v10.4.7

### New Templates Added: `122` | CVEs Added: `49` | First-time contributions: `23`

### 🔥 Release Highlights 🔥
- [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion (@slcyber, @mielverkerken, @pdteam, @flx-0x00) [critical] (kev) (vKEV) 🔥
- [CVE-2026-60004] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥
- [CVE-2026-58455] Dockwatch <= 0.6.567 - OS Command Injection (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-56291] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload (@Nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-56290] Page Builder CK <= 3.5.10 - Unauth File Upload (@panchiko-p, @0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-48908] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-46442] Flowise < 3.1.2 - node-custom-function Unauth RCE (@DhiyaneshDk, @princechaddha) [critical] (kev) (vKEV) 🔥
- [CVE-2026-44825] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials (@pdteam, @0x_Akoko) [high] (kev) (vKEV) 🔥
- [CVE-2026-16232] Check Point Security Management Server - SmartConsole Authentication Bypass (@sfewer-r7, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-15409] SonicWall SMA1000 - Server-Side Request Forgery (@DhiyaneshDk, @rapid7) [critical] (kev) (vKEV) 🔥
- [CVE-2026-9282] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥
- [CVE-2026-8732] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-8713] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥
- [CVE-2026-6875] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE (@pdteam, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-3296] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2025-71334] Flowise - Path Traversal (@theamanrawat) [critical] (kev) (vKEV) 🔥
- [CVE-2025-68493] Apache Struts XWork - XML External Entity Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
- [CVE-2025-54988] Apache Tika - XXE Injection (@tx1ee) [critical] 🔥
- [CVE-2025-6389] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2025-2505] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion (@pussycat0x) [critical] (kev) (vKEV) 🔥
- [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal (@ChrisJr404) [critical] 🔥
- [CVE-2023-34992] Fortinet FortiSIEM - Unauth Command Injection (@thacien) [critical] 🔥

## What's Changed

**Bug Fixes**
* Stopped credential-stuffing and token-spray templates from sending their first request when no username, password or token is supplied (PR #16589, Issue #11238).
* Restored missing matcher and extractor values in four templates that silently no-op'd, including CVE-2021-44228, CVE-2021-45046 and CVE-2026-42281 (PR #16661).
* Replaced an unsupported RE2 lookahead that stopped home-env-permission.yaml from loading at all (PR #16664).
* Added the missing capture group to three regex extractors (PR #16665).
* Corrected the extractor part in portal-api-ssrf from interactsh to interactsh_request (PR #16667).
* Corrected the DSL variable in thinkphp6-arbitrary-write from status_2 to status_code_2 (PR #16668).
* Unhid two extractors marked internal that nothing consumed (PR #16669).
* Marked the setup-stage matchers in CVE-2025-2075 as internal (PR #16671).
* Removed an AWS access key ID from a reference URL in CVE-2024-51482.yaml (PR #16616).
* Fixed an intrusive tag typo in CVE-2023-34124.yaml (PR #16675).
* Corrected the id and filename for the IBM DB2 Server template (PR #16688).
* Fixed the severity in directory-listing-no-host-header.yaml (PR #16614).
* Corrected the author field for CVE-2024-23108 (PR #16620).
* Moved CVE-2025-29635 from javascript to http to fix its classification (PR #16636).
* Moved CVE-2021-27877.yaml to the correct folder (PR #16591).
* Renamed Wix-detect.yaml to wix-detect.yaml (PR #16731) and renamed a CVE file to match the naming convention (PR #16730).
* Renamed CVE-2021-45046 to CVE-2021-45046-DAST (PR #16685) and smb-default-creds to smb-default-login (PR #16592).
* Removed superseded and redundant templates: geovision-geowebserver-lfi.yaml (PR #16687), geovision-geowebserver-xss.yaml (PR #16686) and config-json.yaml (PR #16680).
 
**False Negatives**
* Fixed mongodb-unauth failing on MongoDB 6.0+ by switching from the removed OP_QUERY opcode to OP_MSG (PR #16454, Issue #16294).
* Fixed CVE-2026-23550 missing WordPress canonical redirects that carry a trailing slash (PR #16566, Issue #16554).
* Improved CVE-2026-63030 with safe route-confusion detection (PR #16658, Issue #16629).
* Reduced false negatives in the exposed-zookeeper template (PR #16579, Issue #11076).
* Extended the unauthenticated-jenkins matcher to cover both dashboard title variants (PR #16575).
* Fixed the langfuse-panel health matcher, which checked the wrong response part (PR #16574).
* Updated twitter-phish.yaml matchers to the current X/Twitter login page markup (PR #16362).
  
**False Positives**
* Reduced false positives and improved accuracy in the following templates:
* nfs-v3-exposed, which treated an RPC PROG_UNAVAIL reply as a valid hit (PR #16672, Issue #16662).
* Mailpit < 1.28.2 SMTP CRLF injection, CVE-2026-23829 (PR #16580, Issue #16576).
* CVE-2025-32969, by removing an incorrect content_type matcher (PR #16704).
* CVE-2023-50839, by adding a plugin fingerprint before flagging (PR #16526).
* kiali-panel (PR #16628).
* dameng-detect, switched to a positive signature (PR #16468).
* open-proxy-portscan, now rejects HTML bodies returned by WAFs (PR #16588).

**Enhancements**
* Refactored airflow-detect.yaml to add an /openapi.json check with stop-at-first-match (PR #16703).
* Added body fuzzing plus POST/PUT method support to the DAST templates (PR #15947).
* Reworked CVE-2024-22476 into a flow-based check with randomised markers (PR #16590).
* Improved the CVE-2026-63030 request payload and tightened its matchers (PR #16682).
* Updated htaccess-config.yaml with .htaccess.bak, .txt and .old paths, dropping stale ones (PR #16706).
* Enriched four Perforce templates with CVE-2026-6043 metadata and references (PR #16349).
* Converted geovision-geowebserver LFI/XSS templates to CVE-2021-47795 (PR #16160, Issue #15275).
* Converted the Bitrix open redirect template to CVE-2008-2052 (PR #16301, Issue #15275).
* Updated the Wix subdomain takeover fingerprint (PR #16551).
* Added the Arista VeloCloud favicon hash to favicon-detect (PR #16677).
* Updated tags in CVE-2026-16232.yaml (PR #16689).                                                                                                       

## Templates Added
- [CVE-2026-65694] Microweber CMS <= 2.0.20 - Unauth Arbitrary File Read (@0x_Akoko, @abdugafforov-bobur) [high]
- [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion (@slcyber, @mielverkerken, @pdteam, @flx-0x00) [critical] (kev) (vKEV) 🔥
- [CVE-2026-60004] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥
- [CVE-2026-58455] Dockwatch <= 0.6.567 - OS Command Injection (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-56291] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload (@Nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-56290] Page Builder CK <= 3.5.10 - Unauth Arbitrary File Upload (@panchiko-p, @0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-55450] Langflow < 1.9.1 - Unauth File Upload (@xtr0nix) [critical]
- [CVE-2026-54836] YMC Filter - SQL Injection (@theamanrawat) [critical]
- [CVE-2026-52824] Kimai <= 2.57.0 - Default APP_SECRET Authentication Bypass (@DhiyaneshDK) [critical]
- [CVE-2026-52773] YesWiki Archived Revision - Cross-Site Scripting (@0x_Akoko) [medium]
- [CVE-2026-49952] Discuz! X5.0 - Authentication Bypass (@0x_Akoko) [critical]
- [CVE-2026-48909] Joomla SP LMS <= 4.1.3 - Remote Code Execution (@DhiyaneshDK) [critical]
- [CVE-2026-48908] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-46442] Flowise < 3.1.2 - node-custom-function Unauthorized RCE (@DhiyaneshDk, @princechaddha) [critical] (kev) (vKEV) 🔥
- [CVE-2026-44825] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials (@pdteam, @0x_Akoko) [high] (kev) (vKEV) 🔥
- [CVE-2026-42796] Arelle < 2.39.10 - Remote Code Execution (@aryu-ru) [critical]
- [CVE-2026-39468] Meta Box <= 5.11.1 - Arbitrary File Deletion (@iamatownboy) [high]
- [CVE-2026-34036] Dolibarr <=22.0.4 - Local File Inclusion (@y0no) [medium]
- [CVE-2026-33497] Langflow < 1.7.0 - Path Traversal (@xtr0nix) [high]
- [CVE-2026-31831] Tautulli <= 2.16.1 - Path Traversal (@WRG-11) [high]
- [CVE-2026-30623] LiteLLM 1.18.10 - Command Injection (@leeseungsu) [high]
- [CVE-2026-23696] Windmill < 1.603.3 - SQL Injection (@chocapikk, @DhiyaneshDk) [critical]
- [CVE-2026-22683] Windmill < 1.603.3 - Operator Authorization Bypass (@chocapikk, @DhiyaneshDK) [high]
- [CVE-2026-16232] Check Point Security Management Server - SmartConsole Authentication Bypass (@sfewer-r7, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-15409] SonicWall SMA1000 - Server-Side Request Forgery (@DhiyaneshDk, @rapid7) [critical] (kev) (vKEV) 🔥
- [CVE-2026-15094] WP Hotel Booking <= 2.3.2 - Cross-Site Scripting (@SmigsBellamigs) [medium]
- [CVE-2026-9282] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥
- [CVE-2026-9198] IBM Langflow - Remote Code Execution (@YesWeHack) [critical]
- [CVE-2026-8732] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-8713] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥
- [CVE-2026-8385] WordPress WP Go Maps < 10.0.10 - Unauth Marker Data Disclosure (@0x_Akoko) [medium]
- [CVE-2026-6875] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE (@pdteam, @DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-4987] SureForms <= 2.5.2 - Unauth Payment Amount Validation Bypass via form_id (@iamatownboy) [high]
- [CVE-2026-3891] Pix for WooCommerce <= 1.5.0 - Unauth Arbitrary File Upload (@m4sh_wacker) [critical]
- [CVE-2026-3335] Canto <= 3.1.1 - Missing Authorization to Unauth File Upload (@iamatownboy) [medium]
- [CVE-2026-3296] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-1980] WPBookit <= 1.0.8 - Unauth Customer Information Disclosure (@aryu-ru) [medium]
- [CVE-2026-1830] Quick Playground <= 1.3.1 - Missing Authorization to Unauth Arbitrary File Upload (@iamatownboy) [critical]
- [CVE-2025-71334] Flowise - Path Traversal (@theamanrawat) [critical] (kev) (vKEV) 🔥
- [CVE-2025-68493] Apache Struts XWork - XML External Entity Injection (@pussycat0x) [high] (kev) (vKEV) 🔥
- [CVE-2025-55746] Directus - Unauth File Modification (@aleff-github) [critical]
- [CVE-2025-54988] Apache Tika - XXE Injection (@tx1ee) [critical] 🔥
- [CVE-2025-14047] User Frontend <= 4.2.4 - Missing Authorization to Unauth Attachment Deletion (@iamatownboy) [medium]
- [CVE-2025-6389] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2025-2505] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion (@pussycat0x) [critical] (kev) (vKEV) 🔥
- [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal (@ChrisJr404) [critical] 🔥
- [CVE-2024-42323] Apache HertzBeat < 1.6.0 - SnakeYAML Deserialization Remote Code Execution (@ChrisJr404) [high]
- [CVE-2023-34992] Fortinet FortiSIEM - Unauth Command Injection (@thacien) [critical] 🔥
- [CVE-2019-14793] Meta Box <= 4.16.2 - Arbitrary File Deletion (@ritikchaddha) [high]
- [apport-error-reporting-disabled-check] Ensure Automatic Error Reporting is Not Enabled (@Th3l0newolf) [medium]
- [gdm-automount-removable-media-disabled-check] Ensure GDM Automatic Mounting of Removable Media is Disabled (@Th3l0newolf) [medium]
- [gdm-autorun-never-enabled-check] Ensure GDM autorun-never is Enabled (@Th3l0newolf) [medium]
- [gdm-disable-user-list-enabled-check] Ensure GDM disable-user-list Option is Enabled (@Th3l0newolf) [low]
- [gdm-login-banner-configured-check] Ensure GDM Login Banner is Configured (@Th3l0newolf) [low]
- [gdm-removed-check] Ensure GDM is Removed (@Th3l0newolf) [medium]
- [gdm-screen-lock-idle-check] Ensure GDM Screen Locks When the User is Idle (@Th3l0newolf) [medium]
- [issue-file-permissions-check] Ensure Access to /etc/issue is Configured (@Th3l0newolf) [medium]
- [issue-net-file-permissions-check] Ensure Access to /etc/issue.net is Configured (@Th3l0newolf) [medium]
- [local-login-warning-banner-configured-check] Ensure Local Login Warning Banner is Configured Properly (@Th3l0newolf) [low]
- [motd-configured-properly-check] Ensure Message of the Day is Configured Properly (@Th3l0newolf) [low]
- [motd-file-permissions-check] Ensure Access to /etc/motd is Configured (@Th3l0newolf) [medium]
- [prelink-not-installed-check] Ensure Prelink is Not Installed (@Th3l0newolf) [medium]
- [remote-login-warning-banner-configured-check] Ensure Remote Login Warning Banner is Configured Properly (@Th3l0newolf) [low]
- [unix-command-injection] Unix Command Injection - Generic Detection (@Jaenact) [high]
- [windows-command-injection] Windows Command Injection - Generic Detection (@Jaenact) [high]
- [sentinel-default-login] Alibaba Sentinel - Default Login (@wujiecong) [high]
- [9router-default-login] 9Router - Default Login (@0x_Akoko) [high]
- [aim-panel] Aim Panel - Detect (@rxerium) [info]
- [arthas-web-console] Alibaba Arthas Web Console - Detect (@wujiecong) [info]
- [aruba-airwave-panel] Aruba AirWave Management Platform - Login Panel (@rxerium) [info]
- [asustor-adm-panel] ASUSTOR ADM - Login Panel (@rxerium) [info]
- [atera-customer-portal] Atera Customer Portal - Login Panel (@rxerium) [info]
- [bizzy-panel] BIZZY Login - Panel (@Kazgangap) [info]
- [buffalo-terastation-pro-panel] Buffalo TeraStation Pro - Login Panel (@rxerium) [info]
- [chatwoot-login-panel] Chatwoot Login Panel - Detect (@Th3l0newolf) [info]
- [compreface-panel] CompreFace Panel - Detect (@rxerium) [info]
- [cribl-stream-panel] Cribl Stream - Login Panel (@rxerium) [info]
- [cyberark-pvwa-panel] CyberArk Password Vault Web Access - Login Panel (@rxerium) [info]
- [deepstack-panel] DeepStack AI Server Panel - Detect (@rxerium) [info]
- [delinea-secret-server-panel] Delinea Secret Server - Login Panel (@rxerium) [info]
- [determined-ai-panel] Determined AI Panel - Detect (@rxerium) [info]
- [fastchat-panel] FastChat Panel - Detect (@rxerium) [info]
- [fiftyone-panel] FiftyOne Panel - Detect (@rxerium) [info]
- [fooocus-panel] Fooocus Panel - Detect (@rxerium) [info]
- [h2o-driverless-ai-panel] H2O Driverless AI Panel - Detect (@rxerium) [info]
- [helicone-panel] Helicone Panel - Detect (@rxerium) [info]
- [kaseya-vsa-login-panel] Kaseya VSA - Login Panel (@rxerium) [info]
- [knime-server-panel] KNIME Server / Business Hub WebPortal - Detect (@rxerium) [info]
- [kubeflow-katib-panel] Kubeflow Katib Panel - Detect (@rxerium) [info]
- [langtrace-panel] Langtrace Panel - Detect (@rxerium) [info]
- [nakivo-backup-replication-panel] NAKIVO Backup & Replication - Login Panel (@rxerium) [info]
- [one-identity-safeguard-spp-panel] One Identity Safeguard for Privileged Passwords - Login Panel (@rxerium) [info]
- [pingfederate-login-panel] PingFederate - Login Panel (@rxerium) [info]
- [prodigy-panel] Prodigy Annotation Tool - Unauth Exposure (@rxerium) [medium]
- [rubrik-panel] Rubrik - Login Panel (@rxerium) [info]
- [rustdesk-server-pro-panel] RustDesk Server Pro - Login Panel (@rxerium) [info]
- [sailpoint-identityiq-panel] SailPoint IdentityIQ - Login Panel (@rxerium) [info]
- [scale-computing-hc3-panel] Scale Computing HC3 - Login Panel (@rxerium) [info]
- [schneider-ecostruxure-building-operation-webstation-panel] Schneider EcoStruxure Building Operation WebStation - Login Panel (@rxerium) [info]
- [signoz-panel] SigNoz - Login Panel (@rxerium) [info]
- [simplehelp-login-panel] SimpleHelp - Login Panel (@rxerium) [info]
- [sonicwall-sma-panel] SonicWall Secure Mobile Access (SMA) Panel - Detection (@DhiyaneshDk) [info]
- [tenable-sc-panel] Tenable Security Center - Login Panel (@rxerium) [info]
- [unitrends-recovery-series-panel] Unitrends Recovery Series - Login Panel (@rxerium) [info]
- [verba-panel] Verba (The Golden RAGtriever) Panel - Detect (@rxerium) [info]
- [vermeg-solife-panel] Vermeg Solife Panel - Detect (@righettod) [info]
- [xcp-ng-xo-lite-panel] XCP-ng XO Lite - Login Panel (@rxerium) [info]
- [xen-orchestra-panel] Xen Orchestra - Login Panel (@rxerium) [info]
- [vllm-openai-api-exposed] vLLM OpenAI-Compatible API - Unauth Exposure (@fsoppelsa) [medium]
- [claude-settings-exposure] Claude Code Project Settings Exposure (@shadowhunter-92) [medium]
- [abb-ability-genix-detect] ABB Ability Genix Industrial Analytics and AI Suite - Detect (@rxerium) [info]
- [cockroachdb-detect] CockroachDB DB Console - Detect (@rxerium) [info]
- [deskpro-default-page] Deskpro Private Controller - Default Page Detect (@Th3l0newolf) [info]
- [deskpro-on-default-page] Deskpro On-Premise Controller - Default Page Detect (@Th3l0newolf) [info]
- [huggingface-tei-tgi-detect] HuggingFace TEI & TGI - Detect (@insidetrust, @hdm) [info]
- [jan-detect] Jan AI - Detect (@insidetrust, @hdm) [info]
- [pingaccess-detect] PingAccess - Detect (@rxerium) [info]
- [qdrant-detect] Qdrant - Detect (@rxerium) [info]
- [rasa-detect] Rasa Open Source - Detect (@rxerium) [info]
- [seldon-core-detect] Seldon Core - Detect (@rxerium) [info]
- [sglang-detect] SGLang - Detect (@insidetrust, @hdm) [info]
- [vespa-detect] Vespa - Detect (@rxerium) [info]

## New Contributors
* @l46983284-cpu made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16566
* @Nivid42 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16569
* @sec-mlot made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16575
* @SmigsDeLaMigs made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16599
* @panchiko-p made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16555
* @anupamme made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16616
* @zer0p0intvvv made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16600
* @kadewu made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16628
* @wujiecong made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16619
* @infosec-asish made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16574
* @jakxx made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16362
* @PachkaKofe04 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16160
* @AI-DEV-BOT made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16301
* @munzzyy made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16579
* @fsoppelsa made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16471
* @Thacien made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/10321
* @hugo-syn made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/15947
* @DPS0340 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16665
* @stopic-lab made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16631
* @iamatownboy made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16644
* @shadowhunter-92 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16701
* @shreyas-malhotra made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16704
* @gotr00t0day made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16682

**Full Changelog**: https://github.com/projectdiscovery/nuclei-templates/compare/v10.4.6...v10.4.7