Nuclei Templates v10.4.3 - Release Notes
New Templates Added: 105 | CVEs Added: 62 | First-time contributions: 12 🔥 Release Highlights 🔥 [ CVE-2026-42167 ] ProFTPD mod_sql - Preauth User Backdoor ( @pussycat0x ) [high] 🔥 [ CVE-2026-41179 ] RClone RC - Command Injection ( @theamanrawat ) [critical] 🔥 [ CVE-2026-41176 ] Rclone RC - Broken Access Control ( @theamanrawat ) [critical] 🔥 [ CVE-2026-40466 ] Apache ActiveMQ - RCE via HTTP Discovery Transport Bypass ( @dhiyaneshdk ) [high] 🔥 [ CVE-2026-39808 ] Fortinet FortiSandbox - Command Injection ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-39363 ] Vite Dev Server - Arbitrary File Read ( @theamanrawat ) [high] 🔥 [ CVE-2026-35029 ] LiteLLM - Arbitrary File Read ( @theamanrawat ) [high] 🔥 [ CVE-2026-33626 ] LMDeploy - Server-Side Request Forgery ( @theamanrawat ) [high] (kev) (vKEV) 🔥 [ CVE-2026-33439 ] OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-33032 ] Nginx UI - Broken Access Control ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-33017 ] Langflow < 1.9.0 - Remote Code Execution ( @himind ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-27174 ] MajorDoMo - Unauthenticated RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-24423 ] SmarterMail - Remote Code Execution ( @jyoti369 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-4631 ] Cockpit Web Console < 360 - Remote Code Execution ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-3844 ] Breeze <= 2.4.4 - Arbitrary File Upload ( @theamanrawat , @ritikchaddha ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-13390 ] WP Directory Kit <= 1.4.4 - Authentication Bypass (@maxthepm) [critical] (kev) (vKEV) 🔥 [ CVE-2021-3152 ] Home Assistant HACS - Local File Inclusion ( @dhiyaneshdk ) [high] 🔥 What's Changed Bug Fixes CI: migrated nuclei GitHub action to native Node.js runtime (PR #16061 , PR #16049 ). Removed duplicate template for BeyondTrust (PR #16024 ). Removed duplicate matcher line in roundcube-log-disclosure.yaml (PR #16042 ). Corrected invalid cve-id classification field values across templates (PR #16023 ). Fixed invalid CPE format strings across templates (PR #15991 , PR #15828 ). Fixed tag formatting in CVE-2024-57727 , CVE-2023-38875 , CVE-2023-24322 (PR #15989 , PR #15897 , PR #15899 ). Corrected YAML formatting in Retool postMessage XSS template (PR #15952 ). Fixed file path for CVE-2026-2262 (PR #15998 ). Renamed joomla-htaccess.yaml → joomla-htaccess-file.yaml for clarity (PR #15987 ). Renamed contrastapi-domain-recon.yaml to correct directory (PR #16025 ). Renamed and updated superset-default-login.yaml (PR #15822 ). Release preparation for Nuclei Templates v10.4.2 (PR #15920 ). False Negatives Fixed FN in tomcat-default-login by ordering payloads to avoid LockOutRealm shunning (PR #16053 , Issue #15382 ). False Positives Reduced false positives and improved accuracy in the following templates: ingress-nginx-valid-admission.yaml — added 200-status guard for verbose-debug PHP frameworks (PR #16046 , Issue #14248 ). CVE-2024-2473 — verify hidden login URL disclosure to avoid FP on WPS Hide Login (PR #15985 , Issue #15871 ). CVE-2019-5544 — fix FP triggered when port 427 is closed (PR #15979 , Issue #15098 ). CVE-2023-45648 — bound Tomcat version regex (PR #15459 , Issue #15566 ). ldap-anonymous-login-detect.yaml — honor Port parameter instead of forcing 389 (PR #15430 , Issue #14736 ). sentry-panel — added title check to prevent FP (PR #15984 ). Enhancements Added Microsoft domain to mx-service-detector (PR #16030 ). Added registrar extractors to rdap-whois template (PR #15908 ). Added references to CVE-2020-15718 (PR #16058 ). Updated mitel-version-detect.yaml (PR #15839 ). Linked CVE-2021-31589 to existing beyond-trust-xss.yaml (Issue #15273 ). Templates Added [ CVE-2026-42167 ] ProFTPD mod_sql - Preauth User Backdoor ( @pussycat0x ) [high] 🔥 [ CVE-2026-42031 ] CKAN DataStore SQL Search - SQL Injection ( @theamanrawat ) [high] [ CVE-2026-41940 ] cPanel & WHM - Auth Bypass via Session-File CRLF Injection ( @wat