[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":48,"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk":55,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":62,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":68,"$f17q7jdn7tll3p":75,"$f2r4b9phgo6bha":102,"finding-templates-{\"q\":\"\",\"page\":1}":104},[4,15,21,27,33,39],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":41,"text":42,"link":43,"external":44,"targets":45,"cta":47,"variant":13,"campaign_id":41},"Office Hours #13 - Reducing tool sprawl","office-hours-13","[Live Office Hours, Wed Oct 14] How to consolidate your security testing stack without the lock-in","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_m_Won6d_SzOQ-gYhCdXU_A",true,[46],"\u002F","Save your spot",["Island",49],{"key":50,"params":51,"result":53},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":52},"{}",{"head":54},{},["Island",56],{"key":57,"params":58,"result":60},"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk",{"props":59},"{\"date\":1791358396,\"format\":\"MMMM dd, yyyy\"}",{"head":61},{},["Island",63],{"key":64,"params":65,"result":66},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":52},{"head":67},{},["Island",69],{"key":70,"params":71,"result":73},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":72},"{\"text-color\":\"gray\"}",{"head":74},{},{"count":76,"next":77,"previous":78,"results":79},17485,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",null,[80],{"id":81,"detectable_with":82,"vuln_details":89,"vuln_id":99,"name":100,"published":101,"updated":78},29804,{"tool":83,"engine":86},{"id":84,"name":85},1,"Network Scanner",{"id":87,"name":88},2,"Nuclei",{"id":81,"epss_score":78,"epss_percentile":78,"in_cisa_catalog":9,"codename":78,"public_description":90,"description":78,"severity":91,"risk_description":92,"public_recommendation":93,"recommendation":78,"references":94,"cvssv3":78,"cve":78,"date":78,"software_type":78,"vendor":97,"product":98,"ptt_exploit_capabilities":78,"category":78},"MITRE Caldera was found using default credentials. When started with the insecure default configuration, both the v4 (classic) and v5 (Magma) consoles ship static operator accounts (red, blue and admin) that all authenticate with the password \"admin\". An attacker who logs in gains full control of the adversary-emulation server and can run operations that execute commands on every connected agent.","high","The risk exist that a remote attacker could take advantage of the default credentials for taking over the default account. If an authenticated vulnerability is present on the machine, it could also be leveraged to exploit the target, compromising the underlying system.","Change all default credentials immediately and configure unique, strong passwords for each operator account.",[95,96],"https:\u002F\u002Fgithub.com\u002Fmitre\u002Fcaldera","https:\u002F\u002Fcaldera.readthedocs.io\u002Fen\u002Flatest\u002FServer-Configuration.html","mitre","caldera","NETSCAN-NUCLEI-DEFAULT-LOGINS-CALDERA-DEFAULT-LOGIN","MITRE Caldera - Default Login","2026-10-13T00:00:00Z",{"count":103},210,{"count":76,"next":105,"previous":78,"results":106},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[107,131,150,171,194,215,237,243,264,285,305,327,354,374,397,418,439,461,482,504,525,540,561,573,585],{"id":108,"detectable_with":109,"vuln_details":112,"vuln_id":129,"name":130,"published":101,"updated":78},29807,{"tool":110,"engine":111},{"id":84,"name":85},{"id":87,"name":88},{"id":108,"codename":78,"description":78,"severity":113,"risk_description":114,"public_description":115,"public_recommendation":116,"recommendation":78,"references":117,"cvssv3":121,"epss_score":122,"epss_percentile":123,"cve":124,"in_cisa_catalog":9,"date":126,"software_type":78,"vendor":127,"product":128,"ptt_exploit_capabilities":78},"critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via \u002Fwd\u002Fhub\u002Fsession due to missing Origin validation and weak content-type enforcement.","Upgrade to Selenium Server 4.0.0-alpha-7 or later and restrict network exposure.",[118,119,120],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-28108","https:\u002F\u002Fwww.gabriel.urdhr.fr\u002F2022\u002F02\u002F07\u002Fselenium-standalone-server-csrf-dns-rebinding-rce\u002F","https:\u002F\u002Fgithub.com\u002FSeleniumHQ\u002Fselenium\u002Fblob\u002Ftrunk\u002Fjava\u002FCHANGELOG",9.8,0.11727,0.95987,[125],"CVE-2022-28108","2022-04-19T00:00:00Z","selenium","selenium_grid","NETSCAN-NUCLEI-CVE-CVE-2022-28108","Selenium Grid \u003C 4.0.0-alpha-7 - Remote Code Execution",{"id":132,"detectable_with":133,"vuln_details":136,"vuln_id":148,"name":149,"published":101,"updated":78},29806,{"tool":134,"engine":135},{"id":84,"name":85},{"id":87,"name":88},{"id":132,"codename":78,"description":78,"severity":113,"risk_description":114,"public_description":137,"public_recommendation":138,"recommendation":78,"references":139,"cvssv3":121,"epss_score":141,"epss_percentile":142,"cve":143,"in_cisa_catalog":9,"date":145,"software_type":78,"vendor":146,"product":147,"ptt_exploit_capabilities":78},"When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.","Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.",[140],"https:\u002F\u002Fgithub.com\u002Fmaximhq\u002Fbifrost\u002Fpull\u002F6757",0.00621,0.48287,[144],"CVE-2026-90898","2026-09-14T00:00:00Z","maximhq","bifrost","NETSCAN-NUCLEI-CVE-CVE-2026-90898","Bifrost \u003C 2.1.0 - Unauthenticated MCP Stdio Command Execution",{"id":151,"detectable_with":152,"vuln_details":155,"vuln_id":169,"name":170,"published":101,"updated":78},29809,{"tool":153,"engine":154},{"id":84,"name":85},{"id":87,"name":88},{"id":151,"codename":78,"description":78,"severity":113,"risk_description":156,"public_description":157,"public_recommendation":158,"recommendation":78,"references":159,"cvssv3":121,"epss_score":162,"epss_percentile":163,"cve":164,"in_cisa_catalog":9,"date":166,"software_type":78,"vendor":167,"product":168,"ptt_exploit_capabilities":78},"An unauthenticated attacker can read arbitrary files including the ECDSA signing key, enabling them to forge access JWTs and bypass authentication for any account.","LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '\u002F'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys\u002Fecdsa_id), which signs access JWTs and enables full authentication bypass for any account.","Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.",[160,161],"https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fsecurity\u002Fadvisories\u002FGHSA-5g75-477j-2c2f","https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fcommit\u002F1e0b3a3",0.00677,0.50933,[165],"CVE-2026-54617","2026-09-17T00:00:00Z","gravitlauncher","launchserver","NETSCAN-NUCLEI-CVE-CVE-2026-54617","GravitLauncher LaunchServer \u003C=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read",{"id":172,"detectable_with":173,"vuln_details":176,"vuln_id":192,"name":193,"published":101,"updated":78},29805,{"tool":174,"engine":175},{"id":84,"name":85},{"id":87,"name":88},{"id":172,"codename":78,"description":78,"severity":91,"risk_description":177,"public_description":178,"public_recommendation":179,"recommendation":78,"references":180,"cvssv3":184,"epss_score":185,"epss_percentile":186,"cve":187,"in_cisa_catalog":9,"date":189,"software_type":78,"vendor":190,"product":191,"ptt_exploit_capabilities":78},"Attackers can execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, potentially leading to session hijacking or privilege escalation.","The Tag Groups WordPress plugin \u003C 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.","Update the Tag Groups plugin to version 2.2.0 or later.",[181,182,183],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9833","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F75792c33-2d9d-46db-a98c-00ec40951099\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ftag-groups\u002F",7.1,0.00282,0.19068,[188],"CVE-2026-9833","2026-07-20T00:00:00Z","publishpress","tag-groups","NETSCAN-NUCLEI-CVE-CVE-2026-9833","WordPress Tag Groups \u003C 2.2.0 - Reflected Cross-Site Scripting",{"id":195,"detectable_with":196,"vuln_details":199,"vuln_id":213,"name":214,"published":101,"updated":78},29808,{"tool":197,"engine":198},{"id":84,"name":85},{"id":87,"name":88},{"id":195,"codename":78,"description":78,"severity":200,"risk_description":201,"public_description":202,"public_recommendation":203,"recommendation":78,"references":204,"cvssv3":207,"epss_score":208,"epss_percentile":209,"cve":210,"in_cisa_catalog":9,"date":212,"software_type":78,"vendor":78,"product":78,"ptt_exploit_capabilities":78},"medium","Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.","MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.","Update to stable release v6.49.18 or later.",[205,206],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-54772","https:\u002F\u002Fgithub.com\u002Fdeauther890\u002FCVE-2024-54772",5.3,0.00792,0.55109,[211],"CVE-2024-54772","2025-02-11T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2024-54772","MikroTik WinBox \u003C= 6.49.17 - Username Enumeration",{"id":216,"detectable_with":217,"vuln_details":220,"vuln_id":235,"name":236,"published":101,"updated":78},29810,{"tool":218,"engine":219},{"id":84,"name":85},{"id":87,"name":88},{"id":216,"codename":78,"description":78,"severity":91,"risk_description":221,"public_description":222,"public_recommendation":223,"recommendation":78,"references":224,"cvssv3":227,"epss_score":228,"epss_percentile":229,"cve":230,"in_cisa_catalog":9,"date":232,"software_type":78,"vendor":233,"product":234,"ptt_exploit_capabilities":78},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","The Divi Plus WordPress plugin through 2.4.0 exposes the \u002Fwp-json\u002Felicus\u002Fv1\u002Fdipl-modules\u002Fsvg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.","Update Divi Plus to version 2.4.1 or later.",[225,226],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91136","https:\u002F\u002Fgithub.com\u002Ffl0ydsec\u002FCVE-2026-91136",7.5,0.0056,0.44975,[231],"CVE-2026-91136","2026-10-10T00:00:00Z","elicus","divi_plus","NETSCAN-NUCLEI-CVE-CVE-2026-91136","Divi Plus \u003C= 2.4.0 - Unauthenticated Arbitrary File Read",{"id":81,"detectable_with":238,"vuln_details":241,"vuln_id":99,"name":100,"published":101,"updated":78},{"tool":239,"engine":240},{"id":84,"name":85},{"id":87,"name":88},{"id":81,"codename":78,"description":78,"severity":91,"risk_description":92,"public_description":90,"public_recommendation":93,"recommendation":78,"references":242,"cvssv3":78,"epss_score":78,"epss_percentile":78,"cve":78,"in_cisa_catalog":9,"date":78,"software_type":78,"vendor":97,"product":98,"ptt_exploit_capabilities":78},[95,96],{"id":244,"detectable_with":245,"vuln_details":248,"vuln_id":261,"name":262,"published":263,"updated":78},29803,{"tool":246,"engine":247},{"id":84,"name":85},{"id":87,"name":88},{"id":244,"codename":78,"description":78,"severity":91,"risk_description":221,"public_description":249,"public_recommendation":250,"recommendation":78,"references":251,"cvssv3":227,"epss_score":254,"epss_percentile":255,"cve":256,"in_cisa_catalog":9,"date":258,"software_type":78,"vendor":259,"product":260,"ptt_exploit_capabilities":78},"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.","Upgrade Eclipse Theia to the patched version.",[252,253],"https:\u002F\u002Fgithub.com\u002Feclipse-theia\u002Ftheia\u002Fsecurity\u002Fadvisories\u002FGHSA-qmm6-p8q4-2g48","https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fcve-assignment\u002F-\u002Fwork_items\u002F133",0.00523,0.42677,[257],"CVE-2026-12609","2026-08-05T00:00:00Z","eclipse","theia","NETSCAN-NUCLEI-CVE-CVE-2026-12609","Eclipse Theia - Unauthenticated Path Traversal","2026-10-12T00:00:00Z",{"id":265,"detectable_with":266,"vuln_details":269,"vuln_id":283,"name":284,"published":263,"updated":78},29801,{"tool":267,"engine":268},{"id":84,"name":85},{"id":87,"name":88},{"id":265,"codename":78,"description":78,"severity":113,"risk_description":270,"public_description":271,"public_recommendation":272,"recommendation":78,"references":273,"cvssv3":78,"epss_score":277,"epss_percentile":278,"cve":279,"in_cisa_catalog":9,"date":281,"software_type":78,"vendor":282,"product":282,"ptt_exploit_capabilities":78},"An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.","FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.","Upgrade FOSSBilling to 0.8.0 or later, or block external access to \u002Fapi\u002Fsystem\u002F*.",[274,275,276],"https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Fsecurity\u002Fadvisories\u002FGHSA-78x5-c8gw-8279","https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Freleases\u002Ftag\u002F0.8.0","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27604",0.00509,0.41747,[280],"CVE-2026-27604","2026-06-23T00:00:00Z","fossbilling","NETSCAN-NUCLEI-CVE-CVE-2026-27604","FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass",{"id":286,"detectable_with":287,"vuln_details":290,"vuln_id":303,"name":304,"published":263,"updated":78},29802,{"tool":288,"engine":289},{"id":84,"name":85},{"id":87,"name":88},{"id":286,"codename":78,"description":78,"severity":200,"risk_description":291,"public_description":292,"public_recommendation":293,"recommendation":78,"references":294,"cvssv3":296,"epss_score":297,"epss_percentile":298,"cve":299,"in_cisa_catalog":9,"date":301,"software_type":78,"vendor":302,"product":302,"ptt_exploit_capabilities":78},"An unauthenticated attacker can forge bounce-status webhook events to artificially inflate a user's bounce score, causing that user's legitimate emails to be disabled.","Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints (including \u002Fwebhooks\u002Fmailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost) without validating a token when none is configured, which is the default state, letting an unauthenticated attacker forge webhook payloads.","Upgrade Discourse to the patched version, which rejects any provider webhook request with HTTP 406 when no authentication token is configured for that provider.",[295],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-j67c-53j2-4hfw",6.5,0.00437,0.36104,[300],"CVE-2026-26077","2026-02-26T00:00:00Z","discourse","NETSCAN-NUCLEI-CVE-CVE-2026-26077","Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery",{"id":306,"detectable_with":307,"vuln_details":310,"vuln_id":324,"name":325,"published":326,"updated":78},29800,{"tool":308,"engine":309},{"id":84,"name":85},{"id":87,"name":88},{"id":306,"codename":78,"description":78,"severity":113,"risk_description":114,"public_description":311,"public_recommendation":312,"recommendation":78,"references":313,"cvssv3":121,"epss_score":317,"epss_percentile":318,"cve":319,"in_cisa_catalog":9,"date":321,"software_type":78,"vendor":322,"product":323,"ptt_exploit_capabilities":78},"Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST \u002Fapi\u002Fv1\u002Fvalidate\u002Fcode endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax. Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET \u002Fapi\u002Fv1\u002Fauto_login with no credentials) and the custom_component exec() sink (POST \u002Fapi\u002Fv1\u002Fcustom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution. Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).","Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.",[314,315,316],"https:\u002F\u002Fwww.pruva.dev\u002Freproductions\u002FREPRO-2026-00381","https:\u002F\u002Fgithub.com\u002Flangflow-ai\u002Flangflow","https:\u002F\u002Fgithub.com\u002Flangflow-ai\u002Flangflow\u002Fcommit\u002F461506ac2f38f70a994b5140572b876448c11e4c",0.02662,0.8531,[320],"CVE-2026-93674","2026-10-07T00:00:00Z","langflow-ai","langflow","NETSCAN-NUCLEI-CVE-CVE-2026-93674","Langflow OSS \u003C=1.12.2 - Unauthenticated RCE via Import Code Execution","2026-10-11T00:00:00Z",{"id":328,"detectable_with":329,"vuln_details":332,"vuln_id":351,"name":352,"published":353,"updated":78},29799,{"tool":330,"engine":331},{"id":84,"name":85},{"id":87,"name":88},{"id":328,"codename":78,"description":78,"severity":91,"risk_description":114,"public_description":333,"public_recommendation":334,"recommendation":78,"references":335,"cvssv3":343,"epss_score":344,"epss_percentile":345,"cve":346,"in_cisa_catalog":44,"date":348,"software_type":78,"vendor":349,"product":350,"ptt_exploit_capabilities":78},"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.","Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 \u002F 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.",[336,337,338,339,340,341,342],"http:\u002F\u002Fpacketstormsecurity.com\u002Ffiles\u002F168146\u002FZimbra-Zip-Path-Traversal.html","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FSecurity_Center","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Releases\u002F9.0.0\u002FP24","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Releases\u002F8.8.15\u002FP31","https:\u002F\u002Fwiki.zimbra.com\u002Fwiki\u002FZimbra_Security_Advisories","https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2022\u002F08\u002F10\u002Fmass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-27925",7.2,0.98676,0.99923,[347],"CVE-2022-27925","2022-04-21T00:00:00Z","synacor","zimbra_collaboration_suite","NETSCAN-NUCLEI-CVE-CVE-2022-27925","Zimbra Collaboration Suite 8.8.15\u002F9.0 - Zip Path Traversal","2026-10-08T00:00:00Z",{"id":355,"detectable_with":356,"vuln_details":359,"vuln_id":372,"name":373,"published":321,"updated":78},29797,{"tool":357,"engine":358},{"id":84,"name":85},{"id":87,"name":88},{"id":355,"codename":78,"description":78,"severity":113,"risk_description":221,"public_description":360,"public_recommendation":361,"recommendation":78,"references":362,"cvssv3":121,"epss_score":365,"epss_percentile":366,"cve":367,"in_cisa_catalog":9,"date":369,"software_type":78,"vendor":370,"product":371,"ptt_exploit_capabilities":78},"Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.","Update to the fixed versions: Jira 9.12.40\u002F10.3.26\u002F11.3.12, Confluence 9.2.26\u002F10.2.19, Bitbucket 9.4.26\u002F10.2.8\u002F10.5.1, Bamboo 10.2.24\u002F12.1.12, Crowd 6.3.7\u002F7.0.3\u002F7.1.7\u002F7.2.4, Crucible 4.9.15, Fisheye 4.9.15.",[363,364],"https:\u002F\u002Flabs.watchtowr.com\u002Fyou-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21589",0.02777,0.85995,[368],"CVE-2026-21589","2026-10-05T00:00:00Z","atlassian","jira,confluence,bitbucket","NETSCAN-NUCLEI-CVE-CVE-2026-21589","Atlassian Jira\u002FConfluence\u002FBitbucket - Pre-Auth Arbitrary File Read",{"id":375,"detectable_with":376,"vuln_details":379,"vuln_id":395,"name":396,"published":321,"updated":78},29798,{"tool":377,"engine":378},{"id":84,"name":85},{"id":87,"name":88},{"id":375,"codename":78,"description":78,"severity":91,"risk_description":380,"public_description":381,"public_recommendation":382,"recommendation":78,"references":383,"cvssv3":387,"epss_score":388,"epss_percentile":389,"cve":390,"in_cisa_catalog":9,"date":392,"software_type":78,"vendor":393,"product":394,"ptt_exploit_capabilities":78},"The risk exists that a remote attacker can relay the Exchange machine account to bypass authentication, access all mailboxes, and, when chained with a path-validation weakness, write an ASPX webshell to achieve SYSTEM-level remote code execution.","Microsoft Exchange Server on-premises (2016 CU23, 2019 CU14\u002FCU15, and Subscription Edition RTM) contains an authentication-bypass-by-capture-replay vulnerability in the HTTP.sys-hosted MRSProxy endpoint, which accepts Negotiate authentication without enforcing Extended Protection for Authentication channel bindings. An attacker can relay the Exchange machine account via NTLM to bypass authentication and elevate privileges, and when chained with a path-validation weakness, write an ASPX webshell to disk for pre-auth remote code execution as SYSTEM. Detection is version-based, comparing the OWA build number exposed in the \u002Fowa\u002Fauth\u002F\u003Cbuild>\u002F static resource path against Microsoft's August 2026 patched builds.","Install the August 2026 security update for your Exchange build (2016 CU23 >= 15.1.2507.72, 2019 CU14 >= 15.2.1544.44, 2019 CU15 >= 15.2.1748.49, SE RTM >= 15.2.2562.46) and enable Extended Protection for Authentication.",[384,385,386],"https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2026-62911","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-62911","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fexchange\u002Fnew-features\u002Fbuild-numbers-and-release-dates",8,0.00694,0.51603,[391],"CVE-2026-62911","2026-08-11T00:00:00Z","microsoft","exchange_server","NETSCAN-NUCLEI-CVE-CVE-2026-62911","Microsoft Exchange Server - Authentication Bypass",{"id":398,"detectable_with":399,"vuln_details":402,"vuln_id":415,"name":416,"published":417,"updated":78},29795,{"tool":400,"engine":401},{"id":84,"name":85},{"id":87,"name":88},{"id":398,"codename":78,"description":78,"severity":91,"risk_description":403,"public_description":404,"public_recommendation":405,"recommendation":78,"references":406,"cvssv3":409,"epss_score":410,"epss_percentile":411,"cve":412,"in_cisa_catalog":9,"date":414,"software_type":78,"vendor":146,"product":147,"ptt_exploit_capabilities":78},"An unauthenticated network caller can cause the gateway to make outbound HTTP requests. Dynamically linked builds that can load a compatible Go plugin may permit code execution.","When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.","Upgrade Bifrost to a release that requires genuine admin authentication for custom plugin paths, such as transports v2.1.0 or later, and enable dashboard authentication.",[407,408],"https:\u002F\u002Fgithub.com\u002Fmaximhq\u002Fbifrost\u002Fsecurity\u002Fadvisories\u002FGHSA-2qp8-4xgm-fw6g","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86242",8.1,0.03575,0.89113,[413],"CVE-2026-86242","2026-09-06T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-86242","Bifrost \u003C 1.6.3 - Unauthenticated Remote Plugin URL Fetch","2026-10-06T00:00:00Z",{"id":419,"detectable_with":420,"vuln_details":423,"vuln_id":437,"name":438,"published":417,"updated":78},29796,{"tool":421,"engine":422},{"id":84,"name":85},{"id":87,"name":88},{"id":419,"codename":78,"description":78,"severity":91,"risk_description":424,"public_description":425,"public_recommendation":426,"recommendation":78,"references":427,"cvssv3":409,"epss_score":430,"epss_percentile":431,"cve":432,"in_cisa_catalog":9,"date":434,"software_type":78,"vendor":435,"product":436,"ptt_exploit_capabilities":78},"Unauthenticated attackers can plant arbitrary files in the webroot, which can lead to remote code execution when the written file is reachable and interpreted by the server.","WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content\u002Fuploads\u002Fwpforms\u002Ftmp\u002F before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.","Update WPForms Pro to a version later than 1.10.1.1.",[428,429],"https:\u002F\u002Fgithub.com\u002FNxploited\u002FCVE-2026-10818","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10818",0.02482,0.84155,[433],"CVE-2026-10818","2026-07-25T00:00:00Z","awesome-motive","wpforms","NETSCAN-NUCLEI-CVE-CVE-2026-10818","WPForms Pro \u003C= 1.10.1.1 - Unauthenticated Arbitrary File Upload",{"id":440,"detectable_with":441,"vuln_details":444,"vuln_id":459,"name":460,"published":369,"updated":78},29793,{"tool":442,"engine":443},{"id":84,"name":85},{"id":87,"name":88},{"id":440,"codename":78,"description":78,"severity":91,"risk_description":445,"public_description":446,"public_recommendation":447,"recommendation":78,"references":448,"cvssv3":227,"epss_score":452,"epss_percentile":453,"cve":454,"in_cisa_catalog":9,"date":456,"software_type":78,"vendor":457,"product":458,"ptt_exploit_capabilities":78},"Unauthenticated attackers can manipulate order statuses, causing financial and operational disruption.","BlueSnap Payment Gateway for WooCommerce \u003C= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.","Update to the latest version of BlueSnap Payment Gateway for WooCommerce plugin.",[449,450,451],"https:\u002F\u002Fplugins.svn.wordpress.org\u002Fbluesnap-payment-gateway-for-woocommerce\u002Ftags\u002F3.4.0\u002Fincludes\u002Fclass-wc-bluesnap-ipn-webhooks.php","https:\u002F\u002Fplugins.svn.wordpress.org\u002Fbluesnap-payment-gateway-for-woocommerce\u002Ftags\u002F3.4.1\u002Fincludes\u002Fclass-wc-bluesnap-ipn-webhooks.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0692",0.00818,0.55956,[455],"CVE-2026-0692","2026-02-14T00:00:00Z","bluesnap","bluesnap-payment-gateway-for-woocommerce","NETSCAN-NUCLEI-CVE-CVE-2026-0692","BlueSnap Payment Gateway for WooCommerce \u003C=3.4.0 - IPN Authorization Bypass",{"id":462,"detectable_with":463,"vuln_details":466,"vuln_id":480,"name":481,"published":369,"updated":78},29794,{"tool":464,"engine":465},{"id":84,"name":85},{"id":87,"name":88},{"id":462,"codename":78,"description":78,"severity":113,"risk_description":114,"public_description":467,"public_recommendation":468,"recommendation":78,"references":469,"cvssv3":121,"epss_score":473,"epss_percentile":474,"cve":475,"in_cisa_catalog":9,"date":477,"software_type":78,"vendor":478,"product":479,"ptt_exploit_capabilities":78},"AVideo \u003C 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.","Upgrade to version 7.0 or later.",[470,471,472],"https:\u002F\u002Fgithub.com\u002FWWBN\u002FAVideo-Encoder\u002Fsecurity\u002Fadvisories\u002FGHSA-9j26-99jh-v26q","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-29058","https:\u002F\u002Fgithub.com\u002FWWBN\u002FAVideo-Encoder",0.06773,0.93844,[476],"CVE-2026-29058","2026-03-06T00:00:00Z","wwbn","avideo","NETSCAN-NUCLEI-CVE-CVE-2026-29058","WWBN AVideo Encoder \u003C 7.0 - Unauthenticated OS Command Injection",{"id":483,"detectable_with":484,"vuln_details":487,"vuln_id":502,"name":503,"published":369,"updated":78},29792,{"tool":485,"engine":486},{"id":84,"name":85},{"id":87,"name":88},{"id":483,"codename":78,"description":78,"severity":91,"risk_description":221,"public_description":488,"public_recommendation":489,"recommendation":78,"references":490,"cvssv3":227,"epss_score":496,"epss_percentile":497,"cve":498,"in_cisa_catalog":9,"date":500,"software_type":78,"vendor":501,"product":501,"ptt_exploit_capabilities":78},"Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handler returns the referenced file from the underlying host, letting unauthenticated attackers read any non-hidden file readable by the Yamcs service account whose path contains no dot segment.","Update to version 5.11.13, or 5.12.0 or later, which constrain resolved static file paths to the configured static roots.",[491,492,493,494,495],"https:\u002F\u002Fgithub.com\u002Fyamcs\u002Fyamcs\u002Fsecurity\u002Fadvisories\u002FGHSA-9jg3-g3wh-w9pj","https:\u002F\u002Fgithub.com\u002Fyamcs\u002Fyamcs\u002Fcommit\u002Ff4bc588880c166849e983aa8f65b9c8107d06091","https:\u002F\u002Fgithub.com\u002Fyamcs\u002Fyamcs\u002Fcommit\u002Fc7dfd24e469ae1086c23e0fe04401cb1ce4260d4","https:\u002F\u002Fgithub.com\u002Fyamcs\u002Fyamcs\u002Freleases\u002Ftag\u002Fyamcs-5.11.13","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55552",0.01722,0.7687,[499],"CVE-2026-55552","2026-08-28T00:00:00Z","yamcs","NETSCAN-NUCLEI-CVE-CVE-2026-55552","Yamcs \u003C=5.11.12 - Arbitrary File Read",{"id":505,"detectable_with":506,"vuln_details":509,"vuln_id":523,"name":524,"published":369,"updated":78},29791,{"tool":507,"engine":508},{"id":84,"name":85},{"id":87,"name":88},{"id":505,"codename":78,"description":78,"severity":200,"risk_description":510,"public_description":511,"public_recommendation":512,"recommendation":78,"references":513,"cvssv3":207,"epss_score":516,"epss_percentile":517,"cve":518,"in_cisa_catalog":9,"date":520,"software_type":78,"vendor":521,"product":522,"ptt_exploit_capabilities":78},"Unauthenticated attackers can access sensitive email notification configurations, potentially leading to data leakage and abuse of downstream systems.","SureForms WordPress plugin \u003C= 1.13.1 contains a sensitive information exposure caused by setting 'auth_callback' to '__return_true' in '_srfm_email_notification' post meta registration, letting unauthenticated attackers access sensitive email notification data, exploit requires no authentication.","Update to the latest version beyond 1.13.1.",[514,515],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fsureforms\u002Fvulnerability\u002Fwordpress-sureforms-plugin-1-13-1-unauthenticated-sensitive-information-exposure-vulnerability","https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fwordpress-plugins\u002Fsureforms\u002Fsureforms-1131-missing-authorization-to-unauthenticated-sensitive-information-exposure",0.00791,0.5505,[519],"CVE-2025-12536","2025-11-13T00:00:00Z","brainstormforce","sureforms","NETSCAN-NUCLEI-CVE-CVE-2025-12536","SureForms \u003C= 1.13.1 - Sensitive Information Exposure",{"id":526,"detectable_with":527,"vuln_details":530,"vuln_id":537,"name":538,"published":539,"updated":78},29787,{"tool":528,"engine":529},{"id":84,"name":85},{"id":87,"name":88},{"id":526,"codename":78,"description":78,"severity":91,"risk_description":531,"public_description":532,"public_recommendation":533,"recommendation":78,"references":534,"cvssv3":78,"epss_score":78,"epss_percentile":78,"cve":78,"in_cisa_catalog":9,"date":78,"software_type":78,"vendor":78,"product":78,"ptt_exploit_capabilities":78},"The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","A Terraform state file was found exposed on the web server. State files map real world infrastructure to configuration and frequently store resource attributes such as passwords, private keys, database connection strings and access tokens in clear text, so public exposure can leak sensitive credentials for the managed infrastructure.","We suggest restricting access to the exposed resource.",[535,536],"https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Flanguage\u002Fstate","https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Flanguage\u002Fstate\u002Fsensitive-data","NETSCAN-NUCLEI-EXPOSURES-TERRAFORM-TFSTATE-EXPOSURE","Terraform State - File Exposure","2026-10-04T00:00:00Z",{"id":541,"detectable_with":542,"vuln_details":545,"vuln_id":559,"name":560,"published":539,"updated":78},29788,{"tool":543,"engine":544},{"id":84,"name":85},{"id":87,"name":88},{"id":541,"codename":78,"description":78,"severity":113,"risk_description":114,"public_description":546,"public_recommendation":547,"recommendation":78,"references":548,"cvssv3":553,"epss_score":554,"epss_percentile":555,"cve":556,"in_cisa_catalog":9,"date":558,"software_type":78,"vendor":78,"product":78,"ptt_exploit_capabilities":78},"Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The \u002Fcrawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.","Upgrade to Crawl4AI 0.8.0 or later, which removes __import__ from allowed_builtins in hook_manager.py and disables hooks by default (CRAWL4AI_HOOKS_ENABLED=false). As an interim mitigation, disable the Docker API deployment or restrict network access to it and add authentication.",[549,550,551,552],"https:\u002F\u002Fgithub.com\u002Funclecode\u002Fcrawl4ai\u002Fsecurity\u002Fadvisories\u002FGHSA-5882-5rx9-xgxp","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fcrawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter","https:\u002F\u002Fgithub.com\u002Funclecode\u002Fcrawl4ai\u002Fblob\u002Fmain\u002Fdocs\u002Fblog\u002Frelease-v0.8.0.md","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26216",10,0.06001,0.93168,[557],"CVE-2026-26216","2026-02-12T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-26216","Crawl4AI \u003C 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter",{"id":562,"detectable_with":563,"vuln_details":566,"vuln_id":571,"name":572,"published":539,"updated":78},29789,{"tool":564,"engine":565},{"id":84,"name":85},{"id":87,"name":88},{"id":562,"codename":78,"description":78,"severity":91,"risk_description":531,"public_description":567,"public_recommendation":533,"recommendation":78,"references":568,"cvssv3":78,"epss_score":78,"epss_percentile":78,"cve":78,"in_cisa_catalog":9,"date":78,"software_type":78,"vendor":78,"product":78,"ptt_exploit_capabilities":78},"A Terraform CLI configuration file (.terraformrc or terraform.rc) containing a credentials block was found exposed. This file stores API tokens used to authenticate the Terraform CLI to remote backends such as Terraform Cloud or Terraform Enterprise, so exposure can leak a valid token that grants access to remote state and workspaces.",[569,570],"https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fcli\u002Fconfig\u002Fconfig-file","https:\u002F\u002Fdeveloper.hashicorp.com\u002Fterraform\u002Fcli\u002Fconfig\u002Fconfig-file#credentials","NETSCAN-NUCLEI-EXPOSURES-TERRAFORMRC-CREDENTIALS-EXPOSURE","Terraform CLI Configuration - Credentials Exposure",{"id":574,"detectable_with":575,"vuln_details":578,"vuln_id":583,"name":584,"published":539,"updated":78},29790,{"tool":576,"engine":577},{"id":84,"name":85},{"id":87,"name":88},{"id":574,"codename":78,"description":78,"severity":200,"risk_description":531,"public_description":579,"public_recommendation":533,"recommendation":78,"references":580,"cvssv3":78,"epss_score":78,"epss_percentile":78,"cve":78,"in_cisa_catalog":9,"date":78,"software_type":78,"vendor":78,"product":78,"ptt_exploit_capabilities":78},"A Serverless Framework configuration file (serverless.yml) was found exposed on the web server. The file describes the service, cloud provider, functions and often provider level environment variables, IAM statements and plugin settings, which can disclose the application architecture and occasionally hardcoded secrets to an unauthenticated visitor.",[581,582],"https:\u002F\u002Fwww.serverless.com\u002Fframework\u002Fdocs\u002Fproviders\u002Faws\u002Fguide\u002Fserverless.yml","https:\u002F\u002Fwww.serverless.com\u002Fframework\u002Fdocs\u002Fproviders\u002Faws\u002Fguide\u002Ffunctions","NETSCAN-NUCLEI-EXPOSURES-SERVERLESS-FRAMEWORK-CONFIG-EXPOSURE","Serverless Framework - Configuration Exposure",{"id":586,"detectable_with":587,"vuln_details":590,"vuln_id":604,"name":605,"published":606,"updated":78},29777,{"tool":588,"engine":589},{"id":84,"name":85},{"id":87,"name":88},{"id":586,"codename":78,"description":78,"severity":91,"risk_description":78,"public_description":591,"public_recommendation":592,"recommendation":78,"references":593,"cvssv3":409,"epss_score":597,"epss_percentile":598,"cve":599,"in_cisa_catalog":9,"date":601,"software_type":78,"vendor":602,"product":603,"ptt_exploit_capabilities":78},"LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead.","Upgrade LiteLLM Proxy to 1.84.0 or later.",[594,595,596],"https:\u002F\u002Fgithub.com\u002FBerriAI\u002Flitellm\u002Fsecurity\u002Fadvisories\u002FGHSA-4xpc-pv4p-pm3w","https:\u002F\u002Fgithub.com\u002FBerriAI\u002Flitellm\u002Freleases\u002Ftag\u002Fv1.84.0","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49468",0.03033,0.87147,[600],"CVE-2026-49468","2026-06-22T00:00:00Z","berriai","litellm","NETSCAN-NUCLEI-CVE-CVE-2026-49468","LiteLLM Proxy \u003C 1.84.0 - Host Header Authentication Bypass","2026-10-02T00:00:00Z"]