Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the -env-vars process when multi-step templates are used against untrusted targets. An attacker can execute arbitrary code by injecting malicious DSL expressions. This is only exploitable if multi-step...

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-41282

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-41282

Summary: CVE-2026-41282 affects ProjectDiscovery Nuclei prior to 3.8.0, where DSL expression injection is possible when using -env-vars for multi-step templates against untrusted targets configured non-defaultly. The Red Hat advisory describes a flaw enabling DSL injection that could lead to unau...

CVE-2021-26947

creationtimestamp| type| source ---|---|--- 2026-04-20 05:29:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-26947.yaml...

Nuclei 安全漏洞

Nuclei is a fast-customizable vulnerability scanner based on simple YAML, open-sourced by ProjectDiscovery. Versions of Nuclei prior to 3.8.0 have security vulnerabilities, which stem from DSL expression injection and may affect the use of multi-step templates...

PT-2026-33724

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

CVE-2026-2262

creationtimestamp| type| source ---|---|--- 2026-04-18 01:18:04+00:00| published-proof-of-concept| Telegram/u5f3Gra6Haipf3VJEB4yu-gwc95-0FLxvYnhbIvKSTo7fn8 2026-04-21 03:41:01+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/CVE-2026-2262.yaml 2026-04-22...

CVE-2026-40887

creationtimestamp| type| source ---|---|--- 2026-04-17 06:31:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-40887.yaml 2026-04-19 21:03:03+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mjuu2zdoll2i 2026-04-21...

CVE-2026-21484

creationtimestamp| type| source ---|---|--- 2026-04-15 06:48:35+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-21484.yaml 2026-04-17 21:02:33+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mjpt4bq5ps2r...

CVE-2026-4106

creationtimestamp| type| source ---|---|--- 2026-04-12 01:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/79929 2026-04-12 02:46:41+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-4106.yaml 2026-04-12 03:00:07+00:00|...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cilium-envoy, terraform-provider-sendgrid, external-secrets-operator, ingress-nginx-controller, pulumi-language-java, grafana-rollout-operator, coredns, trivy, newrelic-fluent-bit-output, wal-g, vault-env, prometheus-pushgateway, k8ssandra-operator, openbao,...

GHSA-XMRV-PMRH-HHX2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, gomplate, steampipe, guac, crossplane-provider-family-aws, crossplane-provider-aws-firehose, vault-env, crossplane-provider-aws-cloudformation, docker, vitess, task, cloudprober, eksctl, telegraf, gitaly, rclone, teleport,...

GHSA-XMRV-PMRH-HHX2 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator-fips, terraform-fips, crossplane-provider-aws-cloudformation-fips, kyverno-policy-reporter-fips, docker, zarf-fips, longhorn-engine, grafana-alloy, agentbeat, crossplane-provider-aws-elbv2, pulumi, kubeflow-pipelines, litestream,...

CVE-2023-6825

creationtimestamp| type| source ---|---|--- 2026-04-08 14:00:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-6825.yaml 2026-04-10 21:03:06+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mj67urtpyt27...

CVE-2026-25616

creationtimestamp| type| source ---|---|--- 2026-04-08 04:11:57+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-25616.yaml 2026-04-10 21:03:15+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mj67usncez2x...

CVE-2026-39987

creationtimestamp| type| source ---|---|--- 2026-04-08 04:00:00+00:00| published-proof-of-concept| https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc 2026-04-09 04:00:00+00:00| exploited|...