CVE-2026-76804 is a vulnerability in Nuclei, a vulnerability scanner, affecting versions from 3.0.0 to 3.10.0. The issue allows an untrusted, unsigned workflow to load a file-protocol template and read local files from the scanner host, even when file templates are not enabled. This affects CLI users running workflows with the -w option and SDK integrations accepting end-user workflows that rely on defaul [truncated]
CVE-2026-92718 Nuclei Template Signature Verification Bypass. Nuclei versions before 3.11.1 are vulnerable to a template signature verification bypass due to caching based solely on file modification time without content checksums. This allows attackers to replace verified templates with unsigned malicious content and restore the original modification time, potentially leading to arbitrary code execution. [truncated]
A vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction. This issue has been patched in version 3.8.0. The vulnerability affects Nuclei versions from 3.0.0 to before 3.8.0, and defenders should assess exposure and verify patch deployment. The issue allows unauth [truncated]
