Acunetix Premium - v.Security

Security checks

• Updated the vulnerability database (VDB)
• Added a new active security check for PHP2Shell vulnerabilities
• Added a new security check for the Cross-Origin-Embedder-Policy (COEP) HTTP response header
• Added a new security check for JavaScript source map exposure
• Added security check for insecure use of iframes
• Updated severity ratings for Angular versions 0.9.0–0.9.7, 0.9.9–0.9.19, 0.10.0–0.10.6, 0.16.2, 1.0.0–1.0.8, 1.1.0–1.1.5, 1.2.0–1.2.32, 2.0.0–2.0.2, 2.1.0–2.1.2, 2.2.0–2.2.4, 2.3.0, 2.3.1, 2.4.0–2.4.10, 4.0.0–4.0.3, 4.1.0–4.1.3, 4.2.0–4.2.6, 4.3.0–4.3.6, 4.4.0–4.4.7, 5.0.0–5.0.5, 5.1.0–5.1.3, 5.2.0–5.2.11, 6.0.0–6.0.9, 6.1.0–6.1.10, 7.0.0–7.0.4, 7.1.0–7.1.4, 7.2.0–7.2.16, 8.0.0–8.0.3, 8.1.0–8.1.3, 8.2.0–8.2.14, 9.0.0–9.0.7, 9.1.0–9.1.13, 10.0.0–10.0.14, 10.1.0–10.1.6, 10.2.0–10.2.5, 11.0.6–11.0.9, 11.1.0–11.1.2, 11.2.0–11.2.14, 12.0.0–12.0.5, 12.1.0–12.1.5, 12.2.0–12.2.17, 13.0.0–13.0.3, 13.1.0–13.1.3, 13.2.0–13.2.7, 13.3.0–13.3.12, 13.4.0, 14.0.0–14.0.7, 14.1.0–14.1.3, 14.2.0–14.2.12, 14.3.0, 15.0.0–15.0.4, 15.1.0–15.1.5, 15.2.0–15.2.10, 16.0.0–16.0.6, 16.1.0–16.1.9, 16.2.0–16.2.12, 17.0.0–17.0.9, 17.1.0–17.1.3, 17.2.0–17.2.4, 17.3.0–17.3.12, 18.0.0–18.0.7, 18.1.0–18.1.5, 18.2.0–18.2.14, 19.0.0–19.0.7, 19.1.0–19.1.8, 19.2.0–19.2.20, 19.2.24, 20.0.0–20.0.7, 20.1.0–20.1.8, 20.2.0–20.2.4, 20.3.0–20.3.18, 20.3.23, 20.3.25–20.3.33, 21.0.0–21.0.9, 21.1.0–21.1.6, 21.2.0–21.2.8, 21.2.17–21.2.25, 22.0.0–22.0.8, 22.1.0–22.1.7 from Medium to High
• Updated severity ratings for Apache Traffic Server versions 9.2.6–9.2.11, 10.0.2–10.0.6 from High to Critical
• Updated severity ratings for Artifactory versions 6.23.41, 6.23.42, 7.37.13–7.37.16, 7.38.4, 7.38.7, 7.38.8, 7.38.10, 7.39.4, 7.39.6, 7.41.4, 7.161.0 from High to Critical
• Updated severity ratings for Artifactory versions 7.59.0, 7.59.9, 7.59.11, 7.59.16, 7.59.18, 7.59.22, 7.63.5, 7.63.7, 7.63.8, 7.63.10, 7.63.11, 7.63.18, 7.68.7, 7.68.11, 7.68.13, 7.68.14, 7.68.17, 7.68.19, 7.71.2–7.71.5, 7.71.8, 7.76.2, 7.77.0 from Medium to Critical
• Updated severity ratings for Artifactory versions 7.161.15, 7.161.16 from Information to Critical
• Updated severity ratings for Artifactory versions 6.17.4, 6.18.0, 6.19, 6.20, 6.21, 6.21.1, 6.22, 6.22.1, 6.23, 7.0, 7.0.3, 7.1, 7.2, 7.3, 7.4, 7.5, 7.5.7, 7.6, 7.7, 7.8, 7.9, 7.10, 7.11, 7.12, 7.12.5, 7.14.14, 7.31.12, 7.37.17, 7.38.16, 7.38.17, 7.39.10, 7.41.6, 7.41.7, 7.41.12, 7.41.13, 7.42.1, 7.42.3, 7.42.5, 7.46.3, 7.46.6–7.46.13, 7.46.17, 7.47.7, 7.47.10–7.47.12, 7.47.14, 7.47.15, 7.49.3, 7.49.5, 7.49.6, 7.50.3, 7.50.5–7.50.7, 7.52.0, 7.52.1, 7.53.1–7.53.4, 7.55.1–7.55.4, 7.55.6, 7.55.9, 7.56.2, 7.56.4, 7.56.5, 7.57.1, 7.57.2, 7.57.5, 7.58.0–7.58.5, 7.59.5, 7.59.12, 7.61.3, 7.63.2, 7.63.4, 7.63.14, 7.64, 7.64.4, 7.65.3, 7.66.3, 7.67.0, 7.68.6, 7.71.0, 7.71.1, 7.71.9–7.71.11, 7.72.0, 7.72.1, 7.73.1, 7.74.0, 7.74.3, 7.75.3, 7.76.0, 7.77.1, 7.77.5, 7.77.6, 7.77.8, 7.79.2, 7.80.0, 7.81.1, 7.82.2, 7.83.1, 7.84.3, 7.84.6, 7.84.14–7.84.16, 7.86.0, 7.87.3, 7.88.0, 7.89.2, 7.90.1, 7.90.5–7.90.10, 7.90.13–7.90.15, 7.92.0, 7.92.3, 7.93.3, 7.94.1, 7.95.0, 7.96.3, 7.98.2, 7.98.7–7.98.13, 7.99.1, 7.100.2, 7.103.0, 7.103.1, 7.104.2, 7.104.6, 7.104.7, 7.104.10, 7.104.14, 7.104.15, 7.106.3, 7.106.4, 7.107.1, 7.108.3, 7.110.1, 7.111.1, 7.111.4, 7.111.7–7.111.10, 7.111.12, 7.112.0, 7.113.0, 7.114.2, 7.115.3, 7.116.3, 7.117.5, 7.117.8, 7.117.12, 7.117.14, 7.117.17, 7.119.0, 7.119.1, 7.122.2, 7.124.1, 7.125.3, 7.125.4, 7.125.6, 7.125.8–7.125.11, 7.126.0, 7.127.0, 7.128.0, 7.129.1, 7.130.0, 7.131.0, 7.132.1, 7.133.2, 7.133.3, 7.133.6, 7.133.8, 7.133.10, 7.134.0, 7.135.0, 7.136.0, 7.137.0, 7.139.1, 7.141.0, 7.146.34, 7.155.3, 7.156.2, 7.157.0, 7.158.4, 7.160.0, 7.161.20, 7.161.29 from Low to High
• Updated severity ratings for axios versions 1.16.0, 1.16.1, 1.17.0, 1.18.0, 1.18.1, 1.19.0, 1.20.0 from Medium to High
• Updated severity ratings for CakePHP versions 1.2.8, 1.3.0–1.3.5, 2.0.0–2.0.6, 2.1.0–2.1.5, 2.2.0–2.2.9, 2.3.0–2.3.10, 2.4.0–2.4.10, 2.5.0–2.5.9, 2.6.0–2.6.12, 2.7.0–2.7.9, 3.0.0–3.0.15, 3.1.0–3.1.4, 3.7.6, 4.0.0–4.0.10, 4.1.0–4.1.3 from High to Critical
• Updated severity ratings for CakePHP versions 1.0.1.2708, 1.1.3.2967, 1.1.4.3104, 1.1.5.3148, 1.1.6.3264, 1.1.7.3363, 1.1.8.3544, 1.2.0–1.2.7, 1.2.9–1.2.12, 1.3.6–1.3.21, 2.6.13, 2.7.10, 2.7.11, 2.8.0–2.8.9, 2.9.0–2.9.9, 2.10.0–2.10.24, 3.0.16–3.0.19, 3.1.5–3.1.14, 3.2.0–3.2.14, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.18, 3.6.0–3.6.15, 3.7.0–3.7.5, 3.7.7–3.7.9, 3.8.0–3.8.13, 3.9.0–3.9.10, 3.10.0–3.10.5, 4.1.4–4.1.7, 4.2.12, 4.3.11, 4.4.10–4.4.18, 4.5.0–4.5.12, 4.6.0–4.6.5, 5.0.0–5.0.11, 5.1.0–5.1.2, 5.1.4–5.1.10, 5.2.0–5.2.15, 5.3.0–5.3.7, 5.4.0–5.4.2 from Medium to Critical
• Updated severity ratings for contao versions 3.2.14, 3.5.39, 3.5.40, 4.0, 4.4.39–4.4.57, 4.5, 4.7.5–4.7.7, 4.8, 4.8.0–4.8.8, 4.9.0–4.9.40, 4.9.42, 4.10.0–4.10.7, 4.11.0–4.11.8, 4.12.0–4.12.7, 4.13.0–4.13.21, 4.13.28, 5.0.0–5.0.10, 5.1.0–5.1.4, 5.1.10, 5.3.0–5.3.14, 5.4.1, 5.4.2 from High to Critical
• Updated severity ratings for contao versions 4.13.22–4.13.27, 4.13.29–4.13.56, 5.3.15, 5.3.29–5.3.41, 5.4.0, 5.4.3–5.4.14, 5.5.0–5.5.16, 5.6.0–5.6.4 from Medium to Critical
• Updated severity rating for Coppermine version 1.6.10 from High to Low
• Updated severity ratings for Django versions 0.91, 3.2.24, 6.0.3–6.0.6 from Medium to High
• Updated severity ratings for Dolibarr versions 23.0.2, 23.0.3, 24.0.0, 24.0.1 from Medium to High
• Updated severity rating for Dolibarr version 23.0.4 from Low to High
• Updated severity ratings for DOMPurify versions 2.4.2–2.4.9, 2.5.0–2.5.9, 3.0.0–3.0.11, 3.1.0–3.1.7, 3.2.0–3.2.7, 3.3.0–3.3.3, 3.4.0–3.4.3, 3.4.5, 3.4.6 from Medium to High
• Updated severity ratings for Drupal versions 10.5.10, 10.6.9, 11.1.10, 11.2.12 from Critical to Medium
• Updated severity ratings for Envoy versions 1.35.13, 1.36.9, 1.36.10, 1.38.3, 1.38.4, 1.39.0, 1.39.1 from Medium to High
• Updated severity ratings for EspoCRM versions 9.1.8, 9.3.4–9.3.10, 10.0.0–10.0.8 from Medium to High
• Updated severity ratings for Grafana versions 12.2.4–12.2.8, 12.3.2–12.3.6, 12.4.0–12.4.3, 13.0.0, 13.0.1 from Medium to High
• Updated severity ratings for Java versions 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 from Medium to High
• Updated severity ratings for Jetty versions 12.0.33, 12.0.34, 12.1.7, 12.1.8 from High to Critical
• Updated severity ratings for Jetty versions 9.4.58–9.4.60, 10.0.26–10.0.28, 11.0.26–11.0.28 from Medium to Critical
• Updated severity ratings for LimeSurvey versions 7.0.14, 7.3.0 from Medium to High
• Updated severity rating for Lodash version 4.17.21 from Medium to Critical
• Updated severity ratings for MediaWiki versions 1.43.4–1.43.6, 1.44.1–1.44.3, 1.45.1 from High to Critical
• Updated severity ratings for MongoDB versions 4.4.30, 5.0.32, 5.0.33, 6.1.1, 6.2.0, 6.2.1, 6.3.0–6.3.2 from Medium to High
• Updated severity ratings for moveittransfer versions 2022.0.0, 2022.0.4–2022.0.9, 2022.1.0, 2022.1.5–2022.1.10, 2023.1.7–2023.1.10, 2023.1.12, 2024.0.3–2024.0.6, 2024.0.8, 2024.1.0, 2026.0.0 from High to Critical
• Updated severity ratings for moveittransfer versions 2019.0.6, 2019.0.7, 2019.1, 2019.1.3–2019.1.6, 2019.2, 2019.2.1–2019.2.3, 2020.0, 2020.0.5, 2020.0.6, 2020.1, 2020.1.1, 2020.1.4–2020.1.6, 2020.1.10, 2020.1.11, 2021.0, 2021.0.1, 2021.0.3, 2021.0.6–2021.0.9, 2021.1.0, 2021.1.4–2021.1.8, 2022.0.10, 2022.1.11, 2024.1.1–2024.1.7, 2025.0.0–2025.0.3 from Medium to Critical
• Updated severity ratings for NextJsReactFramework versions 1.0.0–1.0.2, 1.1.0–1.1.2, 1.2.0–1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0–2.3.2, 2.4.0–2.4.9, 3.0.1–3.0.6, 3.1.0, 3.2.0–3.2.3, 4.0.0–4.0.5, 4.1.0–4.1.4, 4.2.0–4.2.3, 5.0.0, 5.1.0, 6.0.0–6.0.3, 6.1.0–6.1.2, 7.0.0–7.0.3, 8.0.0–8.0.4, 8.1.1, 9.0.0–9.0.8, 9.1.0–9.1.8, 9.2.0–9.2.2, 9.3.0–9.3.5, 9.5.0–9.5.6, 10.0.0–10.0.9, 10.1.0–10.1.3, 10.2.0–10.2.3, 11.0.0, 11.0.1, 11.1.0–11.1.3, 12.3.5–12.3.7, 13.5.9–13.5.11, 14.2.25–14.2.35, 15.2.6–15.2.8, 15.3.6–15.3.8, 15.4.8–15.4.10, 15.5.7–15.5.20, 16.0.7–16.0.10, 16.1.0–16.1.7, 16.2.2–16.2.10 from High to Critical
• Updated severity ratings for NextJsReactFramework versions 3.0.0, 8.1.0 from Medium to Critical
• Updated severity ratings for NextJsReactFramework versions 4.4.0, 5.0.1, 6.0.4, 8.0.5, 9.0.9, 9.2.3, 9.3.6, 9.3.7, 9.4.0–9.4.5, 15.2.9, 15.3.9, 15.4.11, 15.5.1, 15.5.21–15.5.27, 16.0.11, 16.2.0, 16.2.1, 16.2.11, 16.2.12, 16.3.0–16.3.4 from Information to Critical
• Updated severity rating for Nexus version 3.18.1-01-3.38.0 from Medium to High
• Updated severity rating for OpenSSL version 4.0.1 from Medium to Critical
• Updated severity rating for OpenSSL version 4.0.2 from Medium to High
• Updated severity ratings for Oracle versions 19.3, 19.4, 19.5, 19.6, 19.7, 19.8, 19.9, 19.10, 19.11, 19.12, 19.13, 19.14, 19.15, 19.16, 19.17, 19.18, 19.19, 19.20, 19.21, 19.22, 19.23, 23.4, 23.8, 23.9 from High to Critical
• Updated severity ratings for Oracle versions 19.27, 21.3, 21.11, 21.12, 21.13, 21.14, 21.18 from Medium to Critical
• Updated severity rating for Oracle version 19.28 from Low to Critical
• Updated severity ratings for PHP versions 8.2.31, 8.3.30–8.3.32, 8.4.17–8.4.21, 8.5.2–8.5.6 from Medium to Critical
• Updated severity rating for phpList version 3.6.12 from Medium to High
• Updated severity ratings for phpList versions 3.5.5–3.5.8, 3.6.1–3.6.11, 3.6.13–3.6.17 from Low to High
• Updated severity ratings for Piwigo versions 13.0.0, 16.1.0, 16.2.0, 16.3.0, 16.4.0 from Low to Critical
• Updated severity rating for ReviveAdserver version 5.5.3 from Medium to High
• Updated severity ratings for Roundcube versions 1.6.7–1.6.12 from High to Critical
• Updated severity rating for Roundcube version 1.6.15 from Low to High
• Updated severity rating for Ruby version 1.9.0 from High to Critical
• Updated severity ratings for Skipper versions 0.10.253-1, 0.13.228–0.13.235, 0.17.13, 0.21.35, 0.22.118, 0.24.0–0.24.89, 0.25.0–0.25.7, 0.26.0–0.26.23, 0.27.0–0.27.100 from Medium to High
• Updated severity ratings for Squid versions 2.4.stable1–2.4.stable7, 2.6.stable1–2.6.stable23, 2.7.stable1–2.7.stable9 from Medium to High
• Updated severity ratings for TornadoWebServer versions 6.5.9, 6.5.10 from Medium to High
• Updated severity ratings for TornadoWebServer versions 1.0.0, 1.1.0, 1.2.0, 2.0.0, 2.1.0, 2.2.0, 6.5.5–6.5.8 from Low to High
• Updated severity ratings for WebLogic versions 14.1.2.0.0, 15.1.1.0.0 from High to Critical
• Updated severity ratings for WordPress versions 6.8, 6.8.1, 6.8.2 from Medium to Critical
• Updated severity ratings for WordPress versions 5.7.11–5.7.15, 5.8.9–5.8.11, 5.9.9–5.9.11, 6.1.6–6.1.8, 6.2.5–6.2.7, 6.3.4–6.3.6, 6.4.4–6.4.6, 6.5.2–6.5.6, 6.6, 6.6.1–6.6.3, 6.7, 6.7.1–6.7.3 from Medium to High
• Updated severity ratings for Wordpress versions 5.7.16, 5.7.17 from Medium to High
• Added vulnerability detection for Adobe ColdFusion:
  • Critical: CVE-2026-48282
• Added vulnerability detection for Angular:
  • High: CVE-2026-50168, CVE-2026-50170, CVE-2026-54268
  • Medium: CVE-2026-46417, CVE-2026-50169, CVE-2026-50171, CVE-2026-50184, CVE-2026-50555, CVE-2026-50556, CVE-2026-50557, CVE-2026-52725, CVE-2026-54264, CVE-2026-54265, CVE-2026-54266, CVE-2026-54267, CVE-2026-68945, CVE-2026-69149, CVE-2026-69151, CVE-2026-88056, CVE-2026-88057, CVE-2026-88058, CVE-2026-88059, CVE-2026-88060
• Added vulnerability detection for Apache:
  • Critical: CVE-2026-29167, CVE-2026-42535, CVE-2026-44631
  • High: CVE-2026-34355, CVE-2026-34356, CVE-2026-42536, CVE-2026-44185, CVE-2026-44186, CVE-2026-48913, CVE-2026-49975
  • Medium: CVE-2026-29170, CVE-2026-43951, CVE-2026-44119
• Added vulnerability detection for Apache Traffic Server:
  • Critical: CVE-2026-33267, CVE-2026-41920, CVE-2026-57834, CVE-2026-58150, CVE-2026-58155, CVE-2026-58162, CVE-2026-58163, CVE-2026-58177, CVE-2026-58179, CVE-2026-58185
  • High: CVE-2026-58151, CVE-2026-58153, CVE-2026-58154, CVE-2026-58157, CVE-2026-58159, CVE-2026-58161, CVE-2026-58164, CVE-2026-58175, CVE-2026-58178, CVE-2026-58180, CVE-2026-58181, CVE-2026-58182, CVE-2026-58183, CVE-2026-58184, CVE-2026-58186, CVE-2026-58187, CVE-2026-58188, CVE-2026-58189, CVE-2026-59173, CVE-2026-65324
  • Medium: CVE-2026-22068, CVE-2026-24033, CVE-2026-33930, CVE-2026-58152, CVE-2026-58156, CVE-2026-58158, CVE-2026-58160, CVE-2026-65100, CVE-2026-65325
• Added vulnerability detection for Artifactory:
  • Critical: CVE-2026-66014
  • High: CVE-2026-42016, CVE-2026-42017, CVE-2026-65616, CVE-2026-65617, CVE-2026-65921, CVE-2026-66015
  • Medium: CVE-2026-65618, CVE-2026-65922, CVE-2026-65923, CVE-2026-65924, CVE-2026-65925, CVE-2026-66018
  • Low: CVE-2026-42018
  • Information: CVE-2026-82329
• Added vulnerability detection for axios:
  • High: CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496
  • Medium: CVE-2026-44489, CVE-2026-101898, CVE-2026-101899, CVE-2026-101900, CVE-2026-101901, CVE-2026-101902, CVE-2026-101903, CVE-2026-101904, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101908, CVE-2026-101909
• Added vulnerability detection for Caddy:
  • High: CVE-2026-45135, CVE-2026-52844, CVE-2026-52845
  • Medium: CVE-2026-52846
  • Low: CVE-2026-45692
• Added vulnerability detection for CaddyWebServer:
  • Medium: CVE-2026-77281, CVE-2026-92284, CVE-2026-92700
• Added vulnerability detection for CakePHP:
  • Medium: CVE-2026-55590, CVE-2026-79752
• Added vulnerability detection for contao:
  • Critical: CVE-2026-107845
  • Medium: CVE-2026-107842, CVE-2026-107843, CVE-2026-107844, CVE-2026-107850, CVE-2026-107851
  • Low: CVE-2026-107848
• Added vulnerability detection for Coppermine:
  • High: CVE-2026-82482
• Added vulnerability detection for Django:
  • High: CVE-2026-15307
  • Medium: CVE-2026-6873, CVE-2026-8404, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920, CVE-2026-48587, CVE-2026-48588, CVE-2026-53877, CVE-2026-53878, CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, CVE-2026-87975
  • Low: CVE-2026-7666, CVE-2026-35193
• Added vulnerability detection for Dolibarr:
  • High: CVE-2026-71504, CVE-2026-71505, CVE-2026-71506
  • Medium: CVE-2026-71503, CVE-2026-71507, CVE-2026-71508, CVE-2026-71509, CVE-2026-71510, CVE-2026-71511, CVE-2026-77923, CVE-2026-81729, CVE-2026-89012, CVE-2026-107706
  • Low: CVE-2026-81728, CVE-2026-81730, CVE-2026-89013
• Added vulnerability detection for DOMPurify:
  • High: CVE-2026-47423, CVE-2026-65898
  • Medium: CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65904, CVE-2026-65911, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914, CVE-2026-66010, CVE-2026-109344, CVE-2026-109345
• Added vulnerability detection for Drupal:
  • Medium: CVE-2026-55803, CVE-2026-55804, CVE-2026-55806, CVE-2026-55808
  • Low: CVE-2026-55807
• Added vulnerability detection for Envoy:
  • High: CVE-2026-47204, CVE-2026-47220, CVE-2026-47221, CVE-2026-47774, CVE-2026-48042, CVE-2026-48044, CVE-2026-48497, CVE-2026-48706, CVE-2026-48743, CVE-2026-49975
  • Medium: CVE-2026-47205, CVE-2026-47207, CVE-2026-47692, CVE-2026-47775, CVE-2026-47778, CVE-2026-48090, CVE-2026-48521, CVE-2026-50572, CVE-2026-73511, CVE-2026-73549, CVE-2026-73551
  • Low: CVE-2026-73512, CVE-2026-73513, CVE-2026-73546, CVE-2026-73547, CVE-2026-73548, CVE-2026-73550, CVE-2026-73552, CVE-2026-73553
• Added vulnerability detection for EspoCRM:
  • High: CVE-2026-105833
  • Medium: CVE-2026-88896, CVE-2026-90934, CVE-2026-92298, CVE-2026-105831, CVE-2026-105832, CVE-2026-109957, CVE-2026-109958, CVE-2026-109959
• Added vulnerability detection for FrontAccounting:
  • Medium: CVE-2026-80210, CVE-2026-80211
• Added vulnerability detection for GeoServer:
  • High: CVE-2025-27511, CVE-2025-52465, CVE-2025-58175
• Added vulnerability detection for GibbonEdu:
  • Medium: CVE-2026-97864
• Added vulnerability detection for Grafana:
  • High: CVE-2026-8609, CVE-2026-33376, CVE-2026-33377, CVE-2026-33381, CVE-2026-33382, CVE-2026-42127
  • Medium: CVE-2026-8595, CVE-2026-9029, CVE-2026-10601, CVE-2026-28374, CVE-2026-28379, CVE-2026-28380, CVE-2026-28383, CVE-2026-33380
  • Low: CVE-2026-28378
• Added vulnerability detection for IBM RTC:
  • Medium: CVE-2024-51454, CVE-2025-33128
• Added vulnerability detection for IIS:
  • High: CVE-2026-49975
• Added vulnerability detection for Java:
  • High: CVE-2026-47057, CVE-2026-47058, CVE-2026-47063, CVE-2026-62574
  • Medium: CVE-2026-46917, CVE-2026-46968, CVE-2026-47021, CVE-2026-47027, CVE-2026-60147
  • Low: CVE-2026-47010, CVE-2026-47059
• Added vulnerability detection for Jenkins:
  • High: CVE-2026-53435
  • Medium: CVE-2026-53436, CVE-2026-53437, CVE-2026-53438, CVE-2026-53439, CVE-2026-53440, CVE-2026-53441, CVE-2026-53442
• Added vulnerability detection for Jetty:
  • Critical: CVE-2026-10050
  • High: CVE-2024-7708, CVE-2026-10051
  • Medium: CVE-2026-6790, CVE-2026-8384
• Added vulnerability detection for Joomla:
  • High: CVE-2026-48948, CVE-2026-48957, CVE-2026-48958
  • Medium: CVE-2026-48947, CVE-2026-48949, CVE-2026-48950, CVE-2026-48951, CVE-2026-48952, CVE-2026-48953, CVE-2026-48954, CVE-2026-48955, CVE-2026-48956
• Added vulnerability detection for LimeSurvey:
  • High: CVE-2026-50635, CVE-2026-50636, CVE-2026-102626
  • Medium: CVE-2026-91775, CVE-2026-92730, CVE-2026-97685
• Added vulnerability detection for LiteSpeed:
  • High: CVE-2026-31386
• Added vulnerability detection for markdown-it:
  • Medium: CVE-2026-48988
• Added vulnerability detection for MediaWiki:
  • Critical: CVE-2026-58025
  • High: CVE-2026-8857, CVE-2026-13706, CVE-2026-13707
  • Medium: CVE-2026-14358, CVE-2026-58024, CVE-2026-58026, CVE-2026-58027, CVE-2026-58028, CVE-2026-58029, CVE-2026-58030, CVE-2026-58032, CVE-2026-58033, CVE-2026-58037, CVE-2026-58038, CVE-2026-58517, CVE-2026-58518, CVE-2026-58520
• Added vulnerability detection for MongoDB:
  • High: CVE-2026-9740, CVE-2026-9753, CVE-2026-11933, CVE-2026-13059, CVE-2026-13072, CVE-2026-13077, CVE-2026-13078
  • Medium: CVE-2026-9735, CVE-2026-9741, CVE-2026-9742, CVE-2026-9743, CVE-2026-9746, CVE-2026-9747, CVE-2026-9748, CVE-2026-9749, CVE-2026-9750, CVE-2026-9751, CVE-2026-9752, CVE-2026-9754, CVE-2026-13055, CVE-2026-13056, CVE-2026-13057, CVE-2026-13058, CVE-2026-13060, CVE-2026-13061, CVE-2026-13062, CVE-2026-13063, CVE-2026-13064, CVE-2026-13065, CVE-2026-13066, CVE-2026-13067, CVE-2026-13068, CVE-2026-13069, CVE-2026-13070, CVE-2026-13071, CVE-2026-13073, CVE-2026-13074, CVE-2026-13075, CVE-2026-13076
• Added vulnerability detection for moveittransfer:
  • Critical: CVE-2026-8649, CVE-2026-8801, CVE-2026-10697, CVE-2026-15966, CVE-2026-15967
  • High: CVE-2026-8650, CVE-2026-8651, CVE-2026-8800, CVE-2026-10698, CVE-2026-10699
  • Medium: CVE-2026-11903, CVE-2026-15968
• Added vulnerability detection for Next.js:
  • High: CVE-2026-64641, CVE-2026-64642
  • Medium: CVE-2026-64643, CVE-2026-64644, CVE-2026-64645, CVE-2026-64646, CVE-2026-64647, CVE-2026-64648, CVE-2026-64649
• Added vulnerability detection for NextJsReactFramework:
  • High: CVE-2026-94483
  • Medium: CVE-2026-94484, CVE-2026-94485, CVE-2026-94543, CVE-2026-94544, CVE-2026-103004
  • Low: CVE-2026-94486
  • Information: CVE-2026-75604
• Added vulnerability detection for Nexus:
  • High: CVE-2026-3329
  • Medium: CVE-2026-10741, CVE-2026-77121, CVE-2026-77122, CVE-2026-77123, CVE-2026-77124, CVE-2026-77125
• Added vulnerability detection for nginx:
  • High: CVE-2026-42533, CVE-2026-49975
• Added vulnerability detection for Nginx:
  • High: CVE-2026-42533
• Added vulnerability detection for OpenResty:
  • High: CVE-2026-55233
• Added vulnerability detection for OpenSSL:
  • Critical: CVE-2026-34182
  • High: CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42765, CVE-2026-45445, CVE-2026-45447
  • Medium: CVE-2026-2673, CVE-2026-35188, CVE-2026-35189, CVE-2026-35191, CVE-2026-42766, CVE-2026-42767, CVE-2026-42769, CVE-2026-42771, CVE-2026-42772, CVE-2026-45446, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75803, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784
  • Low: CVE-2026-42768, CVE-2026-42770
• Added vulnerability detection for OpenVpnAccessServer:
  • High: CVE-2025-3110
• Added vulnerability detection for Oracle:
  • Critical: CVE-2026-46833, CVE-2026-47040, CVE-2026-61211, CVE-2026-71063, CVE-2026-71064, CVE-2026-71102
  • High: CVE-2026-46834, CVE-2026-46835, CVE-2026-47046, CVE-2026-60175, CVE-2026-71062
  • Medium: CVE-2026-46975, CVE-2026-47039, CVE-2026-47045, CVE-2026-47060, CVE-2026-47061, CVE-2026-71100
  • Low: CVE-2026-47038
• Added vulnerability detection for Oracle HTTP Server:
  • Critical: CVE-2026-60363, CVE-2026-60364, CVE-2026-60365, CVE-2026-60438
  • High: CVE-2026-60431, CVE-2026-60454, CVE-2026-60530
• Added vulnerability detection for Pega:
  • Medium: CVE-2026-1562, CVE-2026-1563
• Added vulnerability detection for Perl:
  • Critical: CVE-2026-13221
  • High: CVE-2026-57432
• Added vulnerability detection for PHP:
  • Critical: CVE-2026-17543, CVE-2026-17544
  • Medium: CVE-2026-7260, CVE-2026-14355
• Added vulnerability detection for phpList:
  • Low: CVE-2026-92806
• Added vulnerability detection for phpMyFAQ:
  • Medium: CVE-2026-34973
• Added vulnerability detection for Piwigo:
  • Low: CVE-2026-42323, CVE-2026-42324, CVE-2026-44642, CVE-2026-85750
  • Information: CVE-2026-42322, CVE-2026-62262
• Added vulnerability detection for PostgreSQL:
  • High: CVE-2026-6464, CVE-2026-6471, CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14676, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15741, CVE-2026-15742, CVE-2026-16238, CVE-2026-16239, CVE-2026-18408, CVE-2026-19385
  • Medium: CVE-2026-6470, CVE-2026-14663, CVE-2026-14666, CVE-2026-14672, CVE-2026-14678, CVE-2026-14681, CVE-2026-18024
  • Low: CVE-2026-6469, CVE-2026-14673, CVE-2026-16241
• Added vulnerability detection for PrestaShop:
  • Medium: CVE-2026-84186
• Added vulnerability detection for Python:
  • Critical: CVE-2025-13462
  • High: CVE-2026-3644, CVE-2026-4224, CVE-2026-15308
  • Medium: CVE-2026-0864, CVE-2026-4360
• Added vulnerability detection for ReviveAdserver:
  • High: CVE-2026-50741
  • Medium: CVE-2026-50739, CVE-2026-50740, CVE-2026-50742, CVE-2026-50744, CVE-2026-50745
• Added vulnerability detection for Roundcube:
  • Critical: CVE-2026-62643, CVE-2026-62644
  • High: CVE-2026-54433
  • Medium: CVE-2026-62641, CVE-2026-62642
  • Low: CVE-2026-48842
• Added vulnerability detection for Ruby on Rails:
  • Medium: CVE-2026-33167
• Added vulnerability detection for Serendipity:
  • Medium: CVE-2026-73628
• Added vulnerability detection for SharePoint:
  • Critical: CVE-2026-50522, CVE-2026-55040, CVE-2026-56164, CVE-2026-58644, CVE-2026-62826, CVE-2026-70306
  • High: CVE-2026-44819, CVE-2026-44824, CVE-2026-45454, CVE-2026-45456, CVE-2026-45458, CVE-2026-45471, CVE-2026-45475, CVE-2026-45484, CVE-2026-47294, CVE-2026-47298, CVE-2026-55021, CVE-2026-55032, CVE-2026-55033, CVE-2026-55034, CVE-2026-55038, CVE-2026-55045, CVE-2026-55052, CVE-2026-55055, CVE-2026-55125, CVE-2026-55127, CVE-2026-55128, CVE-2026-55130, CVE-2026-55132, CVE-2026-55134, CVE-2026-58277, CVE-2026-62827, CVE-2026-63514, CVE-2026-63520, CVE-2026-64901, CVE-2026-64921, CVE-2026-65658, CVE-2026-65663, CVE-2026-65665, CVE-2026-66805, CVE-2026-66808, CVE-2026-70321, CVE-2026-70324, CVE-2026-70326, CVE-2026-70355
  • Medium: CVE-2026-33113, CVE-2026-44821, CVE-2026-45453, CVE-2026-45462, CVE-2026-45464, CVE-2026-45465, CVE-2026-45467, CVE-2026-45468, CVE-2026-45479, CVE-2026-45481, CVE-2026-45483, CVE-2026-47634, CVE-2026-47636, CVE-2026-47637, CVE-2026-47638, CVE-2026-47639, CVE-2026-47640, CVE-2026-47641, CVE-2026-48560, CVE-2026-48562, CVE-2026-54108, CVE-2026-55016, CVE-2026-55019, CVE-2026-55020, CVE-2026-55023, CVE-2026-55026, CVE-2026-55027, CVE-2026-55028, CVE-2026-55030, CVE-2026-55047, CVE-2026-55050, CVE-2026-55051, CVE-2026-55121, CVE-2026-55124, CVE-2026-55126, CVE-2026-55135, CVE-2026-55142, CVE-2026-56157, CVE-2026-56192, CVE-2026-57105, CVE-2026-58639, CVE-2026-62829, CVE-2026-62837, CVE-2026-62839, CVE-2026-62917, CVE-2026-63512, CVE-2026-63516, CVE-2026-64897, CVE-2026-64900, CVE-2026-64902, CVE-2026-64916, CVE-2026-64922, CVE-2026-65660
  • Low: CVE-2026-45485, CVE-2026-55035
• Added vulnerability detection for Skipper:
  • High: CVE-2026-65604
  • Medium: CVE-2026-54246, CVE-2026-54247
  • Low: CVE-2026-65838, CVE-2026-86043
• Added vulnerability detection for Spring Boot:
  • Critical: CVE-2026-40976
  • High: CVE-2025-22235, CVE-2026-22731, CVE-2026-40972, CVE-2026-40973
  • Medium: CVE-2023-34055, CVE-2024-38807, CVE-2026-40970, CVE-2026-40971, CVE-2026-40974, CVE-2026-40975, CVE-2026-40977, CVE-2026-40992, CVE-2026-41001
• Added vulnerability detection for Spring Cloud Gateway:
  • High: CVE-2026-22750
• Added vulnerability detection for SQLite:
  • Critical: CVE-2026-51302
  • High: CVE-2026-11822, CVE-2026-11824, CVE-2026-51296, CVE-2026-51297, CVE-2026-51304
  • Medium: CVE-2026-51298
• Added vulnerability detection for Squid:
  • High: CVE-2026-61642
  • Medium: CVE-2026-47729, CVE-2026-50012
• Added vulnerability detection for Tomcat:
  • Critical: CVE-2026-53434, CVE-2026-55276, CVE-2026-59083, CVE-2026-59084
  • High: CVE-2026-53404, CVE-2026-55957, CVE-2026-66299
  • Medium: CVE-2026-50229, CVE-2026-55955, CVE-2026-55956
• Added vulnerability detection for TornadoWebServer:
  • High: CVE-2026-103262
  • Medium: CVE-2024-58384, CVE-2026-91991, CVE-2026-91992, CVE-2026-103261, CVE-2026-103263
  • Low: CVE-2023-54397, CVE-2024-14029, CVE-2026-82397, CVE-2026-91990
• Added vulnerability detection for uaparser.js:
  • Medium: CVE-2026-48125
• Added vulnerability detection for WebLogic:
  • Critical: CVE-2026-35263, CVE-2026-35292, CVE-2026-35298, CVE-2026-35300, CVE-2026-35301, CVE-2026-60198, CVE-2026-60199, CVE-2026-60200, CVE-2026-60202, CVE-2026-60204, CVE-2026-60205, CVE-2026-60206, CVE-2026-60208, CVE-2026-60291, CVE-2026-60292, CVE-2026-60294, CVE-2026-60672, CVE-2026-60696, CVE-2026-60698, CVE-2026-60702, CVE-2026-60977
  • High: CVE-2026-35258, CVE-2026-35259, CVE-2026-35299, CVE-2026-35302, CVE-2026-35303, CVE-2026-35311, CVE-2026-46848, CVE-2026-60153, CVE-2026-60196, CVE-2026-60201, CVE-2026-60203, CVE-2026-60207, CVE-2026-60293, CVE-2026-60312, CVE-2026-60313, CVE-2026-60343, CVE-2026-60415, CVE-2026-60527, CVE-2026-60528, CVE-2026-60529, CVE-2026-60679, CVE-2026-60680, CVE-2026-60699
  • Medium: CVE-2026-35291
• Added vulnerability detection for WordPress:
  • Critical: CVE-2026-60137, CVE-2026-63030
  • High: CVE-2026-64638
• Added vulnerability detection for Wordpress:
  • High: CVE-2026-87902

Improvements

• Source map detection: Detection of source maps is improved.
• Leaked secret detection: Detection of leaked secrets is improved with better coverage and adding GitHub tokens detection.
• fancyBox library version detection: Invicti now detects the fancyBox jQuery plugin and its version, enabling better coverage of known vulnerabilities in this library.
• Apache HTTP Server path traversal detection: Detection accuracy for CVE-2021-41773 and CVE-2021-42013 is improved.
• Admin interface detection: Detection coverage for exposed admin interfaces is improved.
• XSS in JSON security check: The XSS in JSON security check is now a separate, independently configurable script that you can enable or disable on its own.
• Default scan profiles: Crawling, discovery, and web application firewall (WAF) detection scripts are now included in the default scan profiles.
• CWE classifications: Discouraged CWE identifiers are replaced with currently recommended alternatives for 23 vulnerability types.
• CSTI security check: False positives for Client-Side Template Injection are reduced.
• Apache Struts2 Remote Code Execution check: False positives for S2-053 are reduced.
• Polyfill.io Supply Chain Compromise check: The check now includes the CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) classification.
• Time-based SQL injection detection: False positives are reduced. Invicti now verifies response delays with a proportionality check before confirming the vulnerability.