CVE-2026-92718
Last modified
CVE-2026-92718 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands..
Description
Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| projectdiscovery | nuclei | >= 3.7.0, < 3.11.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92718?
How severe is CVE-2026-92718?
How do I fix CVE-2026-92718?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92702Cocos AI is a confidential computing system for running AI w…9.1
- CVE-2026-92708Svelte devalue is a JavaScript library that serializes value…7.5
- CVE-2026-9271Vulnerability Title5.9
- CVE-2026-92714The Download Manager plugin for WordPress is vulnerable to I…6.5
- CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
- CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
- CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme…7.5
- CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
- CVE-2026-92720Kubero through 3.1.1 fails to apply authentication guards to…9.1
- CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
- CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
- CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
Are you affected by CVE-2026-92718?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST