Starstruk Logo MarkStarstruk

v10.5.0

projectdiscovery/nuclei-templatesv10.5.0Oct 5, 2026by princechaddha

Upgrading?

What changed from v3.8.51 → v10.5.0?

AI Summary

A security-focused update adding 295 new templates and 36 CVEs, including critical vulnerabilities in WordPress, N-able, and LiteLLM, alongside fixes for false positives and negatives in existing templates.

Key Highlights

  • Added 295 new templates and 36 new CVEs, including critical RCE vulnerabilities
  • Critical CVEs added: WordPress PHP Path Traversal, N-able Pre-Auth RCE, Gravity Forms RCE, LiteLLM Host Header Bypass
  • Fixed false negatives in WP Cerber, MongoDB MongoBleed, and Munin templates
  • Fixed false positives in Drupalgeddon, OneNav SSRF, and gude-default-login templates
  • Re-signed code and javascript templates with ProjectDiscovery key

New Features

  • CVE-2026-87902: WordPress Core PHP Template Path Traversal
  • CVE-2026-86218: N-able N-central Pre-Authentication Remote Code Execution
  • CVE-2026-84434: WordPress Gravity Forms Unauthenticated Arbitrary File Upload
  • CVE-2026-49468: LiteLLM Proxy Host Header Authentication Bypass
  • CVE-2026-18072: Advanced Responsive Video Embedder Hardcoded Backdoor
  • CVE-2026-9103: Langflow OSS Superuser Token Issuance
  • CVE-2026-1340: Ivanti EPMM Remote Code Execution
  • CVE-2025-62593: Ray Remote Code Execution
  • CVE-2025-14847: MongoDB Server Information Disclosure (MongoBleed)
  • CVE-2024-57728: SimpleHelp Arbitrary File Upload

Full Release Notes

### New Templates Added: `295` | CVEs Added: `36` | First-time contributions: `11`

### 🔥 Release Highlights 🔥
- [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥
- [CVE-2026-86218] N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-84434] WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload (@DhiyaneshDk) [critical] (vKEV) 🔥
- [CVE-2026-49468] LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass (@str4k3r) [critical] 🔥
- [CVE-2026-42018] JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
- [CVE-2026-18072] Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass (@str4k3r) [critical] 🔥
- [CVE-2026-9103] Langflow OSS - Superuser Token Issuance (@str4k3r) [critical] 🔥
- [CVE-2026-1340] Ivanti EPMM < 12.8.0.0 - Remote Code Execution (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2025-62593] Ray < 2.52.0 - Remote Code Execution (@Veraptos VaaS Alpha) [critical] (kev) (vKEV) 🔥
- [CVE-2025-14847] MongoDB Server - Information Disclosure (MongoBleed) (@pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo) [high] (kev) (vKEV) 🔥
- [CVE-2024-57728] SimpleHelp <= 5.5.7 - Arbitrary File Upload (@popy21) [high] (kev) (vKEV) 🔥

## What's Changed

**Bug Fixes**
* Fixed the `cve-id` classification field in CVE-2025-12536 where it was copy-pasted from another template (PR #17355).
* Corrected the expression spacing in the `X-T0KEN-INF0` header for the Yonyou NC MessageServlet RCE template, which broke the payload (PR #17353).
* Fixed the `info` block in elfinder-version.yaml that was copy-pasted from the 2.1.58 RCE template, making every version-only detection report a critical RCE (PR #17358, Issue #17349).
* Corrected the DSL matcher in CVE-2024-42640 that referenced out-of-scope `body_3`/`body_4` variables that do not exist in a two-request block (PR #17191).
* Fixed the endpoint path and XML declaration in CVE-2020-11991 (Apache Cocoon) so the template actually reaches the vulnerable XSLT endpoint (PR #17173).
* Encoded payload-bearing `#` as `%23` in query-string injections for CVE-2020-22208 and CVE-2023-30258, which were silently dropping the fragment (PR #16587).
* Re-signed four `code/` and `javascript/` templates that carried a contributor's signing key instead of the ProjectDiscovery key (PR #17260).

**False Negatives**
* CVE-2021-37598 — rewrote the WP Cerber access-control bypass template to fix a matcher inversion that turned true positives into false negatives on CDN-fronted sites (PR #17362, Issue #17023).
* unauth-munin — fixed a `tolower(body)` DSL matcher that could never match because of the casing logic (PR #17357).
* CVE-2022-0482 — the Easy!Appointments SSRF template matched on `unavailables`, a key from the wrong endpoint; switched to `unavailability_events` from the actual `ajax_get_calendar_events` response (PR #17241).
* CVE-2025-29927 — added the missing `matchers-condition: and` to the Next.js middleware bypass request, which was evaluating matchers with OR logic and never matching when both conditions were needed (PR #17034).
* CVE-2026-63077 — retargeted the TeamCity XStream deserialization template from the legacy `/app/agents/` endpoint to `/app/agents/v1` with the documented XML gadget, since the old probe never fires on affected builds (PR #17045).
* CVE-2021-34429 — replaced `unsafe: true` with `disable-path-automerge` to stop Jetty WEB-INF disclosure detection from duplicating the request path, producing zero detections on vulnerable instances (PR #17298).
* CVE-2025-14847 — moved the MongoDB MongoBleed template from `javascript/` to `network/` and switched the TCP matcher from a truncated `maxBsonObjectSize` field to version-only detection, since the original field sat beyond the 2048-byte read-size window (PR #17168).
* caldera-c2 — added detection for Caldera 5.x Magma UI, since the existing template only matched the 4.x `<title>Login | CALDERA</title>` title (PR #17161).

**False Positives**
* CVE-2018-7600 — rewrote the Drupalgeddon RCE template for non-destructive, false-positive-proof detection (PR #17167).
* CVE-2024-45440 — stopped matching on patched Drupal 10.x versions (PR #17272).
* CVE-2024-33832 — added the missing `matchers-condition: and` to the OneNav SSRF template, which was matching on status 200 alone (PR #17293).
* CVE-2026-31807 — added `matchers-condition: and` to the XSS detection request, which was matching on supporting indicators alone (PR #17240).
* sap-readconfigfile-disclosure — restored `matchers-condition: and` in request 2 (PR #17294).
* gude-default-login — verified that credentials are actually required before reporting default creds (PR #17263).
* outback-power-detect — required OutBack-specific markers so the template stops matching on Cisco Meraki local status pages (PR #17351).
* adcs-certificate — required a link to a certificate file rather than matching any 200 response with `.cer`/`.crt` somewhere in the body (PR #17319, Issue #17314).
* CVE-2021-44528 — added ruby-specific header checks to stop matching on non-Ruby backends (PR #17259).

**Enhancements**
* Enhanced CVE-2025-55184 with updated classification, max-request limit, and refined matchers (PR #17345).
* Added the `user:user` factory credential pair and version extraction to the GUDE Expert Net Control default-login template (PR #17194).
* Extended niagara-fox-info-enum to detect FoxS (Fox over TLS) on port 4911, since stations that disable plaintext Fox were invisible to the existing template (PR #17311).
* Updated matchers in CVE-2026-47717 (PR #17296).

## Templates Added
- [CVE-2026-89063] Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access (@0x_Akoko) [high]
- [CVE-2026-89013] Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter (@DhiyaneshDk) [high] (vKEV)
- [CVE-2026-87902] WordPress Core - PHP Template Path Traversal (@Hadrian,FLX) [critical] (kev) (vKEV) 🔥
- [CVE-2026-86218] N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution (@DhiyaneshDk) [critical] (kev) (vKEV) 🔥
- [CVE-2026-85688] TEN Framework - Arbitrary File Read & Write (@aryu-ru,geo-chen) [critical]
- [CVE-2026-84434] WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload (@DhiyaneshDk) [critical] (vKEV) 🔥
- [CVE-2026-82456] argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access (@kh1166) [critical]
- [CVE-2026-80099] Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret (@ritikchaddha) [high] (vKEV)
- [CVE-2026-69085] SiYuan <=3.7.2 - SQL Injection (@str4k3r) [critical]
- [CVE-2026-61560] GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access (@ashish-cybersec) [critical]
- [CVE-2026-58467] Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion (@Abdullah Shahid (comradezephyr)) [high]
- [CVE-2026-56681] 9router <=0.5.4 - Authentication Bypass (@0x_Akoko) [high]
- [CVE-2026-55552] Yamcs <=5.11.12 - Arbitrary File Read (@aryu-ru,AbdrrahimDahmani) [high]
- [CVE-2026-55549] Yamcs <=5.8.6 - Cross-Site Scripting (@str4k3r) [medium]
- [CVE-2026-49468] LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass (@str4k3r) [critical] 🔥
- [CVE-2026-49060] Hippoo Mobile App for WooCommerce - Broken Access Control (@theamanrawat) [critical] (vKEV)
- [CVE-2026-42018] JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass (@theamanrawat) [high] (kev) (vKEV) 🔥
- [CVE-2026-40281] Gotenberg <= 8.30.1 - Remote Code Execution (@aryu-ru) [critical]
- [CVE-2026-29058] WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection (@ashish-cybersec) [critical]
- [CVE-2026-27886] Strapi <=5.36.x - Admin Credential Enumeration (@zeroc00I) [critical]
- [CVE-2026-26216] Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter (@dishantmodi) [critical]
- [CVE-2026-25703] NeuVector - Information Disclosure (@str4k3r) [high]
- [CVE-2026-18072] Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass (@str4k3r) [critical] 🔥
- [CVE-2026-13153] Essential Blocks < 6.4.0 - Information Disclosure (@str4k3r) [medium]
- [CVE-2026-12227] Visual Composer <= 45.16.0 - Unauthenticated LFI (@0x_Akoko) [critical]
- [CVE-2026-9103] Langflow OSS - Superuser Token Issuance (@str4k3r) [critical] 🔥
- [CVE-2026-6639] AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure (@str4k3r) [high]
- [CVE-2026-1340] Ivanti EPMM < 12.8.0.0 - Remote Code Execution (@0x_Akoko) [critical] (kev) (vKEV) 🔥
- [CVE-2026-0692] BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass (@str4k3r) [high]
- [CVE-2025-68273] Signal K Server <= 2.18.0 - Information Disclosure (@ChrisJr404) [medium]
- [CVE-2025-62593] Ray < 2.52.0 - Remote Code Execution (@Veraptos VaaS Alpha) [critical] (kev) (vKEV) 🔥
- [CVE-2025-34033] Blue Angel Software Suite (5V Technologies) - OS Command Injection (@princechaddha,ritikchaddha) [high] (vKEV)
- [CVE-2025-14847] MongoDB Server - Information Disclosure (MongoBleed) (@pussycat0x,joe-desimone,DhiyaneshDK,Wiz Research,diedromeo) [high] (kev) (vKEV) 🔥
- [CVE-2025-11452] Asgaros Forum < 3.2.0 - SQL Injection (@Pauullamm) [high]
- [CVE-2024-57728] SimpleHelp <= 5.5.7 - Arbitrary File Upload (@popy21) [high] (kev) (vKEV) 🔥
- [CVE-2021-42392] H2 Database Console - JNDI Injection RCE (@i-am-paradox) [critical]
- [3dprinteros-client-detect] 3DPrinterOS Client - Detect (@rxerium) [info]
- [adempiere-detect] ADempiere - Detect (@rxerium) [info]
- [admidio-detect] Admidio - Detect (@rxerium) [info]
- [affine-detect] AFFiNE - Detect (@rxerium) [info]
- [agenta-detect] Agenta - Detect (@rxerium) [info]
- [akkoma-detect] Akkoma - Detect (@rxerium) [info]
- [ant-media-server-detect] Ant Media Server - Detect (@rxerium) [info]
- [appflowy-cloud-detect] AppFlowy Cloud - Detect (@rxerium) [info]
- [apprise-api-detect] Apprise API - Detect (@rxerium) [info]
- [aptabase-detect] Aptabase - Detect (@rxerium) [info]
- [archivesspace-detect] ArchivesSpace - Detect (@rxerium) [info]
- [autobrr-detect] autobrr - Detect (@rxerium) [info]
- [azuracast-detect] AzuraCast - Detect (@rxerium) [info]
- [backstage-detect] Backstage - Detect (@rxerium) [info]
- [bagisto-detect] Bagisto - Detect (@rxerium) [info]
- [bahmni-detect] Bahmni - Detect (@rxerium) [info]
- [bareos-webui-detect] Bareos WebUI - Detect (@rxerium) [info]
- [bludit-detect] Bludit - Detect (@rxerium) [info]
- [broadleaf-commerce-detect] Broadleaf Commerce - Detect (@rxerium) [info]
- [bunkerweb-detect] BunkerWeb - Detect (@rxerium) [info]
- [cabot-detect] Cabot - Detect (@rxerium) [info]
- [cal-com-detect] Cal.com - Detect (@rxerium) [info]
- [calaos-webapp-detect] Calaos Web App - Detect (@rxerium) [info]
- [castopod-detect] Castopod - Detect (@rxerium) [info]
- [chartbrew-detect] Chartbrew - Detect (@rxerium) [info]
- [chibisafe-detect] Chibisafe - Detect (@rxerium) [info]
- [cinny-detect] Cinny - Detect (@rxerium) [info]
- [ckan-detect] CKAN - Detect (@rxerium) [info]
- [cloudbeaver-detect] CloudBeaver Community - Detect (@rxerium) [info]
- [cloudreve-detect] Cloudreve - Detect (@rxerium) [info]
- [cloudron-detect] Cloudron - Detect (@rxerium) [info]
- [coder-detect] Coder - Detect (@rxerium) [info]
- [coroot-detect] Coroot - Detect (@rxerium) [info]
- [countly-detect] Countly - Detect (@rxerium) [info]
- [cpanel-login-detect] cPanel Login Panel - Detect (@johnk3r) [info]
- [crafty-controller-detect] Crafty Controller - Detect (@rxerium) [info]
- [crater-detect] Crater - Detect (@rxerium) [info]
- [cryptpad-detect] CryptPad - Detect (@rxerium) [info]
- [cubejs-playground-detect] Cube.js Playground - Detect (@rxerium) [info]
- [datasette-detect] Datasette - Detect (@rxerium) [info]
- [dataverse-detect] Dataverse - Detect (@rxerium) [info]
- [defguard-detect] Defguard - Detect (@rxerium) [info]
- [dispatcharr-detect] Dispatcharr - Detect (@rxerium) [info]
- [docker-registry-ui-detect] Docker Registry UI - Detect (@rxerium) [info]
- [docspell-detect] Docspell - Detect (@rxerium) [info]
- [documize-detect] Documize - Detect (@rxerium) [info]
- [docusaurus-detect] Docusaurus - Detect (@rxerium) [info]
- [duplicati-detect] Duplicati - Detect (@rxerium) [info]
- [easyappointments-detect] Easy!Appointments - Detect (@rxerium) [info]
- [eclipse-kapua-detect] Eclipse Kapua - Detect (@rxerium) [info]
- [etherpad-detect] Etherpad - Detect (@rxerium) [info]
- [evcc-detect] EVCC - Detect (@rxerium) [info]
- [evershop-detect] EverShop - Detect (@rxerium) [info]
- [excalidraw-detect] Excalidraw - Detect (@rxerium) [info]
- [faveo-helpdesk-detect] Faveo Helpdesk - Detect (@rxerium) [info]
- [fileflows-detect] FileFlows - Detect (@rxerium) [info]
- [filerise-detect] FileRise - Detect (@rxerium) [info]
- [filerun-detect] FileRun - Detect (@rxerium) [info]
- [firefly-iii-detect] Firefly III - Detect (@rxerium) [info]
- [firezone-detect] Firezone - Detect (@rxerium) [info]
- [flagsmith-detect] Flagsmith - Detect (@rxerium) [info]
- [flipt-detect] Flipt - Detect (@rxerium) [info]
- [flowable-detect] Flowable - Detect (@rxerium) [info]
- [flowfuse-detect] FlowFuse - Detect (@rxerium) [info]
- [fluidd-detect] Fluidd - Detect (@rxerium) [info]
- [focalboard-detect] Focalboard - Detect (@rxerium) [info]
- [formbricks-detect] Formbricks - Detect (@rxerium) [info]
- [frontaccounting-detect] FrontAccounting - Detect (@rxerium) [info]
- [funkwhale-detect] Funkwhale - Detect (@rxerium) [info]
- [galaxy-project-detect] Galaxy Project - Detect (@rxerium) [info]
- [gameap-detect] GameAP - Detect (@rxerium) [info]
- [gatus-detect] Gatus - Detect (@rxerium) [info]
- [geonetwork-detect] GeoNetwork - Detect (@rxerium) [info]
- [gladys-assistant-detect] Gladys Assistant - Detect (@rxerium) [info]
- [glitchtip-detect] GlitchTip - Detect (@rxerium) [info]
- [goatcounter-detect] GoatCounter - Detect (@rxerium) [info]
- [gokapi-detect] Gokapi - Detect (@rxerium) [info]
- [gollum-detect] Gollum - Detect (@rxerium) [info]
- [gonic-detect] gonic - Detect (@rxerium) [info]
- [gotosocial-detect] GoToSocial - Detect (@rxerium) [info]
- [gpon-router-detect] GPON Home Gateway - Detect (@K3ysTr0K3R) [info]
- [gravitee-apim-detect] Gravitee APIM - Detect (@rxerium) [info]
- [grist-detect] Grist - Detect (@rxerium) [info]
- [grocy-detect] Grocy - Detect (@rxerium) [info]
- [growthbook-detect] GrowthBook - Detect (@rxerium) [info]
- [hatchet-detect] Hatchet - Detect (@rxerium) [info]
- [headplane-detect] Headplane - Detect (@rxerium) [info]
- [highlight-io-detect] Highlight.io - Detect (@rxerium) [info]
- [homegenie-detect] HomeGenie - Detect (@rxerium) [info]
- [horilla-detect] Horilla - Detect (@rxerium) [info]
- [htmly-detect] HTMLy - Detect (@rxerium) [info]
- [http-etcd-unauthenticated-api-v3] etcd v3 Unauthenticated API (@x3lfyn) [high]
- [http-etcd-unauthenticated-raft] etcd RAFT Unauthenticated API (@x3lfyn) [high]
- [huawei-ssh-detect] Huawei SSH Service - Detect (@johnk3r) [info]
- [humhub-detect] HumHub - Detect (@rxerium) [info]
- [idempiere-detect] iDempiere - Detect (@rxerium) [info]
- [illa-builder-detect] ILLA Builder - Detect (@rxerium) [info]
- [inngest-detect] Inngest - Detect (@rxerium) [info]
- [invoice-ninja-detect] Invoice Ninja - Detect (@rxerium) [info]
- [invoiceplane-detect] InvoicePlane - Detect (@rxerium) [info]
- [iobroker-detect] ioBroker - Detect (@rxerium) [info]
- [iotsharp-detect] IoTSharp - Detect (@rxerium) [info]
- [ipplan-detect] IPPlan - Detect (@rxerium) [info]
- [islandora-detect] Islandora - Detect (@rxerium) [info]
- [it-tools-detect] IT-Tools - Detect (@rxerium) [info]
- [janus-webrtc-server-detect] Janus WebRTC Server - Detect (@rxerium) [info]
- [jirafeau-detect] Jirafeau - Detect (@rxerium) [info]
- [kanidm-detect] Kanidm - Detect (@rxerium) [info]
- [kaui-detect] Kaui - Detect (@rxerium) [info]
- [keila-detect] Keila - Detect (@rxerium) [info]
- [kener-detect] Kener - Detect (@rxerium) [info]
- [keystonejs-detect] KeystoneJS - Detect (@rxerium) [info]
- [kimai-detect] Kimai - Detect (@rxerium) [info]
- [komodo-detect] Komodo - Detect (@rxerium) [info]
- [kubesphere-detect] KubeSphere - Detect (@rxerium) [info]
- [lago-detect] Lago - Detect (@rxerium) [info]
- [lemmy-detect] Lemmy - Detect (@rxerium) [info]
- [librebooking-detect] LibreBooking - Detect (@rxerium) [info]
- [libretime-detect] LibreTime - Detect (@rxerium) [info]
- [lightdash-detect] Lightdash - Detect (@rxerium) [info]
- [lizmap-detect] Lizmap - Detect (@rxerium) [info]
- [lldap-detect] LLDAP - Detect (@rxerium) [info]
- [logto-detect] Logto - Detect (@rxerium) [info]
- [lowcoder-detect] Lowcoder - Detect (@rxerium) [info]
- [loxberry-detect] LoxBerry - Detect (@rxerium) [info]
- [lufi-detect] Lufi - Detect (@rxerium) [info]
- [luigi-detect] Luigi - Detect (@rxerium) [info]
- [mailtrain-detect] Mailtrain - Detect (@rxerium) [info]
- [mailu-detect] Mailu - Detect (@rxerium) [info]
- [mainflux-detect] Mainflux - Detect (@rxerium) [info]
- [mainsail-detect] Mainsail - Detect (@rxerium) [info]
- [mathesar-detect] Mathesar - Detect (@rxerium) [info]
- [mayan-edms-detect] Mayan EDMS - Detect (@rxerium) [info]
- [mcp-streamable-http-exposure] MCP Streamable HTTP Server - Unauthenticated Initialize (@DevamShah) [unknown]
- [mediacms-detect] MediaCMS - Detect (@rxerium) [info]
- [medusa-storefront-detect] Medusa Storefront - Detect (@rxerium) [info]
- [metasfresh-detect] metasfresh - Detect (@rxerium) [info]
- [microbin-detect] MicroBin - Detect (@rxerium) [info]
- [mindsdb-detect] MindsDB - Detect (@rxerium) [info]
- [minio-aistor-detect] MinIO AIStor Console - Detect (@r3dg33k) [info]
- [minthcm-detect] MintHCM - Detect (@rxerium) [info]
- [misskey-detect] Misskey - Detect (@rxerium) [info]
- [mobilizon-detect] Mobilizon - Detect (@rxerium) [info]
- [modbus-detect] Modbus TCP Service Detection (@K3ysTr0K3R) [info]
- [monica-detect] Monica - Detect (@rxerium) [info]
- [monitoror-detect] Monitoror - Detect (@rxerium) [info]
- [netbird-detect] NetBird - Detect (@rxerium) [info]
- [netmaker-detect] Netmaker - Detect (@rxerium) [info]
- [nipap-detect] NIPAP - Detect (@rxerium) [info]
- [nymea-detect] nymea - Detect (@rxerium) [info]
- [oidc-signing-alg-none-supported] OpenID Connect - Unsigned (alg none) ID Token Supported (@rocky55ayush) [medium]
- [omeka-s-detect] Omeka S - Detect (@rxerium) [info]
- [openbas-detect] OpenBAS - Detect (@rxerium) [info]
- [openboxes-detect] OpenBoxes - Detect (@rxerium) [info]
- [openelis-detect] OpenELIS Global - Detect (@rxerium) [info]
- [openevse-wifi-detect] OpenEVSE WiFi - Detect (@rxerium) [info]
- [openmrs-detect] OpenMRS - Detect (@rxerium) [info]
- [openroaming-portal] OpenRoaming Portal - Detect (@johnk3r) [info]
- [opensupports-detect] OpenSupports - Detect (@rxerium) [info]
- [openwb-detect] openWB - Detect (@rxerium) [info]
- [openwisp-detect] OpenWISP - Detect (@rxerium) [info]
- [opik-detect] Comet Opik - Detect (@rxerium) [info]
- [orthanc-detect] Orthanc - Detect (@rxerium) [info]
- [otter-wiki-detect] Otter Wiki - Detect (@rxerium) [info]
- [ovenmediaengine-detect] OvenMediaEngine - Detect (@rxerium) [info]
- [owncast-detect] Owncast - Detect (@rxerium) [info]
- [pangolin-detect] Pangolin - Detect (@rxerium) [info]
- [parseable-detect] Parseable - Detect (@rxerium) [info]
- [part-db-detect] Part-DB - Detect (@rxerium) [info]
- [peertube-detect] PeerTube - Detect (@rxerium) [info]
- [pelican-panel-detect] Pelican Panel - Detect (@rxerium) [info]
- [penpot-panel] Penpot - Login Panel (@ashish-cybersec) [info]
- [peppermint-helpdesk-detect] Peppermint Helpdesk - Detect (@rxerium) [info]
- [perses-detect] Perses - Detect (@rxerium) [info]
- [pgweb-detect] Pgweb - Detect (@rxerium) [info]
- [picoshare-detect] PicoShare - Detect (@rxerium) [info]
- [pimatic-detect] pimatic - Detect (@rxerium) [info]
- [pingvin-share-detect] Pingvin Share - Detect (@rxerium) [info]
- [pixelfed-detect] Pixelfed - Detect (@rxerium) [info]
- [plane-detect] Plane - Detect (@rxerium) [info]
- [plik-detect] Plik - Detect (@rxerium) [info]
- [pluxml-detect] PluXml - Detect (@rxerium) [info]
- [postal-detect] Postal - Detect (@rxerium) [info]
- [powerdns-admin-detect] PowerDNS-Admin - Detect (@rxerium) [info]
- [powerdns-monitor-exposure] PowerDNS Authoritative Server Monitor - Unauthenticated Exposure (@ritikchaddha) [medium]
- [pretix-detect] pretix - Detect (@rxerium) [info]
- [proget-detect] ProGet - Detect (@rxerium) [info]
- [promptfoo-detect] Promptfoo - Detect (@rxerium) [info]
- [proxmox-backup-server-detect] Proxmox Backup Server - Detect (@rxerium) [info]
- [prusalink-detect] PrusaLink - Detect (@rxerium) [info]
- [psitransfer-detect] PsiTransfer - Detect (@rxerium) [info]
- [publii-detect] Publii - Detect (@rxerium) [info]
- [pufferpanel-detect] PufferPanel - Detect (@rxerium) [info]
- [pydio-cells-detect] Pydio Cells - Detect (@rxerium) [info]
- [qdrant-telemetry-exposure] Qdrant - Telemetry Exposure (@DevamShah) [medium]
- [quay-detect] Quay - Detect (@rxerium) [info]
- [raneto-detect] Raneto - Detect (@rxerium) [info]
- [rapid-scada-detect] Rapid SCADA - Detect (@rxerium) [info]
- [restate-detect] Restate - Detect (@rxerium) [info]
- [restreamer-detect] Restreamer - Detect (@rxerium) [info]
- [rport-detect] RPort - Detect (@rxerium) [info]
- [runtipi-detect] Runtipi - Detect (@rxerium) [info]
- [saleor-api-detect] Saleor API - Detect (@rxerium) [info]
- [saleor-dashboard-detect] Saleor Dashboard - Detect (@rxerium) [info]
- [scada-lts-detect] Scada-LTS - Detect (@rxerium) [info]
- [sciencelogic-sl1-panel] ScienceLogic SL1 (EM7) Panel - Detect (@cham423) [info]
- [scrutiny-detect] Scrutiny - Detect (@rxerium) [info]
- [scrypted-detect] Scrypted - Detect (@rxerium) [info]
- [secomea-gatemanager-panel] Secomea GateManager Panel - Detect (@cham423) [info]
- [senaite-detect] SENAITE - Detect (@rxerium) [info]
- [sentrifugo-detect] Sentrifugo - Detect (@rxerium) [info]
- [serverless-framework-config-exposure] Serverless Framework - Configuration Exposure (@ChrisJr404) [medium]
- [sharry-detect] Sharry - Detect (@rxerium) [info]
- [shellhub-detect] ShellHub - Detect (@rxerium) [info]
- [shuffle-soar-detect] Shuffle SOAR - Detect (@rxerium) [info]
- [shynet-detect] Shynet - Detect (@rxerium) [info]
- [solaranzeige-detect] Solaranzeige - Detect (@rxerium) [info]
- [solarassistant-detect] SolarAssistant - Detect (@rxerium) [info]
- [stalwart-mail-server-detect] Stalwart Mail Server - Detect (@rxerium) [info]
- [starrocks-detect] StarRocks - Detect (@rxerium) [info]
- [statping-ng-detect] Statping-ng - Detect (@rxerium) [info]
- [sunshine-game-streaming-detect] Sunshine Game Streaming - Detect (@rxerium) [info]
- [swarmpit-detect] Swarmpit - Detect (@rxerium) [info]
- [swetrix-detect] Swetrix - Detect (@rxerium) [info]
- [sylius-detect] Sylius - Detect (@rxerium) [info]
- [taiga-detect] Taiga - Detect (@rxerium) [info]
- [tasmoadmin-detect] TasmoAdmin - Detect (@rxerium) [info]
- [technitium-dns-server-detect] Technitium DNS Server - Detect (@rxerium) [info]
- [terraform-tfstate-exposure] Terraform State - File Exposure (@ChrisJr404) [high]
- [terraformrc-credentials-exposure] Terraform CLI Configuration - Credentials Exposure (@ChrisJr404) [high]
- [thinger-io-detect] Thinger.io - Detect (@rxerium) [info]
- [thingspanel-detect] ThingsPanel - Detect (@rxerium) [info]
- [tinacms-detect] TinaCMS - Detect (@rxerium) [info]
- [trigger-dev-detect] Trigger.dev - Detect (@rxerium) [info]
- [triliumnext-notes-detect] TriliumNext Notes - Detect (@rxerium) [info]
- [tryton-sao-detect] Tryton SAO - Detect (@rxerium) [info]
- [tuleap-detect] Tuleap - Detect (@rxerium) [info]
- [turn-server] TURN Server (@johnk3r) [info]
- [typemill-detect] TypeMill - Detect (@rxerium) [info]
- [typesense-dashboard-detect] Typesense Dashboard - Detect (@rxerium) [info]
- [typesetter-cms-detect] Typesetter CMS - Detect (@rxerium) [info]
- [umbrel-detect] Umbrel - Detect (@rxerium) [info]
- [uptrace-detect] Uptrace - Detect (@rxerium) [info]
- [virto-commerce-detect] Virto Commerce - Detect (@rxerium) [info]
- [volumio-detect] Volumio - Detect (@rxerium) [info]
- [vouch-proxy-detect] Vouch Proxy - Detect (@rxerium) [info]
- [watchyourlan-detect] WatchYourLAN - Detect (@rxerium) [info]
- [weberp-detect] webERP - Detect (@rxerium) [info]
- [webvirtcloud-detect] WebVirtCloud - Detect (@rxerium) [info]
- [wekan-detect] Wekan - Detect (@rxerium) [info]
- [whodb-detect] WhoDB - Detect (@rxerium) [info]
- [winter-cms-detect] Winter CMS - Detect (@rxerium) [info]
- [wordpress-click2shell] WordPress Click2Shell Theme Preview Selector Injection (@alex700) [high]
- [writefreely-detect] WriteFreely - Detect (@rxerium) [info]
- [yaade-detect] Yaade - Detect (@rxerium) [info]
- [yugabytedb-detect] YugabyteDB - Detect (@rxerium) [info]
- [zenko-cloudserver-detect] Zenko CloudServer - Detect (@rxerium) [info]
- [zigbee2mqtt-detect] Zigbee2MQTT - Detect (@rxerium) [info]
- [zincsearch-detect] ZincSearch - Detect (@rxerium) [info]

## New Contributors
* @x3lfyn made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17255
* @i-am-paradox made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17026
* @wong-hau-pepelu made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17238
* @BENZOOgataga made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17194
* @Shaivarth made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17240
* @alex700 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17278
* @rocky55ayush made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/16944
* @Mrs-Skelli made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17300
* @Tito0015 made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17171
* @BilalAtique made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17319
* @neoxua made their first contribution in https://github.com/projectdiscovery/nuclei-templates/pull/17353

Related Repositories

affaan-m/ECC★ 286,018

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

react/react★ 251,631

The library for web and native user interfaces.

nodejs/node★ 122,533

Node.js JavaScript runtime ✨🐢🚀✨

Leonxlnx/taste-skill★ 100,804

Agent skills that give coding agents taste: art direction, reference images and a browser check instead of generic AI pages

louislam/uptime-kuma★ 92,740

A fancy self-hosted monitoring tool