{"schema_version":"2","view":"grouped","data":[{"id":3308,"cve_ids":["CVE-2026-76804"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via Workflow File-Protocol Gate Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76804","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76804","aliases":["CVE-2026-76804"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-28T19:17:51.204Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97","https://github.com/projectdiscovery/nuclei/pull/7489","https://github.com/projectdiscovery/nuclei/commit/638be4481d27f1bbf90f971bbf6e3023777f2089","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T19:17:43.334602Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:17:51.204Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:41:46.188Z"}}},"related_cves":[{"value":"CVE-2026-76804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eb6cbd49-5254-43a2-a13e-3e49b86be76e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76804","advisory_id":"eb6cbd49-5254-43a2-a13e-3e49b86be76e","event_types":["advisory"],"published_at":"2026-10-24T21:33:32.758771+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:41:46.188+00:00","detail_url":"/advisories/advisory%3Aeb6cbd49-5254-43a2-a13e-3e49b86be76e","group":{"id":"advisory:eb6cbd49-5254-43a2-a13e-3e49b86be76e","revision":1,"primary_event_id":3321,"change":"published","superseded_by":[],"changed":{"id":3321,"cve_ids":["CVE-2026-76804"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via Workflow File-Protocol Gate Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76804","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76804","aliases":["CVE-2026-76804"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-28T19:17:51.204Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97","https://github.com/projectdiscovery/nuclei/pull/7489","https://github.com/projectdiscovery/nuclei/commit/638be4481d27f1bbf90f971bbf6e3023777f2089","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T19:17:43.334602Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:17:51.204Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:41:46.188Z"}}},"related_cves":[{"value":"CVE-2026-76804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eb6cbd49-5254-43a2-a13e-3e49b86be76e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76804","advisory_id":"eb6cbd49-5254-43a2-a13e-3e49b86be76e","event_types":["advisory"],"published_at":"2026-10-24T21:33:32.758771+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:41:46.188+00:00","detail_url":"/events/3321"},"members":[{"id":3321,"cve_ids":["CVE-2026-76804"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via Workflow File-Protocol Gate Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76804","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76804","aliases":["CVE-2026-76804"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-28T19:17:51.204Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97","https://github.com/projectdiscovery/nuclei/pull/7489","https://github.com/projectdiscovery/nuclei/commit/638be4481d27f1bbf90f971bbf6e3023777f2089","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76804","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T19:17:43.334602Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T19:17:51.204Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:41:46.188Z"}}},"related_cves":[{"value":"CVE-2026-76804","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:eb6cbd49-5254-43a2-a13e-3e49b86be76e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76804","advisory_id":"eb6cbd49-5254-43a2-a13e-3e49b86be76e","event_types":["advisory"],"published_at":"2026-10-24T21:33:32.758771+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:41:46.188+00:00","detail_url":"/events/3321"}]}},{"id":2317,"cve_ids":["CVE-2026-76803"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via MySQL Client Sandbox Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76803","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76803","aliases":["CVE-2026-76803"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-25T23:44:38.902Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q","https://github.com/projectdiscovery/nuclei/pull/7473","https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76803","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:44:28.021604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:44:38.902Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:27:59.627Z"}}},"related_cves":[{"value":"CVE-2026-76803","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ec5a1114-40a2-4ba1-8035-4d3a7fa05394","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76803","advisory_id":"ec5a1114-40a2-4ba1-8035-4d3a7fa05394","event_types":["advisory"],"published_at":"2026-10-24T21:16:25.963166+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:27:59.627+00:00","detail_url":"/advisories/advisory%3Aec5a1114-40a2-4ba1-8035-4d3a7fa05394","group":{"id":"advisory:ec5a1114-40a2-4ba1-8035-4d3a7fa05394","revision":1,"primary_event_id":2319,"change":"published","superseded_by":[],"changed":{"id":2319,"cve_ids":["CVE-2026-76803"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via MySQL Client Sandbox Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76803","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76803","aliases":["CVE-2026-76803"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-25T23:44:38.902Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q","https://github.com/projectdiscovery/nuclei/pull/7473","https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76803","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:44:28.021604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:44:38.902Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:27:59.627Z"}}},"related_cves":[{"value":"CVE-2026-76803","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ec5a1114-40a2-4ba1-8035-4d3a7fa05394","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76803","advisory_id":"ec5a1114-40a2-4ba1-8035-4d3a7fa05394","event_types":["advisory"],"published_at":"2026-10-24T21:16:25.963166+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:27:59.627+00:00","detail_url":"/events/2319"},"members":[{"id":2319,"cve_ids":["CVE-2026-76803"],"payload":{"kind":"advisory","title":"Nuclei: Local File Read via MySQL Client Sandbox Bypass","summary":"Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.","evidence":"cve:CVE-2026-76803","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-76803","aliases":["CVE-2026-76803"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":">= 3.0.0, < 3.10.0"}]}],"modified":"2026-09-25T23:44:38.902Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q","https://github.com/projectdiscovery/nuclei/pull/7473","https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368","https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76803","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T23:44:28.021604Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T23:44:38.902Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-22T16:27:59.627Z"}}},"related_cves":[{"value":"CVE-2026-76803","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ec5a1114-40a2-4ba1-8035-4d3a7fa05394","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76803","advisory_id":"ec5a1114-40a2-4ba1-8035-4d3a7fa05394","event_types":["advisory"],"published_at":"2026-10-24T21:16:25.963166+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-22T16:27:59.627+00:00","detail_url":"/events/2319"}]}},{"id":1709,"cve_ids":["CVE-2026-92718"],"payload":{"kind":"advisory","title":"Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache","summary":"Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.","evidence":"cve:CVE-2026-92718","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-92718","aliases":["CVE-2026-92718"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/projectdiscovery/nuclei","vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":"3.7.0","lessThan":"3.11.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/projectdiscovery/nuclei/v3","collectionURL":"https://github.com/projectdiscovery/nuclei","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:52.529Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/issues/7663","https://github.com/projectdiscovery/nuclei","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84","https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76","https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92718","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T18:15:17.532307Z"}}}],"references":[{"url":"https://github.com/projectdiscovery/nuclei/issues/7663","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T18:15:47.955Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:52.529Z"}}},"related_cves":[{"value":"CVE-2026-92718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6de860c4-fa9e-417b-85ed-fe983e6dfbf6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92718","advisory_id":"6de860c4-fa9e-417b-85ed-fe983e6dfbf6","event_types":["advisory"],"published_at":"2026-10-24T21:06:01.098685+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-16T17:31:38.38+00:00","detail_url":"/advisories/advisory%3A6de860c4-fa9e-417b-85ed-fe983e6dfbf6","group":{"id":"advisory:6de860c4-fa9e-417b-85ed-fe983e6dfbf6","revision":1,"primary_event_id":1694,"change":"published","superseded_by":[],"changed":{"id":1694,"cve_ids":["CVE-2026-92718"],"payload":{"kind":"advisory","title":"Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache","summary":"Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.","evidence":"cve:CVE-2026-92718","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-92718","aliases":["CVE-2026-92718"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/projectdiscovery/nuclei","vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":"3.7.0","lessThan":"3.11.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/projectdiscovery/nuclei/v3","collectionURL":"https://github.com/projectdiscovery/nuclei","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:52.529Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/issues/7663","https://github.com/projectdiscovery/nuclei","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84","https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76","https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92718","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T18:15:17.532307Z"}}}],"references":[{"url":"https://github.com/projectdiscovery/nuclei/issues/7663","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T18:15:47.955Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:52.529Z"}}},"related_cves":[{"value":"CVE-2026-92718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6de860c4-fa9e-417b-85ed-fe983e6dfbf6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92718","advisory_id":"6de860c4-fa9e-417b-85ed-fe983e6dfbf6","event_types":["advisory"],"published_at":"2026-10-24T21:06:01.098685+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-16T17:31:38.38+00:00","detail_url":"/events/1694"},"members":[{"id":1694,"cve_ids":["CVE-2026-92718"],"payload":{"kind":"advisory","title":"Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache","summary":"Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.","evidence":"cve:CVE-2026-92718","products":[{"name":{"value":"nuclei","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-92718","aliases":["CVE-2026-92718"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/projectdiscovery/nuclei","vendor":"projectdiscovery","product":"nuclei","versions":[{"status":"affected","version":"3.7.0","lessThan":"3.11.1","versionType":"semver"}],"packageURL":"pkg:golang/github.com/projectdiscovery/nuclei/v3","collectionURL":"https://github.com/projectdiscovery/nuclei","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:52.529Z","provider":"cve","references":["https://github.com/projectdiscovery/nuclei/issues/7663","https://github.com/projectdiscovery/nuclei","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/templates/compile.go#L610-L624","https://github.com/projectdiscovery/nuclei/blob/v3.11.0/pkg/catalog/index/metadata.go#L78-L84","https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76","https://www.vulncheck.com/advisories/nuclei-from-3.7.0-before-3.11.1-template-signature-bypass-via-modification-time-only-cache"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-92718","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T18:15:17.532307Z"}}}],"references":[{"url":"https://github.com/projectdiscovery/nuclei/issues/7663","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T18:15:47.955Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:52.529Z"}}},"related_cves":[{"value":"CVE-2026-92718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6de860c4-fa9e-417b-85ed-fe983e6dfbf6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92718","advisory_id":"6de860c4-fa9e-417b-85ed-fe983e6dfbf6","event_types":["advisory"],"published_at":"2026-10-24T21:06:01.098685+00:00","technologies":["core-cve","nuclei"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-16T17:31:38.38+00:00","detail_url":"/events/1694"}]}}],"next_after":3308,"next_before":1709}