cve-threat-intelligence-hub

cve · threat-intelligence · vulnerabilities · cisa-kev · epss ·...

GO-2026-6577 Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei...

GO-2026-6574 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

PT-2026-105594

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei...

PT-2026-105593

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

PT-2026-105589

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei...

CVE-2026-27454

creationtimestamp| type| source ---|---|--- 2026-09-15 09:00:14+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-27454.yaml...

CVE-2026-87820

creationtimestamp| type| source ---|---|--- 2026-09-10 06:00:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-87820.yaml 2026-09-11 00:00:04+00:00| confirmed|...

CVE-2026-41282: Improper Control of Generation of Code

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets not the default configuration...

Arbitrary Code Execution

github.com/projectdiscovery/nuclei is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation of signed workflows within the parseWorkflowTemplate function in workflows.go, which allows the execution of unsigned code templates through workflows...

CVE-2024-27920 Unsigned code template execution through workflows in projectdiscovery/nuclei

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...

CVE-2024-27920: Improper Neutralization of Special Elements used in an OS Command

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing cust...

CVE-2021-25864

creationtimestamp| type| source ---|---|--- 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-25864.yaml 2026-06-23 14:06:19+00:00| exploited|...