Nuclei Templates v10.4.4 - Release Notes
New Templates Added: 179 | CVEs Added: 43 | First-time contributions: 20 🔥 Release Highlights 🔥 [ CVE-2026-47668 ] DbGate - Remote Code Execution via Anonymous JWT ( @benharvey-sage ) [critical] 🔥 [ CVE-2026-46725 ] TYPO3 ceselector Extension - Insecure Deserialization ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-44578 ] Next.js WebSocket Upgrade Handler - SSRF ( @hacktron , @dhiyaneshdk ) [high] 🔥 [ CVE-2026-34486 ] Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-33453 ] Apache Camel camel-coap - Remote Code Execution ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-25545 ] Astro SSR - Server-Side Request Forgery ( @ritikchaddha ) [high] 🔥 [ CVE-2026-20182 ] Cisco Catalyst SD-WAN Controller - vHub Auth Bypass ( @sfewer-r7 , @Crypto-Cat ,.) [critical] 🔥 (kev) (vKEV) [ CVE-2026-9082 ] Drupal Core - SQL Injection via PostgreSQL Entity Query ( @slcyber , @dhiyaneshdk ) [critical] 🔥 (kev) (vKEV) [ CVE-2026-8181 ] WordPress Burst Statistics 3.4.0-3.4.1.1 - Auth Bypass (@0x_Akoko) [critical] 🔥 (kev) (vKEV) [ CVE-2026-5718 ] Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - RCE( @zer0p0int ) [critical] 🔥 (kev) (vKEV) [ CVE-2026-4810 ] Google ADK-Python - Unauthenticated Builder Endpoint ( @dwisiswant0 ) [critical] 🔥 [ CVE-2026-0740 ] Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload ( @whattheslime ) [critical] 🔥 (kev) (vKEV) [ CVE-2026-0545 ] MLflow Job API - Auth Bypass ( @dhiyaneshdk ) [critical] 🔥 [CVE-2025-62168] Squid Proxy - HTTP Auth Credentials Disclosure (@xtr0nix) [critical] 🔥 [ CVE-2025-34030 ] sar2html <=3.2.2 Plot Parameter - Remote Code Execution ( @gy741 , @TATANKA97 ) [critical] 🔥 (kev) (vKEV) [CVE-2025-32778] Web-Check < 2.0.1 Screenshot API - OS Command Injection ( @gugacyber ) [critical] 🔥 (kev) (vKEV) [ CVE-2024-32114 ] Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control ( @ChrisJr404 ) [high] 🔥 (kev) (vKEV) What's Changed Bug Fixes Corrected the classification.cve-id mismatch in the CVE-2024-38856 template, which was pointing to CVE-2024-32113 (PR #16277 ). Fixed a YAML parsing failure in gradio-image-ssrf caused by an unclosed string literal in DSL matchers, after the stricter govaluate fork surfaced it (PRs #16171 , #16210 , #16243 ). Added the missing cve-id classification to CVE-2023-2745 (PR #16152 ). Added the missing words key in CVE-2023-46347 , which previously caused a YAML syntax error and prevented execution (PR #16097 ). Resolved a duplicate template id conflict for fortisandbox-panel by renaming the Fortinet-scoped template (PR #16070 ) and removed the leftover duplicate plus stray contrastapi recon templates as release-prep cleanup (PR #16118 ). Renamed the malware template id from ransomware_windows_hydracrypt for consistency (PR #16114 ). Renamed the eol-magento template id to magento-eol to follow naming conventions (PR #16154 ). Relocated opendcim-detect.yaml out of the non-existent http/detect folder (PR #16266 ). Removed unused extractors from CVE-2025-13418 (PR #16204 ). False Negatives - CVE-2023-2745 : removed an unnecessary authentication requirement so the template fires against unauthenticated targets (Issue #16133 , PR #16139 ). - CVE-2021-40438 : added support for custom Interactsh server hostnames so detection no longer requires the oast* naming convention (Issue #12074 , PR #16052 ). False Positives - CVE-2026-3844 (Issue #16124 , PR #16161 ). - CVE-2025-22457 (Issue #15955 , PR #16162 ). - http-missing-security-headers: dropped the clear-site-data matcher on the base URL (Issue #12008 , PR #16050 ) and unanchored the Content-Type regexes so matches are position-independent (PR #16125 ). - workspace-one-uem panel: removed a matcher that misfired on paths placed inside content="" attributes (PR #16117 ). Enhancements Enhanced CVE-2026-33017 by removing the redundant build_public_tmp exploit request that relied on a null flow UUID (Issue #16134 , PR #16149 ). Converted legacy http/vulnerabilities template