fixed invalid CPE format strings across templates (PR #15991, PR #15828).
  • Fixed tag formatting in CVE-2024-57727, CVE-2023-38875, CVE-2023-24322 (PR #15989, PR #15897, PR #15899).
  • Corrected YAML formatting in Retool postMessage XSS template (PR #15952).
  • Fixed file path for CVE-2026-2262 (PR #15998).
  • Renamed joomla-htaccess.yaml → joomla-htaccess-file.yaml for clarity (PR #15987).
  • Renamed contrastapi-domain-recon.yaml to correct directory (PR #16025).
  • Renamed and updated superset-default-login.yaml (PR #15822).
  • Release preparation for Nuclei Templates v10.4.2 (PR #15920).

False Negatives

  • Fixed FN in tomcat-default-login by ordering payloads to avoid LockOutRealm shunning (PR #16053, Issue #15382).

False Positives

  • Reduced false positives and improved accuracy in the following templates:
    • ingress-nginx-valid-admission.yaml — added 200-status guard for verbose-debug PHP frameworks (PR #16046, Issue #14248).
    • CVE-2024-2473 — verify hidden login URL disclosure to avoid FP on WPS Hide Login (PR #15985, Issue #15871).
    • CVE-2019-5544 — fix FP triggered when port 427 is closed (PR #15979, Issue #15098).
    • CVE-2023-45648 — bound Tomcat version regex (PR #15459, Issue #15566).
    • ldap-anonymous-login-detect.yaml — honor Port parameter instead of forcing 389 (PR #15430, Issue #14736).
    • sentry-panel — added title check to prevent FP (PR #15984).

Enhancements

  • Added Microsoft domain to mx-service-detector (PR #16030).
  • Added registrar extractors to rdap-whois template (PR #15908).
  • Added references to CVE-2020-15718 (PR #16058).
  • Updated mitel-version-detect.yaml (PR #15839).
  • Linked CVE-2021-31589 to existing beyond-trust-xss.yaml (Issue #15273).

Templates Added

Read more

Contributors

umut, morgan, and 28 other contributors
Loading

Nuclei Templates v10.4.2 – Release Notes

Nuclei Templates v10.4.2 – Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 15 Apr 13:56
v10.4.2
8de8816

New Templates Added: 121 | CVEs Added: 61 | First-time contributions: 15

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

False Negatives

  • Fixed false negatives in CVE-2024-8529 (LearnPress SQLi): body matchers were unreliable for blind SQLi responses and a randstr bypass was added to defeat DB query cache (Issue #15768, PR #15844).

False Positives

  • Reduced extremely high false positives in credentials-disclosure template caused by over-permissive [\w-]+ value regex with no minimum length enforcement, flagging short UI strings like "ClientSecret":"Client" as credential leaks (Issue #15563, PR #15845).
  • Reduced false positives in the Apache ActiveMQ Artemis Console Default Login template; tightened matcher to require a valid JSON login response with expectedartemis username (Issue #15762, PR #15861).
  • Resolved false positives in molgenis-default-login template triggered by JSESSIONID cookies on custom 404 pages (Issue #12603).
  • Removed false positive subdomain takeover detection templates for Netlify, Shopify, Azure Azurewebsites, Cloudapp, and Trafficmanager - these services are no longer vulnerable due to enforced TXT verification, deprecation, or claimed namespace blocking (PR #15724).
  • Fixed false positive webpack-config detection triggered by SPA catch-all routing (PR #15869).
  • Improved CVE-2022-3254 matchers to reduce false positives on HTML error responses (PR #15840).
  • Fixed false positives in CVE-2024-52762 (PR #15833).
  • Fixed false positives in CVE-2025-49113 (PR #15777).

Enhancements

  • Refactored matchers in CVE-2024-42009 for improved detection accuracy (PR #15835).
  • Added and normalized CWE metadata across HTTP templates (PR #15804).
  • Added additional EOL version entries to end-of-life detection templates (PR #15891).
  • Updated CVE-2025-30208 detection coverage (PR #15784).

Templates Added

Read more

Contributors

sourabh, maciejklimek, and 29 other contributors
Loading

Nuclei Templates v10.4.1 – Release Notes

Nuclei Templates v10.4.1 – Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 31 Mar 11:04
v10.4.1
2d67ca1

New Templates Added: 76 | CVEs Added: 42 | First-time contributions: 10

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

False Negatives

  • Improved detection in FTP Service - Credential Weakness template, reducing underreporting (PR #15726, Issue
    #15681).
  • Addressed false negative in CVE-2024-3273 detection (Issue #15654).
  • Addressed false negative in CVE-2021-25032 detection (Issue #13647).

False Positives

Enhancements

Templates Added

Read more

Contributors

vincent, J-Run, and 24 other contributors
Loading

Nuclei Templates v10.4.0 – Release Notes

Nuclei Templates v10.4.0 – Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 16 Mar 07:17
v10.4.0
c31357c

New Templates Added: 94 | CVEs Added: 47 | First-time contributions: 12

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

False Negatives

  • Fixed exposed-svn.yaml failing to detect valid SVN repositories despite receiving 200 OK responses (Issue #15060)

False Positives

Enhancements

  • Enriched classification metadata (CVE IDs, CVSS scores, CPEs, NVD references) across multiple templates (PRs #15578, #15589, #15369, #15370, #15371)
  • Updated ClawdBot Gateway exposure template with improved detection logic (PR #15548)
  • Renamed Forcepoint Login panel template to follow naming conventions (PR #15582)

Templates Added

  • [CVE-2026-27971] Qwik - Unauthenticated RCE via server$ Deserialization (@omarkurt) [critical] 🔥
  • [CVE-2026-27944] Nginx UI < 2.3.3 - Information Disclosure (@omarkurt) [critical] 🔥
  • [CVE-2026-27645] Changedetection.io RSS Single Watch - Cross-Site Scripting (@0x_Akoko) [medium]
  • [CVE-2026-25512] Group-Office < 26.0.5 - Remote Code Execution (@omarkurt) [critical]
  • [CVE-2026-23829] Mailpit < 1.28.2 - SMTP CRLF Injection (@omarkurt) [medium]
  • [CVE-2026-2413] Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection (@Shivam Kamboj) [high]
  • [CVE-2026-1603] Ivanti Endpoint Manager - Authentication Bypass (@dhiyaneshdk, @watchtowrlabs) [high] (KEV) (vKEV) 🔥
  • [CVE-2026-1492] WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation (@omarkurt) [critical] (vKEV) 🔥
  • [CVE-2026-1357] WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload (@omarkurt) [critical] (vKEV) 🔥
  • [CVE-2026-0829] Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending (@0x_Akoko) [high]
  • [CVE-2026-0770] Langflow < 1.3.0 - Remote Code Execution via validate_code() exec() (@affix) [critical] (vKEV) 🔥
  • [CVE-2025-71243] SPIP Saisies - Remote Code Execution (@omarkurt) [critical] 🔥
  • [CVE-2025-69971] FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass (@trader642) [critical]
  • [CVE-2025-64328] FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection (@_th3y) [critical] (KEV) (vKEV) 🔥
  • [CVE-2025-62780] ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API (@0x_Akoko) [medium]
  • [CVE-2025-62613] VDO.Ninja - DOM-Based Cross-Site Scripting (@0x_Akoko) [medium]
  • [CVE-2025-54726] WordPress JS Archive List <= 6.1.5 - SQL Injection (@Shivam Kamboj) [high]
  • [CVE-2025-48281] MyStyle Custom Product Designer <= 3.21.1 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2025-40554] SolarWinds Web Help Desk - Authentication Bypass (@Bushi-gg) [critical] 🔥
  • [CVE-2025-40552] SolarWinds Web Help Desk - Authentication Bypass (@watchtowr, @dhiyaneshdk) [critical] 🔥
  • [CVE-2025-40536] SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass (@inokii) [high] (KEV) (vKEV) 🔥
  • [CVE-2025-32355] Rocket TRUfusion Enterprise - Server Side Request Forgery (@princechaddha, @rcesecurity, @dhiyaneshdk) [high]
  • [CVE-2025-27506] NocoDB < 0.258.0 - Reflected XSS in Password Reset (@0x_Akoko) [medium]
  • [CVE-2025-22785] Course Booking System <= 6.0.6 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2024-43965] SendGrid for WordPress <= 1.4 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2024-37261] WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting (@Kazgangap) [medium] (vKEV) 🔥
  • [CVE-2024-30502] WP Travel Engine <= 5.7.9 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2024-30498] CRM Perks Forms <= 1.1.4 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2024-30464] WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization (@pussycat0x) [medium]
  • [CVE-2024-12025] WordPress Collapsing Categories <= 3.0.8 - SQL Injection (@Shivam Kamboj) [high]
  • [CVE-2024-9765] EKC Tournament Manager WordPress plugin - Path Traversal (@Sourabh-Sahu) [medium]
  • [CVE-2024-9643] Four-Faith F3x36 - Authentication Bypass (@trader642) [critical] (vKEV) 🔥
  • [CVE-2024-8625] WordPress TS Poll < 2.4.0 - SQL Injection (@riteshs4hu) [high]
  • [CVE-2023-50839] JS Help Desk <= 2.8.1 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-40600] EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure (@Shivam Kamboj) [medium]
  • [CVE-2023-32590] Subscribe to Category <= 2.7.4 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-7337] JS Help Desk <= 2.8.2 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-6030] LogDash Activity Log <= 1.1.3 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-5652] WP Hotel Booking <= 2.0.7 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-5203] WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2023-3643] CAREL Boss Mini <= 1.4.0 - Local File Inclusion (@Kazgangap) [critical]
  • [CVE-2023-3452] WordPress Canto Plugin <= 3.0.4 - File Inclusion (@omarkurt) [critical] 🔥
  • [CVE-2022-44588] Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2022-1453] RSVPMaker <= 9.2.5 - SQL Injection (@Shivam Kamboj) [critical]
  • [CVE-2022-0439] Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection (@Shivam Kamboj) [high]
  • [CVE-2021-28481] Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound) (@daffainfo) [critical] (vKEV) 🔥
  • [CVE-2021-28480] Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound) (@daffainfo) [critical] 🔥
  • [apache-syncope-default-login] Apache Syncope - Default Login (@icarot) [high]
  • [circutor-default-login] Circutor Line-TCPRS1 - Default Login (@s4e-io) [high]
  • [gitness-default-login] Gitness - Default Login (@0x_Akoko) [high]
  • [carel-boss-mini-panel] CAREL Boss Mini - Login Panel Detected (@Kazgangap) [info]
  • [hpe-autopass-panel] HPE AutoPass License Server - Panel Detection (@Kylianghd) [info]
  • [recoverpoint-panel] Dell EMC RecoverPoint Panel - Detect (@rxerium) [info]
  • [ypareo-panel] YPAREO Panel - Detect (@righettod) [info]
  • [interswitch-webpay] Interswitch Webpay - Credentials Exposure (@LloydCoder) [info]
  • [paystack-secret-live] Paystack Secret/Live Key - Exposure (@LloydCoder) [info]
  • [remita-credentials] Remita Merchant ID & API Key - Exposure (@LloydCoder) [low]
  • [sportybet-api] SportyBet / BetKing Admin or API Token - Exposure (@LloydCoder) [info]
  • [wix-detect] Wix Detection (@chirag Mistry) [info]
  • [apache-syncope-detect] Apache Syncope - Detect (@icarot) [info]
  • [bentoml-detect] BentoML Prediction Service - Detection (@rxerium) [info]
  • [bigcommerce-detect] BigCommerce Detection (@chirag Mistry) [info]
  • [bitrix-detect] Bitrix Detection (@chirag Mistry) [info]
  • [blogger-detect] Blogger Detection (@chirag Mistry) [info]
  • [cloudflare-speedtest] Cloudflare Speedtest - Detect (@dhiyaneshdk) [info]
  • [comfyui...
Read more

Contributors

chirag, affix, and 32 other contributors
Loading

Nuclei Templates v10.3.9 – Release Notes

Nuclei Templates v10.3.9 – Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 16 Feb 09:25
v10.3.9
fc9d1be
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

New Templates Added: 182 | CVEs Added: 116 | First-time contributions: 7

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

False Negatives

  • Fixed false negative in CVE-2025-24963 on Linux targets (Ubuntu/Debian) due to strict /etc/passwd matching (PR #15301, Issue #15205)

False Positives

  • Reduced false positives in wp-wps-hide-login-log template that triggered on non-WordPress SPA sites (PR #15096, Issue #15089)
  • Fixed false positives in CVE-2021-35042 matcher — status_code == 500 alone was triggering on generic 500 pages (PR #15250)
  • Made matchers for weak-csp-detect more granular to avoid duplicate matching results (PR #15123)
  • Improved weak CSP detection logic, fixed matcher conditions and corrected regex typo (PR #15014)

Enhancements

  • Enhanced Cisco UCM username enumeration template to extract usernames, emails, and phone numbers added 3 new Cisco UCM templates (PR #15049)
  • Refactored Open WebUI template to make detection more generic (PR #15251)
  • Rewrote templates from RAW HTTP to normal HTTP for clustering support, saving ~150 requests per scan (PR #14743)
  • Added additional path to Tomcat detection for malformed URL error page disclosure (PR #15056)
  • Added various DNS templates — DMARC, SPF, DKIM, etc. (PR #14784)
  • Added ACME Challenge Detect template (PR #15058)

Templates Added

Read more

Contributors

morgan, righettod, and 36 other contributors
Loading

Nuclei Templates v10.3.8 – Release Notes

Nuclei Templates v10.3.8 – Release Notes

Choose a tag to compare

View all tags
@princechaddha princechaddha released this 26 Jan 12:48
v10.3.8
43df6aa

New Templates Added: 457 | CVEs Added: 43 | First-time contributions: 13

🔥 Release Highlights 🔥

What's Changed

Bug Fixes

False Negatives

  • Fixed multiple regex-based templates triggering incorrectly on valid CSS (Issue #13131)

False Positives

Enhancements

  • Updated detect-sentry.yaml with new matchers (PR #14955)

Templates Added

Read more

Contributors

shino, mahmoud, and 27 other contributors
Loading