CVE-2026-92718
Last modified
CVE-2026-92718 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| projectdiscovery | nuclei | >= 3.7.0, < 3.11.1 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92718?
How severe is CVE-2026-92718?
How do I fix CVE-2026-92718?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92712The ReactPress – Create React App for WordPress plugin for W…6.4
- CVE-2026-92713The Modula Image Gallery – Photo Grid & Video Gallery plugin…8.1
- CVE-2026-92714The Download Manager plugin for WordPress is vulnerable to I…6.5
- CVE-2026-92715The Tutor LMS – eLearning and online course solution plugin …4.3
- CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
- CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
- CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme…7.5
- CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
- CVE-2026-92720Kubero through 3.1.1 fails to apply authentication guards to…9.1
- CVE-2026-92727The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Revie…6.4
- CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
- CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
Are you affected by CVE-2026-92718?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST