563 matches found
CVE-2026-23483
creationtimestamp| type| source ---|---|--- 2026-04-27 12:07:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-23483.yaml...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: external-secrets-operator, xeol, rancher-agent, spqr, frp, percona-server-mongodb-operator, ratify, openbao, cert-manager-csi-driver, cert-manager-cmctl, kyverno, harbor, sftpgo-plugin-auth, flux-source-controller, gitea, trufflehog, flux, juicefs, telegraf,...
GHSA-PJCQ-XVWQ-HHPJ vulnerabilities
Vulnerabilities for packages: external-secrets-operator, xeol, rancher-agent, spqr, frp, percona-server-mongodb-operator, ratify, openbao, cert-manager-csi-driver, cert-manager-cmctl, kyverno, harbor, sftpgo-plugin-auth, flux-source-controller, gitea, trufflehog, flux, juicefs, telegraf,...
CVE-2025-59582
creationtimestamp| type| source ---|---|--- 2026-04-23 10:01:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-59582.yaml 2026-04-24 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkbgeonn2v2i...
CVE-2026-41641
creationtimestamp| type| source ---|---|--- 2026-04-23 09:48:42+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-41641.yaml 2026-04-24 21:02:32+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkbgeocyl62t 2026-05-07...
CVE-2026-41640
creationtimestamp| type| source ---|---|--- 2026-04-23 09:30:40+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-41640.yaml 2026-04-24 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkbgeo6kxw2t 2026-05-07...
CVE-2025-59136
creationtimestamp| type| source ---|---|--- 2026-04-23 07:48:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-59136.yaml 2026-04-24 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkbgeoldbm2x...
CVE-2024-32825
creationtimestamp| type| source ---|---|--- 2026-04-23 06:53:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-32825.yaml 2026-04-23 21:03:12+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwtumpd2m...
CVE-2026-41176
creationtimestamp| type| source ---|---|--- 2026-04-23 05:45:19+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-41176.yaml 2026-04-23 21:03:08+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwtcoov2g 2026-04-24...
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
A vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is...
GHSA-JM34-66CF-QPVR Nuclei: Environment variable disclosure via Response-Derived DSL Expressions
A vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens when HTTP response data containing helper/function syntax gets reused by multi-step templates. If the -env-vars / -ev option is...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the require process. An attacker can access sensitive local .js and .json files by supplying malicious JavaScript templates that exploit the module loader to bypass file access restrictions. This is only...
Nuclei: Local File Read via require() Module Loader Bypass
A vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require function, bypassing the default local file access restriction. Affected Component The issue is in the JavaScript runtime's module loading system. The goja...
GHSA-29RG-WMCW-HPF4 Nuclei: Local File Read via require() Module Loader Bypass
A vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require function, bypassing the default local file access restriction. Affected Component The issue is in the JavaScript runtime's module loading system. The goja...
CVE-2025-62039
creationtimestamp| type| source ---|---|--- 2026-04-22 16:54:21+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-62039.yaml 2026-04-23 21:03:14+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwu4jqz2i...
CVE-2021-3152
creationtimestamp| type| source ---|---|--- 2026-04-22 08:43:03+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-3152.yaml 2026-04-23 21:03:09+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk6vwthxjx2x...
PT-2026-34612
Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.7.9 Description A flaw in the expression evaluation engine allows a malicious target server to inject and execute supported Domain Specific Language DSL expressions. This occurs when HTTP response data containin...
PT-2026-34613
Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.7.9 Description A flaw in the JavaScript protocol runtime's module loading system allows JavaScript templates to read local .js and .json files from the host filesystem. This occurs because the require function...
CVE-2026-41282
A flaw was found in ProjectDiscovery Nuclei. This vulnerability allows for DSL Domain Specific Language expression injection when using environment variables for multi-step templates against untrusted targets. An attacker could exploit this by crafting malicious input, potentially leading to...
