Starstruk Logo MarkStarstruk

v10.4.1

GraphiteEditor/Graphitev10.4.1Mar 31, 2026by princechaddha

AI Summary

Added 76 new templates and 42 CVEs, addressing critical bugs in detection logic for services like Budibase and MindsDB, and reducing false positives.

Key Highlights

  • Added 76 new templates and 42 CVEs
  • Critical vulnerabilities in Budibase, MindsDB, and Spring Cloud
  • Fixed invalid hostname generation and extractor DSL bugs
  • Reduced false positives for multiple detection templates

New Features

  • New templates for CVE-2026-31816 (Budibase), CVE-2026-27483 (MindsDB), CVE-2026-21445 (Langflow), and others

Full Release Notes

### New Templates Added: `76` | CVEs Added: `42` | First-time contributions: `10`

### 🔥 Release Highlights 🔥
- [CVE-2026-32596] Glances - Information Disclosure (@theamanrawat) [high] 🔥
- [CVE-2026-31816] Budibase - Authentication Bypass (@theamanrawat) [critical] 🔥
- [CVE-2026-27483] MindsDB - Remote Code Execution (@thewhiteh4t) [high] 🔥
- [CVE-2026-24477] AnythingLLM - Information Disclosure (@DhiyaneshDk) [high] 🔥
- [CVE-2026-22739] Spring Cloud Config Server - Path Traversal (@0x_Akoko, @vulnh0lic) [high] 🔥
- [CVE-2026-21445] Langflow - Broken Access Control (@DhiyaneshDk) [critical] 🔥
- [CVE-2026-3055] Citrix NetScaler SAML IDP - Memory Overread (@watchtowr, @shaikhyaser, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-1581] wpForo Forum <= 2.4.14 - SQL Injection (@Shivam Kamboj) [critical] (kev) (vKEV) 🔥
- [CVE-2025-71260] BMC FootPrints - Deserialization of Untrusted Data (RCE) (@watchTowr, @DhiyaneshDk) [critical] 🔥
- [CVE-2025-68043] LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization (@pussycat0x) [high] 🔥
- [CVE-2025-32463] Sudo - Local Privilege Escalation via chroot (@SeungAh-Hong) [critical] (kev) (vKEV) 🔥
- [CVE-2025-14437] WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File (@pussycat0x) [high] 🔥
- [CVE-2025-6984] langchain-ai langchain - XML External Entity Injection (@nukunga) [high] 🔥
- [CVE-2025-5947] Service Finder Bookings - Authentication Bypass (@sedat4ras) [critical] (kev) (vKEV) 🔥
- [CVE-2024-43144] Cost Calculator Builder <= 3.2.15 - SQL Injection (@Shivam Kamboj) [critical] 🔥
- [CVE-2023-34092] Vite Dev Server - Information Exposure (@ritikchaddha) [high] 🔥

## What's Changed

**Bug Fixes**
  - Fixed invalid hostname generation affecting template execution (PR https://github.com/projectdiscovery/nuclei-templates/pull/15641, Issue https://github.com/projectdiscovery/nuclei-templates/issues/15624).
  - Fixed extractor DSL by adding a missing condition (PR https://github.com/projectdiscovery/nuclei-templates/pull/15729).                                                                                        
  - Moved CVE-2026-23829 from http to the correct network folder (PR https://github.com/projectdiscovery/nuclei-templates/pull/15738, Issue https://github.com/projectdiscovery/nuclei-templates/issues/15633).    
  - Fixed reference URLs in CVE-2025-66516 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15646). 
 
**False Negatives**
  - Improved detection in FTP Service - Credential Weakness template, reducing underreporting (PR https://github.com/projectdiscovery/nuclei-templates/pull/15726, Issue
  https://github.com/projectdiscovery/nuclei-templates/issues/15681).                                                                                                                                              
  - Addressed false negative in CVE-2024-3273 detection (Issue https://github.com/projectdiscovery/nuclei-templates/issues/15654).
  - Addressed false negative in CVE-2021-25032 detection (Issue https://github.com/projectdiscovery/nuclei-templates/issues/13647).
  
**False Positives**
  - Reduced false positives and improved accuracy in the following templates:
    - CVE-2025-71243 — excluded pages that echo back user input (PR https://github.com/projectdiscovery/nuclei-templates/pull/15665).                                                                              
    - CVE-2025-66516 — tightened matcher logic (PR https://github.com/projectdiscovery/nuclei-templates/pull/15581).                                                                                               
    - CVE-2023-5652 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15622).                                                                                                                          
    - CVE-2023-7337 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15620).                                                                                                                          
    - CVE-2022-21587 — added matchers-condition: and (PR https://github.com/projectdiscovery/nuclei-templates/pull/15621).                                                                                         
    - CVE-2009-1872 ColdFusion fingerprint (PR https://github.com/projectdiscovery/nuclei-templates/pull/15601).                                                                                                   
    - CVE-2002-1131 SquirrelMail fingerprint (PR https://github.com/projectdiscovery/nuclei-templates/pull/15595).                                                                                                 
    - CVE-2021-35042 (Issue https://github.com/projectdiscovery/nuclei-templates/issues/15241).                                                                                                                    
    - flexnet-operations-panel — reduced high false positive rate (PR https://github.com/projectdiscovery/nuclei-templates/pull/15600).                                                                            
    - mercurial-hgignore — added text/xml and <?xml to negative matchers (PR https://github.com/projectdiscovery/nuclei-templates/pull/15623).                                                                     
    - aws-bucket-takeover — excluded S3 account regional namespace buckets (PR https://github.com/projectdiscovery/nuclei-templates/pull/15608).                                                                   
    - hubspot-takeover — switched to header-based detection for NotFoundResolver (PR https://github.com/projectdiscovery/nuclei-templates/pull/15583). 

**Enhancements**
  - Enriched classification metadata and renamed CVE-2020-15718 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15677).
  - Updated classification metadata for CVE-2024-55550 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15666).                                                                                       
  - Updated classification metadata for CVE-2024-13726 (PR https://github.com/projectdiscovery/nuclei-templates/pull/15648).                                                                                       
  - Updated apache-activemq-artemis-detect.yaml detection logic (PR https://github.com/projectdiscovery/nuclei-templates/pull/15717).                                                                              
  - Applied AI-assisted tagging improvements across multiple templates (PR https://github.com/projectdiscovery/nuclei-templates/pull/15571).                                                                                                                                 

## Templates Added
- [CVE-2026-33868] Mastodon - Open Redirect (@theamanrawat) [medium] 🔥
- [CVE-2026-32596] Glances - Information Disclosure (@theamanrawat) [high] 🔥
- [CVE-2026-32583] Webnus Inc. Modern Events Calendar - Broken Access Control (@theamanrawat) [medium] 🔥
- [CVE-2026-31816] Budibase - Authentication Bypass (@theamanrawat) [critical] 🔥
- [CVE-2026-30928] Glances - Information Disclosure (@theamanrawat) [high] 🔥
- [CVE-2026-28288] Dify User Enumeration via Observable Response Discrepancy (@DhiyaneshDk) [medium] 🔥
- [CVE-2026-27483] MindsDB - Remote Code Execution (@thewhiteh4t) [high] 🔥
- [CVE-2026-24477] AnythingLLM - Information Disclosure (@DhiyaneshDk) [high] 🔥
- [CVE-2026-22739] Spring Cloud Config Server - Path Traversal (@0x_Akoko, @vulnh0lic) [high] 🔥
- [CVE-2026-21445] Langflow - Broken Access Control (@DhiyaneshDk) [critical] 🔥
- [CVE-2026-3055] Citrix NetScaler SAML IDP - Memory Overread (@watchtowr, @shaikhyaser, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-2025] Mail Mint < 1.19.5 - Unauthenticated Email Disclosure (@0x_Akoko) [high]
- [CVE-2026-1581] wpForo Forum <= 2.4.14 - SQL Injection (@Shivam Kamboj) [critical] (kev) (vKEV) 🔥
- [CVE-2026-1557] WP Responsive Images <= 1.0 - Arbitrary File Read (@Shivam Kamboj) [high]
- [CVE-2026-1405] WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload (@pussycat0x) [critical]
- [CVE-2026-1306] WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload (@pussycat0x) [critical]
- [CVE-2026-1296] Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect (@Shivam Kamboj) [medium]
- [CVE-2026-1277] URL Shortify <= 1.12.1 - Open Redirect (@Shivam Kamboj) [medium]
- [CVE-2026-0926] Prodigy Commerce <= 3.3.0 - Local File Inclusion (@Shivam Kamboj) [critical]
- [CVE-2025-71260] BMC FootPrints - Deserialization of Untrusted Data (RCE) (@watchTowr, @DhiyaneshDk) [critical] 🔥
- [CVE-2025-71259] BMC FootPrints 'feedUrl' - Server-Side Request Forgery (@watchTowr, @DhiyaneshDk) [high] 🔥
- [CVE-2025-71258] BMC FootPrints 'searchWeb' - Server-Side Request Forgery (@watchTowr, @DhiyaneshDk) [high] 🔥
- [CVE-2025-71257] BMC FootPrints - Authentication Bypass (@watchTowr, @DhiyaneshDk) [medium] 🔥
- [CVE-2025-68602] Accept Donations with PayPal <= 1.5.2 - Open Redirect (@Shivam Kamboj) [medium]
- [CVE-2025-68043] LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization (@pussycat0x) [high] 🔥
- [CVE-2025-62512] Piwigo - User Enumeration via Password Reset (@DhiyaneshDk) [medium] 🔥
- [CVE-2025-62126] WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure (@pussycat0x) [medium]
- [CVE-2025-59716] ownCloud Guests - User Enumeration (@DhiyaneshDk) [medium] 🔥
- [CVE-2025-58044] JumpServer - Open Redirect via Referer Header (@DhiyaneshDk) [medium] 🔥
- [CVE-2025-54793] Astro SSR - Open Redirect (@DhiyaneshDk) [medium] 🔥
- [CVE-2025-46565] Vite Dev Server - Information Exposure (@ritikchaddha) [medium] 🔥
- [CVE-2025-32463] Sudo - Local Privilege Escalation via chroot (@SeungAh-Hong) [critical] (kev) (vKEV) 🔥
- [CVE-2025-14437] WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File (@pussycat0x) [high] 🔥
- [CVE-2025-13920] WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure (@0x_Akoko) [medium]
- [CVE-2025-6984] langchain-ai langchain - XML External Entity Injection (@nukunga) [high] 🔥
- [CVE-2025-5947] Service Finder Bookings - Authentication Bypass (@sedat4ras) [critical] (kev) (vKEV) 🔥
- [CVE-2025-4576] Liferay Portal & DXP - Cross-Site Scripting (@xtr0nix) [medium] 🔥
- [CVE-2024-57241] DedeCMS - Open Redirect via download.php (@0x_Akoko) [medium]
- [CVE-2024-43144] Cost Calculator Builder <= 3.2.15 - SQL Injection (@Shivam Kamboj) [critical] 🔥
- [CVE-2023-34092] Vite Dev Server - Information Exposure (@ritikchaddha) [high] 🔥
- [CVE-2022-1692] CP Image Store with Slideshow <= 1.0.67 - SQL Injection (@Shivam Kamboj) [critical]
- [CVE-2020-15718] RosarioSIS 6.7.2 - Cross-Site Scripting (@0xr2r, @jarvis-survives) [medium]
- [unquoted-service-paths] Unquoted Service Paths (@domwhewell-sage) [high]
- [alfresco-default-login] Alfresco - Default Admin Credentials (@0x_Akoko) [high]
- [apache-polaris-default-login] Apache Polaris - Default Login (@icarot) [high]
- [brickcom-camera-default-login] Brickcom Camera - Default Login (@0x_Akoko) [high]
- [casdoor-default-login] Casdoor - Default Admin Credentials (@0x_Akoko) [high]
- [doccano-default-login] Doccano - Default Login (@0x_Akoko) [high]
- [harbor-default-login] Harbor Registry - Default Admin Credentials (@0x_Akoko) [high]
- [homebridge-default-login] Homebridge - Default Admin Credentials (@0x_Akoko) [high]
- [ilias-default-login] ILIAS LMS - Default Admin Credentials (@0x_Akoko) [high]
- [limesurvey-default-login] LimeSurvey - Default Admin Credentials (@0x_Akoko) [high]
- [ntopng-default-login] ntopng - Default Login (@0x_Akoko) [high]
- [openproject-default-login] OpenProject - Default Admin Credentials (@0x_Akoko) [high]
- [pfsense-default-login] pfSense - Default Admin Credentials (@0x_Akoko) [high]
- [redmine-default-login] Redmine - Default Admin Credentials (@0x_Akoko) [high]
- [xerox-default-login] Xerox Fuji/VersaLink - Default Login (@DhiyaneshDk) [high]
- [arcane-login-panel] Arcane Login Panel - Detect (@Kazgangap) [info]
- [budibase-login-detect] Budibase Login Panel - Detect (@theamanrawat) [info]
- [odoo-website-info-exposure] Odoo Website - Information Disclosure (@aushack) [info]
- [xerox-panel] Xerox Fuji/VersaLink Login - Panel (@DhiyaneshDk) [info]
- [apache-polaris-metrics-exposure] Apache Polaris - Information Disclosure (@icarot) [medium]
- [remote-spark-gateway-config] Remote Spark Gateway Configuration/Credentials - Exposure (@domwhewell-sage) [medium]
- [google-gemini-key-exposure] Google Gemini API Key - Exposure (@Mestizo) [high]
- [brickcom-camera-unauth-snapshot] Brickcom Camera - Unauthenticated Snapshot Access (@0xr2r) [high]
- [graphiql-exposure] GraphiQL - Exposure (@Vincent Olagbemide) [low]
- [ghost-cms-installer] Ghost CMS Installation Setup - Exposure (@0x_Akoko) [high]
- [mistserver-installer] MistServer Installation Wizard - Exposure (@DhiyaneshDk) [high]
- [synology-dsm-system-info] Synology DSM System Info - Detect (@DhiyaneshDk) [info]
- [confluence-eol] Atlassian Confluence End-of-Life - Detect (@Shivam Kamboj) [info]
- [forgejo-eol] Forgejo End-of-Life - Detect (@Shivam Kamboj) [info]
- [leantime-detect] Leantime - Detect (@icarot) [info]
- [litellm-swagger-detect] LiteLLM API - Swagger UI Detection (@rxerium) [info]
- [rustfs-detect] Rustfs - Detect (@icarot) [info]
- [wyse-devicegroup-register] Dell Wyse Management Suite - Unauthenticated Device Registration (@DhiyaneshDK) [high]
- [sanhuismg-radius-rce] Synway SMG Gateway 9-2radius.php - Remote Command Execution (@Chenkh) [critical]

## New Contributors
* @thewhiteh4t made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15568
* @vincentayorinde made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15615
* @J-Run made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15600
* @jarvis-survives made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15309
* @venjaku made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15608
* @SrFlipFlop made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15583
* @mestizo made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15652
* @xtronix2000 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15706
* @whatyourname12345 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15661
* @sedat4ras made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15656

**Full Changelog**: https://github.com/projectdiscovery/nuclei-templates/compare/v10.4.0...v10.4.1