github projectdiscovery/nuclei-templates v10.5.1
Nuclei Templates v10.5.1 - Release Notes
on GitHub

4 hours ago

New Templates Added: 68 | CVEs Added: 54 | First-time contributions: 11

🔥 Release Highlights 🔥

  • [CVE-2026-109618] PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection (@lcfr_hax, @assetnote, @princechaddha, @s4e-io) [critical] (vKEV) 🔥
  • [CVE-2026-105133] AhsayCBS - JSON API Authentication Bypass (@alex) [medium] (kev) (vKEV) 🔥
  • [CVE-2026-104935] Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header (@volexity, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-93674] Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution (@dhiyaneshdk) [critical] 🔥
  • [CVE-2026-93616] Check Point Security Management - Unauthenticated Directory Traversal to RCE (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-90898] Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution (@alex700) [critical] (vKEV) 🔥
  • [CVE-2026-85714] Stirling PDF <= 2.13.1 - H2 Database Import Remote Code Execution (@securin, @AlanNewberry) [critical] 🔥
  • [CVE-2026-76460] Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-76268] Splunk Enterprise Patroni REST API - Missing Authentication RCE (@dhiyaneshdk) [critical] 🔥
  • [CVE-2026-21589] Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read (@Kazgangap, @dhiyaneshdk, @watchtowr) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-6279] Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection (@dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2022-27925] Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal (@Popy21) [high] (kev) (vKEV) 🔥
  • [CVE-2010-0738] JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering (@securin) [critical] (kev) (vKEV) 🔥

What's Changed

Bug Fixes

  • Corrected the cve-id and reference in CVE-2026-76904, which were copy-pasted from CVE-2023-25157 and pointed at an unrelated vulnerability (PR #17332).
  • Marked the intermediate extractor in CVE-2026-33017 as internal: true so its value is used for the follow-up request instead of being reported as a finding (PR #17413).
  • Fixed the tag placement in CVE-2026-22778 so the metadata block parses correctly (PR #17490).
  • Repaired reference links across several templates (hikvision-env, CVE-2021-24215/24235/24237/24335, and the AEM dispatcher and KISA guide references) that were not valid URIs (PR #17378).
  • Normalized the author field to Securin across the Securin-contributed templates, including CVE-2017-7504, CVE-2019-11043, and CVE-2020-10221 (PR #17487).

False Negatives

  • CVE-2017-5638: fixed the OGNL payload that failed on stock Struts 2.3.x because of the null DEFAULT_MEMBER_ACCESS, so the Struts RCE template fires on affected 2.3.x builds (PR #17273).
  • CVE-2024-12849: removed the homepage fingerprint gate in http(1) that never matched, since the Error Log Viewer plugin is admin-only and never appears on the frontend, which meant the exploit request was never sent (PR #17334).
  • CVE-2026-34486: taught the template to honor host:port targets, with the fallback to port 4000 preserved (PR #17275).

False Positives

  • CVE-2017-12617 (and CVE-2017-12615): stopped the Tomcat JSP upload templates from matching on fixed echo strings, which produced false positives (PR #17370).
  • CVE-2025-29927: hardened the Next.js middleware-bypass template so it no longer fires on generic 302 → /unauthorized redirects without a real middleware rewrite header (PR #17286).
  • CVE-2026-72898: reworked the flow and matchers so the template no longer reports on patched Metabase versions (PR #17411, Issue #17409).
  • keycloak-openid-config: required Keycloak-specific markers so the template stops matching on non-Keycloak OIDC discovery endpoints (PR #17344).
  • xff-403-bypass: added a third no-XFF request to confirm the bypass, instead of treating any non-403 response as a successful 403 bypass (PR #17352).
  • CVE-2024-10763: revised the detection logic and matchers to resolve the reported false positives (PR #17377, Issue #17374).
  • dell-dpi-default-login: fixed the title matcher casing and switched to evaluating both authentication responses together so the login page matches correctly (PR #17395).
  • bitbucket-pipelines: excluded text/html responses so catch-all HTML error and SPA index pages no longer trigger the config-exposure template (PR #17476).

Enhancements

  • rabbitmq-dashboard: added unauthenticated version detection using the /api/version endpoint, which returns the exact RabbitMQ version without auth (PR #17354).
  • CVE-2024-51483: refactored the changedetection.io LFI template to be non-destructive, restoring the original settings and cleaning up the quickwatch it creates (PR #17007).
  • ldap-metadata and ldap-anonymous-login-detect: extended to handle LDAPS (LDAP over TLS) (PR #17382, Issue #17373).
  • generic-linux-lfi: added additional LFI bypass payloads (PR #17412, Issue #17390).
  • jenkins-login: added new Jenkins login titles and fingerprints (PR #17397, PR #17408).
  • php-detect: reworked to a raw request that follows redirects, improving PHP detection on sites that redirect the root path (PR #17461).

Templates Added

  • [CVE-2026-110372] WordPress OttoKit Plugin <= 1.1.40 - Unauthenticated Privilege Escalation via connection-denied Token (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2026-109618] PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection (@lcfr_hax, @assetnote, @princechaddha, @s4e-io) [critical] (vKEV) 🔥
  • [CVE-2026-108578] Neterbit NW-431F - Unauthenticated SMS Disclosure (@0x_Akoko) [medium]
  • [CVE-2026-105133] AhsayCBS - JSON API Authentication Bypass (@alex) [medium] (kev) (vKEV) 🔥
  • [CVE-2026-104935] Ivanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header (@volexity, @dhiyaneshdk) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-103956] Loom for AWS < 1.6.1 - Unauthenticated Super-Admin Access (@comradezephyr) [critical]
  • [CVE-2026-94169] The Grid <= 2.8.1 - Unauthenticated Code Injection (@0x_Akoko) [critical] (vKEV)
  • [CVE-2026-93674] Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution (@dhiyaneshdk) [critical] 🔥
  • [CVE-2026-93616] Check Point Security Management - Unauthenticated Directory Traversal to RCE (@0x_Akoko, @pdteam) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-91136] Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read (@HaroonArshad-53) [high] (vKEV)
  • [CVE-2026-90898] Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution (@alex700) [critical] (vKEV) 🔥
  • [CVE-2026-90817] REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru (@sudo-a-man) [critical] (vKEV)
  • [CVE-2026-90774] rustypaste < 0.18.1 - Filename Header Path Traversal (@carfeii) [high]
  • [CVE-2026-86242] Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch (@alex700) [high]
  • [CVE-2026-85714] Stirling PDF <= 2.13.1 - H2 Database Import Remote Code Execution (@securin, @AlanNewberry) [critical] 🔥
  • [CVE-2026-85097] Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2026-82186] WordPress WPLP Cookie Consent < 4.4.2 - SQL Injection (@anirbala98) [medium]
  • [CVE-2026-80462] Chef Automate API Gateway - Authentication Bypass (@wong-hau-pepelu) [critical]
  • [CVE-2026-76460] Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass (@0x_Akoko) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-76268] Splunk Enterprise Patroni REST API - Missing Authentication RCE (@dhiyaneshdk) [critical] 🔥
  • [CVE-2026-72867] Dokploy <= 0.29.12 - Authenticated RCE via Command Injection (@dhiyaneshdk) [critical]
  • [CVE-2026-69137] SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF (@EntroVyx) [high]
  • [CVE-2026-66914] SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal (@het Kalariya) [critical]
  • [CVE-2026-63358] FileGator < 7.14.2 - Privilege Escalation (@moizxsec) [high]
  • [CVE-2026-56070] Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection (@abdullah Shahid (comradezephyr)) [critical]
  • [CVE-2026-54617] GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read (@str4k3r) [critical]
  • [CVE-2026-52715] GEO my WP <= 4.5.5 - Unauthenticated SQL Injection (@HaroonArshad-53) [critical]
  • [CVE-2026-49772] The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection (@HaroonArshad-53) [critical] (vKEV)
  • [CVE-2026-42564] jotty.page < 1.22.0 - Path Traversal (@Het-Kalariya) [high]
  • [CVE-2026-33425] Discourse - Private Group Membership Inference via exclude_groups (@str4k3r) [medium]
  • [CVE-2026-27934] Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure (@str4k3r) [high]
  • [CVE-2026-27604] FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass (@str4k3r) [critical]
  • [CVE-2026-26077] Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery (@str4k3r) [medium]
  • [CVE-2026-21589] Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read (@Kazgangap, @dhiyaneshdk, @watchtowr) [critical] (kev) (vKEV) 🔥
  • [CVE-2026-19089] Product Input Fields for WooCommerce < 2.0.2 - Arbitrary File Upload to RCE (@het Kalariya) [critical]
  • [CVE-2026-18937] WordPress Broken Link Checker < 2.4.12 - Remote Code Execution (@anirbala98) [critical]
  • [CVE-2026-18315] TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass (@0x_Akoko) [critical] (vKEV)
  • [CVE-2026-18143] Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload (@0x_Akoko, @pdteam) [critical] (vKEV)
  • [CVE-2026-15015] MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure (@dhiyaneshdk) [critical] (vKEV)
  • [CVE-2026-14870] WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting (@anirbala98) [high]
  • [CVE-2026-12800] Premium Packages – Sell Digital Products Securely - SQL Injection (@HaroonArshad-53) [high]
  • [CVE-2026-12741] WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection (@abdullah Shahid (comradezephyr)) [high]
  • [CVE-2026-12609] Eclipse Theia - Unauthenticated Path Traversal (@str4k3r) [high]
  • [CVE-2026-10818] WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload (@i-am-paradox) [high] (vKEV)
  • [CVE-2026-9833] WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting (@anirbala98) [high]
  • [CVE-2026-8089] WordPress weMail < 2.1.3 - Cross-Site Scripting (@anirbala98) [high]
  • [CVE-2026-6495] WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting (@anirbala98) [high]
  • [CVE-2026-6377] Next4Biz CSM - Arbitrary File Read via DownloadFileHandler (@1dayexploit) [high]
  • [CVE-2026-6279] Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection (@dhiyaneshdk) [critical] (vKEV) 🔥
  • [CVE-2026-4883] Piotnet Forms Pro <= 2.1.40 - Unauthenticated Arbitrary File Upload RCE (@0x_Akoko, @xShadow-Here) [critical] (vKEV)
  • [CVE-2024-54772] MikroTik WinBox <= 6.49.17 - Username Enumeration (@abdo342003) [medium]
  • [CVE-2022-28108] Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution (@t0xk) [critical]
  • [CVE-2022-27925] Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal (@Popy21) [high] (kev) (vKEV) 🔥
  • [CVE-2010-0738] JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering (@securin) [critical] (kev) (vKEV) 🔥
  • [apache-skywalking-default-login] Apache SkyWalking Horizon UI - Default Login (@icarot) [high]
  • [caldera-default-login] MITRE Caldera - Default Login (@s4e-io) [high]
  • [hermes-agent-panel] Hermes Agent Login Panel - Detect (@rxerium) [info]
  • [apache-skywalking-horizon-ui-config] Apache SkyWalking Horizon UI - Config Exposure (@icarot) [low]
  • [apache-skywalking-horizon-ui-detect] Apache SkyWalking Horizon UI - Detect (@icarot) [info]
  • [astro-detect] Astro Framework - Detect (@iamkunal9) [info]
  • [paperclip-detect] Paperclip - Detect (@rxerium) [info]
  • [ruoyi-detect] RuoYi Detect (@xiangdangloser) [info]
  • [wowza-streaming-engine-detect] Wowza Streaming Engine - Detect (@dhiyaneshdk) [info]
  • [glpi-planning-user-enum] GLPI Planning - Unauthenticated Username Enumeration (@wong-hau-pepelu) [medium]
  • [gost-socks5-detect] GO Simple Tunnel (GOST) SOCKS5 - Detect (@darses) [info]
  • [gost-ssh-detect] GO Simple Tunnel (GOST) SSH Listener - Detect (@darses) [info]
  • [mikrotik-routeros-winbox] MikroTik WinBox Service - Detect (@abdo342003) [info]
  • [emudhra-compromised-ca] eMudhra - Compromised Intermediate CA Certificate - Detection (@dhiyaneshdk) [critical]

New Contributors

Check out latest releases or
releases around projectdiscovery/nuclei-templates v10.5.1

Don't miss a new nuclei-templates release

NewReleases is sending notifications on new releases.

Get notifications