Release Notes

Acunetix Standard & Premium

v.Security - 26 Oct 2026

Copy Link Copy Link

The latest release adds an active PHP2Shell check, new security checks, VDB updates, and improved detection with fewer false positives.

Security checks

Updated the vulnerability database (VDB)
Added a new active security check for PHP2Shell vulnerabilities
Added a new security check for the Cross-Origin-Embedder-Policy (COEP) HTTP response header
Added a new security check for JavaScript source map exposure
Added security check for insecure use of iframes
Updated severity ratings for Angular versions 0.9.0–0.9.7, 0.9.9–0.9.19, 0.10.0–0.10.6, 0.16.2, 1.0.0–1.0.8, 1.1.0–1.1.5, 1.2.0–1.2.32, 2.0.0–2.0.2, 2.1.0–2.1.2, 2.2.0–2.2.4, 2.3.0, 2.3.1, 2.4.0–2.4.10, 4.0.0–4.0.3, 4.1.0–4.1.3, 4.2.0–4.2.6, 4.3.0–4.3.6, 4.4.0–4.4.7, 5.0.0–5.0.5, 5.1.0–5.1.3, 5.2.0–5.2.11, 6.0.0–6.0.9, 6.1.0–6.1.10, 7.0.0–7.0.4, 7.1.0–7.1.4, 7.2.0–7.2.16, 8.0.0–8.0.3, 8.1.0–8.1.3, 8.2.0–8.2.14, 9.0.0–9.0.7, 9.1.0–9.1.13, 10.0.0–10.0.14, 10.1.0–10.1.6, 10.2.0–10.2.5, 11.0.6–11.0.9, 11.1.0–11.1.2, 11.2.0–11.2.14, 12.0.0–12.0.5, 12.1.0–12.1.5, 12.2.0–12.2.17, 13.0.0–13.0.3, 13.1.0–13.1.3, 13.2.0–13.2.7, 13.3.0–13.3.12, 13.4.0, 14.0.0–14.0.7, 14.1.0–14.1.3, 14.2.0–14.2.12, 14.3.0, 15.0.0–15.0.4, 15.1.0–15.1.5, 15.2.0–15.2.10, 16.0.0–16.0.6, 16.1.0–16.1.9, 16.2.0–16.2.12, 17.0.0–17.0.9, 17.1.0–17.1.3, 17.2.0–17.2.4, 17.3.0–17.3.12, 18.0.0–18.0.7, 18.1.0–18.1.5, 18.2.0–18.2.14, 19.0.0–19.0.7, 19.1.0–19.1.8, 19.2.0–19.2.20, 19.2.24, 20.0.0–20.0.7, 20.1.0–20.1.8, 20.2.0–20.2.4, 20.3.0–20.3.18, 20.3.23, 20.3.25–20.3.33, 21.0.0–21.0.9, 21.1.0–21.1.6, 21.2.0–21.2.8, 21.2.17–21.2.25, 22.0.0–22.0.8, 22.1.0–22.1.7 from Medium to High
Updated severity ratings for Apache Traffic Server versions 9.2.6–9.2.11, 10.0.2–10.0.6 from High to Critical
Updated severity ratings for Artifactory versions 6.23.41, 6.23.42, 7.37.13–7.37.16, 7.38.4, 7.38.7, 7.38.8, 7.38.10, 7.39.4, 7.39.6, 7.41.4, 7.161.0 from High to Critical
Updated severity ratings for Artifactory versions 7.59.0, 7.59.9, 7.59.11, 7.59.16, 7.59.18, 7.59.22, 7.63.5, 7.63.7, 7.63.8, 7.63.10, 7.63.11, 7.63.18, 7.68.7, 7.68.11, 7.68.13, 7.68.14, 7.68.17, 7.68.19, 7.71.2–7.71.5, 7.71.8, 7.76.2, 7.77.0 from Medium to Critical
Updated severity ratings for Artifactory versions 7.161.15, 7.161.16 from Information to Critical
Updated severity ratings for Artifactory versions 6.17.4, 6.18.0, 6.19, 6.20, 6.21, 6.21.1, 6.22, 6.22.1, 6.23, 7.0, 7.0.3, 7.1, 7.2, 7.3, 7.4, 7.5, 7.5.7, 7.6, 7.7, 7.8, 7.9, 7.10, 7.11, 7.12, 7.12.5, 7.14.14, 7.31.12, 7.37.17, 7.38.16, 7.38.17, 7.39.10, 7.41.6, 7.41.7, 7.41.12, 7.41.13, 7.42.1, 7.42.3, 7.42.5, 7.46.3, 7.46.6–7.46.13, 7.46.17, 7.47.7, 7.47.10–7.47.12, 7.47.14, 7.47.15, 7.49.3, 7.49.5, 7.49.6, 7.50.3, 7.50.5–7.50.7, 7.52.0, 7.52.1, 7.53.1–7.53.4, 7.55.1–7.55.4, 7.55.6, 7.55.9, 7.56.2, 7.56.4, 7.56.5, 7.57.1, 7.57.2, 7.57.5, 7.58.0–7.58.5, 7.59.5, 7.59.12, 7.61.3, 7.63.2, 7.63.4, 7.63.14, 7.64, 7.64.4, 7.65.3, 7.66.3, 7.67.0, 7.68.6, 7.71.0, 7.71.1, 7.71.9–7.71.11, 7.72.0, 7.72.1, 7.73.1, 7.74.0, 7.74.3, 7.75.3, 7.76.0, 7.77.1, 7.77.5, 7.77.6, 7.77.8, 7.79.2, 7.80.0, 7.81.1, 7.82.2, 7.83.1, 7.84.3, 7.84.6, 7.84.14–7.84.16, 7.86.0, 7.87.3, 7.88.0, 7.89.2, 7.90.1, 7.90.5–7.90.10, 7.90.13–7.90.15, 7.92.0, 7.92.3, 7.93.3, 7.94.1, 7.95.0, 7.96.3, 7.98.2, 7.98.7–7.98.13, 7.99.1, 7.100.2, 7.103.0, 7.103.1, 7.104.2, 7.104.6, 7.104.7, 7.104.10, 7.104.14, 7.104.15, 7.106.3, 7.106.4, 7.107.1, 7.108.3, 7.110.1, 7.111.1, 7.111.4, 7.111.7–7.111.10, 7.111.12, 7.112.0, 7.113.0, 7.114.2, 7.115.3, 7.116.3, 7.117.5, 7.117.8, 7.117.12, 7.117.14, 7.117.17, 7.119.0, 7.119.1, 7.122.2, 7.124.1, 7.125.3, 7.125.4, 7.125.6, 7.125.8–7.125.11, 7.126.0, 7.127.0, 7.128.0, 7.129.1, 7.130.0, 7.131.0, 7.132.1, 7.133.2, 7.133.3, 7.133.6, 7.133.8, 7.133.10, 7.134.0, 7.135.0, 7.136.0, 7.137.0, 7.139.1, 7.141.0, 7.146.34, 7.155.3, 7.156.2, 7.157.0, 7.158.4, 7.160.0, 7.161.20, 7.161.29 from Low to High
Updated severity ratings for axios versions 1.16.0, 1.16.1, 1.17.0, 1.18.0, 1.18.1, 1.19.0, 1.20.0 from Medium to High
Updated severity ratings for CakePHP versions 1.2.8, 1.3.0–1.3.5, 2.0.0–2.0.6, 2.1.0–2.1.5, 2.2.0–2.2.9, 2.3.0–2.3.10, 2.4.0–2.4.10, 2.5.0–2.5.9, 2.6.0–2.6.12, 2.7.0–2.7.9, 3.0.0–3.0.15, 3.1.0–3.1.4, 3.7.6, 4.0.0–4.0.10, 4.1.0–4.1.3 from High to Critical
Updated severity ratings for CakePHP versions 1.0.1.2708, 1.1.3.2967, 1.1.4.3104, 1.1.5.3148, 1.1.6.3264, 1.1.7.3363, 1.1.8.3544, 1.2.0–1.2.7, 1.2.9–1.2.12, 1.3.6–1.3.21, 2.6.13, 2.7.10, 2.7.11, 2.8.0–2.8.9, 2.9.0–2.9.9, 2.10.0–2.10.24, 3.0.16–3.0.19, 3.1.5–3.1.14, 3.2.0–3.2.14, 3.3.0–3.3.16, 3.4.0–3.4.14, 3.5.0–3.5.18, 3.6.0–3.6.15, 3.7.0–3.7.5, 3.7.7–3.7.9, 3.8.0–3.8.13, 3.9.0–3.9.10, 3.10.0–3.10.5, 4.1.4–4.1.7, 4.2.12, 4.3.11, 4.4.10–4.4.18, 4.5.0–4.5.12, 4.6.0–4.6.5, 5.0.0–5.0.11, 5.1.0–5.1.2, 5.1.4–5.1.10, 5.2.0–5.2.15, 5.3.0–5.3.7, 5.4.0–5.4.2 from Medium to Critical
Updated severity ratings for contao versions 3.2.14, 3.5.39, 3.5.40, 4.0, 4.4.39–4.4.57, 4.5, 4.7.5–4.7.7, 4.8, 4.8.0–4.8.8, 4.9.0–4.9.40, 4.9.42, 4.10.0–4.10.7, 4.11.0–4.11.8, 4.12.0–4.12.7, 4.13.0–4.13.21, 4.13.28, 5.0.0–5.0.10, 5.1.0–5.1.4, 5.1.10, 5.3.0–5.3.14, 5.4.1, 5.4.2 from High to Critical
Updated severity ratings for contao versions 4.13.22–4.13.27, 4.13.29–4.13.56, 5.3.15, 5.3.29–5.3.41, 5.4.0, 5.4.3–5.4.14, 5.5.0–5.5.16, 5.6.0–5.6.4 from Medium to Critical
Updated severity rating for Coppermine version 1.6.10 from High to Low
Updated severity ratings for Django versions 0.91, 3.2.24, 6.0.3–6.0.6 from Medium to High
Updated severity ratings for Dolibarr versions 23.0.2, 23.0.3, 24.0.0, 24.0.1 from Medium to High
Updated severity rating for Dolibarr version 23.0.4 from Low to High
Updated severity ratings for DOMPurify versions 2.4.2–2.4.9, 2.5.0–2.5.9, 3.0.0–3.0.11, 3.1.0–3.1.7, 3.2.0–3.2.7, 3.3.0–3.3.3, 3.4.0–3.4.3, 3.4.5, 3.4.6 from Medium to High
Updated severity ratings for Drupal versions 10.5.10, 10.6.9, 11.1.10, 11.2.12 from Critical to Medium
Updated severity ratings for Envoy versions 1.35.13, 1.36.9, 1.36.10, 1.38.3, 1.38.4, 1.39.0, 1.39.1 from Medium to High
Updated severity ratings for EspoCRM versions 9.1.8, 9.3.4–9.3.10, 10.0.0–10.0.8 from Medium to High
Updated severity ratings for Grafana versions 12.2.4–12.2.8, 12.3.2–12.3.6, 12.4.0–12.4.3, 13.0.0, 13.0.1 from Medium to High
Updated severity ratings for Java versions 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 from Medium to High
Updated severity ratings for Jetty versions 12.0.33, 12.0.34, 12.1.7, 12.1.8 from High to Critical
Updated severity ratings for Jetty versions 9.4.58–9.4.60, 10.0.26–10.0.28, 11.0.26–11.0.28 from Medium to Critical
Updated severity ratings for LimeSurvey versions 7.0.14, 7.3.0 from Medium to High
Updated severity rating for Lodash version 4.17.21 from Medium to Critical
Updated severity ratings for MediaWiki versions 1.43.4–1.43.6, 1.44.1–1.44.3, 1.45.1 from High to Critical
Updated severity ratings for MongoDB versions 4.4.30, 5.0.32, 5.0.33, 6.1.1, 6.2.0, 6.2.1, 6.3.0–6.3.2 from Medium to High
Updated severity ratings for moveittransfer versions 2022.0.0, 2022.0.4–2022.0.9, 2022.1.0, 2022.1.5–2022.1.10, 2023.1.7–2023.1.10, 2023.1.12, 2024.0.3–2024.0.6, 2024.0.8, 2024.1.0, 2026.0.0 from High to Critical
Updated severity ratings for moveittransfer versions 2019.0.6, 2019.0.7, 2019.1, 2019.1.3–2019.1.6, 2019.2, 2019.2.1–2019.2.3, 2020.0, 2020.0.5, 2020.0.6, 2020.1, 2020.1.1, 2020.1.4–2020.1.6, 2020.1.10, 2020.1.11, 2021.0, 2021.0.1, 2021.0.3, 2021.0.6–2021.0.9, 2021.1.0, 2021.1.4–2021.1.8, 2022.0.10, 2022.1.11, 2024.1.1–2024.1.7, 2025.0.0–2025.0.3 from Medium to Critical
Updated severity ratings for NextJsReactFramework versions 1.0.0–1.0.2, 1.1.0–1.1.2, 1.2.0–1.2.3, 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.3.0–2.3.2, 2.4.0–2.4.9, 3.0.1–3.0.6, 3.1.0, 3.2.0–3.2.3, 4.0.0–4.0.5, 4.1.0–4.1.4, 4.2.0–4.2.3, 5.0.0, 5.1.0, 6.0.0–6.0.3, 6.1.0–6.1.2, 7.0.0–7.0.3, 8.0.0–8.0.4, 8.1.1, 9.0.0–9.0.8, 9.1.0–9.1.8, 9.2.0–9.2.2, 9.3.0–9.3.5, 9.5.0–9.5.6, 10.0.0–10.0.9, 10.1.0–10.1.3, 10.2.0–10.2.3, 11.0.0, 11.0.1, 11.1.0–11.1.3, 12.3.5–12.3.7, 13.5.9–13.5.11, 14.2.25–14.2.35, 15.2.6–15.2.8, 15.3.6–15.3.8, 15.4.8–15.4.10, 15.5.7–15.5.20, 16.0.7–16.0.10, 16.1.0–16.1.7, 16.2.2–16.2.10 from High to Critical
Updated severity ratings for NextJsReactFramework versions 3.0.0, 8.1.0 from Medium to Critical
Updated severity ratings for NextJsReactFramework versions 4.4.0, 5.0.1, 6.0.4, 8.0.5, 9.0.9, 9.2.3, 9.3.6, 9.3.7, 9.4.0–9.4.5, 15.2.9, 15.3.9, 15.4.11, 15.5.1, 15.5.21–15.5.27, 16.0.11, 16.2.0, 16.2.1, 16.2.11, 16.2.12, 16.3.0–16.3.4 from Information to Critical
Updated severity rating for Nexus version 3.18.1-01-3.38.0 from Medium to High
Updated severity rating for OpenSSL version 4.0.1 from Medium to Critical
Updated severity rating for OpenSSL version 4.0.2 from Medium to High
Updated severity ratings for Oracle versions 19.3, 19.4, 19.5, 19.6, 19.7, 19.8, 19.9, 19.10, 19.11, 19.12, 19.13, 19.14, 19.15, 19.16, 19.17, 19.18, 19.19, 19.20, 19.21, 19.22, 19.23, 23.4, 23.8, 23.9 from High to Critical
Updated severity ratings for Oracle versions 19.27, 21.3, 21.11, 21.12, 21.13, 21.14, 21.18 from Medium to Critical
Updated severity rating for Oracle version 19.28 from Low to Critical
Updated severity ratings for PHP versions 8.2.31, 8.3.30–8.3.32, 8.4.17–8.4.21, 8.5.2–8.5.6 from Medium to Critical
Updated severity rating for phpList version 3.6.12 from Medium to High
Updated severity ratings for phpList versions 3.5.5–3.5.8, 3.6.1–3.6.11, 3.6.13–3.6.17 from Low to High
Updated severity ratings for Piwigo versions 13.0.0, 16.1.0, 16.2.0, 16.3.0, 16.4.0 from Low to Critical
Updated severity rating for ReviveAdserver version 5.5.3 from Medium to High
Updated severity ratings for Roundcube versions 1.6.7–1.6.12 from High to Critical
Updated severity rating for Roundcube version 1.6.15 from Low to High
Updated severity rating for Ruby version 1.9.0 from High to Critical
Updated severity ratings for Skipper versions 0.10.253-1, 0.13.228–0.13.235, 0.17.13, 0.21.35, 0.22.118, 0.24.0–0.24.89, 0.25.0–0.25.7, 0.26.0–0.26.23, 0.27.0–0.27.100 from Medium to High
Updated severity ratings for Squid versions 2.4.stable1–2.4.stable7, 2.6.stable1–2.6.stable23, 2.7.stable1–2.7.stable9 from Medium to High
Updated severity ratings for TornadoWebServer versions 6.5.9, 6.5.10 from Medium to High
Updated severity ratings for TornadoWebServer versions 1.0.0, 1.1.0, 1.2.0, 2.0.0, 2.1.0, 2.2.0, 6.5.5–6.5.8 from Low to High
Updated severity ratings for WebLogic versions 14.1.2.0.0, 15.1.1.0.0 from High to Critical
Updated severity ratings for WordPress versions 6.8, 6.8.1, 6.8.2 from Medium to Critical
Updated severity ratings for WordPress versions 5.7.11–5.7.15, 5.8.9–5.8.11, 5.9.9–5.9.11, 6.1.6–6.1.8, 6.2.5–6.2.7, 6.3.4–6.3.6, 6.4.4–6.4.6, 6.5.2–6.5.6, 6.6, 6.6.1–6.6.3, 6.7, 6.7.1–6.7.3 from Medium to High
Updated severity ratings for WordPress versions 5.7.16, 5.7.17 from Medium to High
Added vulnerability detection for Adobe ColdFusion:
- Critical: CVE-2026-48282
Added vulnerability detection for Angular:
- High: CVE-2026-50168, CVE-2026-50170, CVE-2026-54268
- Medium: CVE-2026-46417, CVE-2026-50169, CVE-2026-50171, CVE-2026-50184, CVE-2026-50555, CVE-2026-50556, CVE-2026-50557, CVE-2026-52725, CVE-2026-54264, CVE-2026-54265, CVE-2026-54266, CVE-2026-54267, CVE-2026-68945, CVE-2026-69149, CVE-2026-69151, CVE-2026-88056, CVE-2026-88057, CVE-2026-88058, CVE-2026-88059, CVE-2026-88060
Added vulnerability detection for Apache:
- Critical: CVE-2026-29167, CVE-2026-42535, CVE-2026-44631
- High: CVE-2026-34355, CVE-2026-34356, CVE-2026-42536, CVE-2026-44185, CVE-2026-44186, CVE-2026-48913, CVE-2026-49975
- Medium: CVE-2026-29170, CVE-2026-43951, CVE-2026-44119
Added vulnerability detection for Apache Traffic Server:
- Critical: CVE-2026-33267, CVE-2026-41920, CVE-2026-57834, CVE-2026-58150, CVE-2026-58155, CVE-2026-58162, CVE-2026-58163, CVE-2026-58177, CVE-2026-58179, CVE-2026-58185
- High: CVE-2026-58151, CVE-2026-58153, CVE-2026-58154, CVE-2026-58157, CVE-2026-58159, CVE-2026-58161, CVE-2026-58164, CVE-2026-58175, CVE-2026-58178, CVE-2026-58180, CVE-2026-58181, CVE-2026-58182, CVE-2026-58183, CVE-2026-58184, CVE-2026-58186, CVE-2026-58187, CVE-2026-58188, CVE-2026-58189, CVE-2026-59173, CVE-2026-65324
- Medium: CVE-2026-22068, CVE-2026-24033, CVE-2026-33930, CVE-2026-58152, CVE-2026-58156, CVE-2026-58158, CVE-2026-58160, CVE-2026-65100, CVE-2026-65325
Added vulnerability detection for Artifactory:
- Critical: CVE-2026-66014
- High: CVE-2026-42016, CVE-2026-42017, CVE-2026-65616, CVE-2026-65617, CVE-2026-65921, CVE-2026-66015
- Medium: CVE-2026-65618, CVE-2026-65922, CVE-2026-65923, CVE-2026-65924, CVE-2026-65925, CVE-2026-66018
- Low: CVE-2026-42018
- Information: CVE-2026-82329
Added vulnerability detection for axios:
- High: CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496
- Medium: CVE-2026-44489, CVE-2026-101898, CVE-2026-101899, CVE-2026-101900, CVE-2026-101901, CVE-2026-101902, CVE-2026-101903, CVE-2026-101904, CVE-2026-101905, CVE-2026-101906, CVE-2026-101907, CVE-2026-101908, CVE-2026-101909
Added vulnerability detection for Caddy:
- High: CVE-2026-45135, CVE-2026-52844, CVE-2026-52845
- Medium: CVE-2026-52846
- Low: CVE-2026-45692
Added vulnerability detection for CaddyWebServer:
- Medium: CVE-2026-77281, CVE-2026-92284, CVE-2026-92700
Added vulnerability detection for CakePHP:
- Medium: CVE-2026-55590, CVE-2026-79752
Added vulnerability detection for contao:
- Critical: CVE-2026-107845
- Medium: CVE-2026-107842, CVE-2026-107843, CVE-2026-107844, CVE-2026-107850, CVE-2026-107851
- Low: CVE-2026-107848
Added vulnerability detection for Coppermine:
- High: CVE-2026-82482
Added vulnerability detection for Django:
- High: CVE-2026-15307
- Medium: CVE-2026-6873, CVE-2026-8404, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920, CVE-2026-48587, CVE-2026-48588, CVE-2026-53877, CVE-2026-53878, CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, CVE-2026-87975
- Low: CVE-2026-7666, CVE-2026-35193
Added vulnerability detection for Dolibarr:
- High: CVE-2026-71504, CVE-2026-71505, CVE-2026-71506
- Medium: CVE-2026-71503, CVE-2026-71507, CVE-2026-71508, CVE-2026-71509, CVE-2026-71510, CVE-2026-71511, CVE-2026-77923, CVE-2026-81729, CVE-2026-89012, CVE-2026-107706
- Low: CVE-2026-81728, CVE-2026-81730, CVE-2026-89013
Added vulnerability detection for DOMPurify:
- High: CVE-2026-47423, CVE-2026-65898
- Medium: CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65904, CVE-2026-65911, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914, CVE-2026-66010, CVE-2026-109344, CVE-2026-109345
Added vulnerability detection for Drupal:
- Medium: CVE-2026-55803, CVE-2026-55804, CVE-2026-55806, CVE-2026-55808
- Low: CVE-2026-55807
Added vulnerability detection for Envoy:
- High: CVE-2026-47204, CVE-2026-47220, CVE-2026-47221, CVE-2026-47774, CVE-2026-48042, CVE-2026-48044, CVE-2026-48497, CVE-2026-48706, CVE-2026-48743, CVE-2026-49975
- Medium: CVE-2026-47205, CVE-2026-47207, CVE-2026-47692, CVE-2026-47775, CVE-2026-47778, CVE-2026-48090, CVE-2026-48521, CVE-2026-50572, CVE-2026-73511, CVE-2026-73549, CVE-2026-73551
- Low: CVE-2026-73512, CVE-2026-73513, CVE-2026-73546, CVE-2026-73547, CVE-2026-73548, CVE-2026-73550, CVE-2026-73552, CVE-2026-73553
Added vulnerability detection for EspoCRM:
- High: CVE-2026-105833
- Medium: CVE-2026-88896, CVE-2026-90934, CVE-2026-92298, CVE-2026-105831, CVE-2026-105832, CVE-2026-109957, CVE-2026-109958, CVE-2026-109959
Added vulnerability detection for FrontAccounting:
- Medium: CVE-2026-80210, CVE-2026-80211
Added vulnerability detection for GeoServer:
- High: CVE-2025-27511, CVE-2025-52465, CVE-2025-58175
Added vulnerability detection for GibbonEdu:
- Medium: CVE-2026-97864
Added vulnerability detection for Grafana:
- High: CVE-2026-8609, CVE-2026-33376, CVE-2026-33377, CVE-2026-33381, CVE-2026-33382, CVE-2026-42127
- Medium: CVE-2026-8595, CVE-2026-9029, CVE-2026-10601, CVE-2026-28374, CVE-2026-28379, CVE-2026-28380, CVE-2026-28383, CVE-2026-33380
- Low: CVE-2026-28378
Added vulnerability detection for IBM RTC:
- Medium: CVE-2024-51454, CVE-2025-33128
Added vulnerability detection for IIS:
- High: CVE-2026-49975
Added vulnerability detection for Java:
- High: CVE-2026-47057, CVE-2026-47058, CVE-2026-47063, CVE-2026-62574
- Medium: CVE-2026-46917, CVE-2026-46968, CVE-2026-47021, CVE-2026-47027, CVE-2026-60147
- Low: CVE-2026-47010, CVE-2026-47059
Added vulnerability detection for Jenkins:
- High: CVE-2026-53435
- Medium: CVE-2026-53436, CVE-2026-53437, CVE-2026-53438, CVE-2026-53439, CVE-2026-53440, CVE-2026-53441, CVE-2026-53442
Added vulnerability detection for Jetty:
- Critical: CVE-2026-10050
- High: CVE-2024-7708, CVE-2026-10051
- Medium: CVE-2026-6790, CVE-2026-8384
Added vulnerability detection for Joomla:
- High: CVE-2026-48948, CVE-2026-48957, CVE-2026-48958
- Medium: CVE-2026-48947, CVE-2026-48949, CVE-2026-48950, CVE-2026-48951, CVE-2026-48952, CVE-2026-48953, CVE-2026-48954, CVE-2026-48955, CVE-2026-48956
Added vulnerability detection for LimeSurvey:
- High: CVE-2026-50635, CVE-2026-50636, CVE-2026-102626
- Medium: CVE-2026-91775, CVE-2026-92730, CVE-2026-97685
Added vulnerability detection for LiteSpeed:
- High: CVE-2026-31386
Added vulnerability detection for markdown-it:
- Medium: CVE-2026-48988
Added vulnerability detection for MediaWiki:
- Critical: CVE-2026-58025
- High: CVE-2026-8857, CVE-2026-13706, CVE-2026-13707
- Medium: CVE-2026-14358, CVE-2026-58024, CVE-2026-58026, CVE-2026-58027, CVE-2026-58028, CVE-2026-58029, CVE-2026-58030, CVE-2026-58032, CVE-2026-58033, CVE-2026-58037, CVE-2026-58038, CVE-2026-58517, CVE-2026-58518, CVE-2026-58520
Added vulnerability detection for MongoDB:
- High: CVE-2026-9740, CVE-2026-9753, CVE-2026-11933, CVE-2026-13059, CVE-2026-13072, CVE-2026-13077, CVE-2026-13078
- Medium: CVE-2026-9735, CVE-2026-9741, CVE-2026-9742, CVE-2026-9743, CVE-2026-9746, CVE-2026-9747, CVE-2026-9748, CVE-2026-9749, CVE-2026-9750, CVE-2026-9751, CVE-2026-9752, CVE-2026-9754, CVE-2026-13055, CVE-2026-13056, CVE-2026-13057, CVE-2026-13058, CVE-2026-13060, CVE-2026-13061, CVE-2026-13062, CVE-2026-13063, CVE-2026-13064, CVE-2026-13065, CVE-2026-13066, CVE-2026-13067, CVE-2026-13068, CVE-2026-13069, CVE-2026-13070, CVE-2026-13071, CVE-2026-13073, CVE-2026-13074, CVE-2026-13075, CVE-2026-13076
Added vulnerability detection for moveittransfer:
- Critical: CVE-2026-8649, CVE-2026-8801, CVE-2026-10697, CVE-2026-15966, CVE-2026-15967
- High: CVE-2026-8650, CVE-2026-8651, CVE-2026-8800, CVE-2026-10698, CVE-2026-10699
- Medium: CVE-2026-11903, CVE-2026-15968
Added vulnerability detection for Next.js:
- High: CVE-2026-64641, CVE-2026-64642
- Medium: CVE-2026-64643, CVE-2026-64644, CVE-2026-64645, CVE-2026-64646, CVE-2026-64647, CVE-2026-64648, CVE-2026-64649
Added vulnerability detection for NextJsReactFramework:
- High: CVE-2026-94483
- Medium: CVE-2026-94484, CVE-2026-94485, CVE-2026-94543, CVE-2026-94544, CVE-2026-103004
- Low: CVE-2026-94486
- Information: CVE-2026-75604
Added vulnerability detection for Nexus:
- High: CVE-2026-3329
- Medium: CVE-2026-10741, CVE-2026-77121, CVE-2026-77122, CVE-2026-77123, CVE-2026-77124, CVE-2026-77125
Added vulnerability detection for nginx:
- High: CVE-2026-42533, CVE-2026-49975
Added vulnerability detection for Nginx:
- High: CVE-2026-42533
Added vulnerability detection for OpenResty:
- High: CVE-2026-55233
Added vulnerability detection for OpenSSL:
- Critical: CVE-2026-34182
- High: CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34183, CVE-2026-42764, CVE-2026-42765, CVE-2026-45445, CVE-2026-45447
- Medium: CVE-2026-2673, CVE-2026-35188, CVE-2026-35189, CVE-2026-35191, CVE-2026-42766, CVE-2026-42767, CVE-2026-42769, CVE-2026-42771, CVE-2026-42772, CVE-2026-45446, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75803, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784
- Low: CVE-2026-42768, CVE-2026-42770
Added vulnerability detection for OpenVpnAccessServer:
- High: CVE-2025-3110
Added vulnerability detection for Oracle:
- Critical: CVE-2026-46833, CVE-2026-47040, CVE-2026-61211, CVE-2026-71063, CVE-2026-71064, CVE-2026-71102
- High: CVE-2026-46834, CVE-2026-46835, CVE-2026-47046, CVE-2026-60175, CVE-2026-71062
- Medium: CVE-2026-46975, CVE-2026-47039, CVE-2026-47045, CVE-2026-47060, CVE-2026-47061, CVE-2026-71100
- Low: CVE-2026-47038
Added vulnerability detection for Oracle HTTP Server:
- Critical: CVE-2026-60363, CVE-2026-60364, CVE-2026-60365, CVE-2026-60438
- High: CVE-2026-60431, CVE-2026-60454, CVE-2026-60530
Added vulnerability detection for Pega:
- Medium: CVE-2026-1562, CVE-2026-1563
Added vulnerability detection for Perl:
- Critical: CVE-2026-13221
- High: CVE-2026-57432
Added vulnerability detection for PHP:
- Critical: CVE-2026-17543, CVE-2026-17544
- Medium: CVE-2026-7260, CVE-2026-14355
Added vulnerability detection for phpList:
- Low: CVE-2026-92806
Added vulnerability detection for phpMyFAQ:
- Medium: CVE-2026-34973
Added vulnerability detection for Piwigo:
- Low: CVE-2026-42323, CVE-2026-42324, CVE-2026-44642, CVE-2026-85750
- Information: CVE-2026-42322, CVE-2026-62262
Added vulnerability detection for PostgreSQL:
- High: CVE-2026-6464, CVE-2026-6471, CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14676, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15741, CVE-2026-15742, CVE-2026-16238, CVE-2026-16239, CVE-2026-18408, CVE-2026-19385
- Medium: CVE-2026-6470, CVE-2026-14663, CVE-2026-14666, CVE-2026-14672, CVE-2026-14678, CVE-2026-14681, CVE-2026-18024
- Low: CVE-2026-6469, CVE-2026-14673, CVE-2026-16241
Added vulnerability detection for PrestaShop:
- Medium: CVE-2026-84186
Added vulnerability detection for Python:
- Critical: CVE-2025-13462
- High: CVE-2026-3644, CVE-2026-4224, CVE-2026-15308
- Medium: CVE-2026-0864, CVE-2026-4360
Added vulnerability detection for ReviveAdserver:
- High: CVE-2026-50741
- Medium: CVE-2026-50739, CVE-2026-50740, CVE-2026-50742, CVE-2026-50744, CVE-2026-50745
Added vulnerability detection for Roundcube:
- Critical: CVE-2026-62643, CVE-2026-62644
- High: CVE-2026-54433
- Medium: CVE-2026-62641, CVE-2026-62642
- Low: CVE-2026-48842
Added vulnerability detection for Ruby on Rails:
- Medium: CVE-2026-33167
Added vulnerability detection for Serendipity:
- Medium: CVE-2026-73628
Added vulnerability detection for SharePoint:
- Critical: CVE-2026-50522, CVE-2026-55040, CVE-2026-56164, CVE-2026-58644, CVE-2026-62826, CVE-2026-70306
- High: CVE-2026-44819, CVE-2026-44824, CVE-2026-45454, CVE-2026-45456, CVE-2026-45458, CVE-2026-45471, CVE-2026-45475, CVE-2026-45484, CVE-2026-47294, CVE-2026-47298, CVE-2026-55021, CVE-2026-55032, CVE-2026-55033, CVE-2026-55034, CVE-2026-55038, CVE-2026-55045, CVE-2026-55052, CVE-2026-55055, CVE-2026-55125, CVE-2026-55127, CVE-2026-55128, CVE-2026-55130, CVE-2026-55132, CVE-2026-55134, CVE-2026-58277, CVE-2026-62827, CVE-2026-63514, CVE-2026-63520, CVE-2026-64901, CVE-2026-64921, CVE-2026-65658, CVE-2026-65663, CVE-2026-65665, CVE-2026-66805, CVE-2026-66808, CVE-2026-70321, CVE-2026-70324, CVE-2026-70326, CVE-2026-70355
- Medium: CVE-2026-33113, CVE-2026-44821, CVE-2026-45453, CVE-2026-45462, CVE-2026-45464, CVE-2026-45465, CVE-2026-45467, CVE-2026-45468, CVE-2026-45479, CVE-2026-45481, CVE-2026-45483, CVE-2026-47634, CVE-2026-47636, CVE-2026-47637, CVE-2026-47638, CVE-2026-47639, CVE-2026-47640, CVE-2026-47641, CVE-2026-48560, CVE-2026-48562, CVE-2026-54108, CVE-2026-55016, CVE-2026-55019, CVE-2026-55020, CVE-2026-55023, CVE-2026-55026, CVE-2026-55027, CVE-2026-55028, CVE-2026-55030, CVE-2026-55047, CVE-2026-55050, CVE-2026-55051, CVE-2026-55121, CVE-2026-55124, CVE-2026-55126, CVE-2026-55135, CVE-2026-55142, CVE-2026-56157, CVE-2026-56192, CVE-2026-57105, CVE-2026-58639, CVE-2026-62829, CVE-2026-62837, CVE-2026-62839, CVE-2026-62917, CVE-2026-63512, CVE-2026-63516, CVE-2026-64897, CVE-2026-64900, CVE-2026-64902, CVE-2026-64916, CVE-2026-64922, CVE-2026-65660
- Low: CVE-2026-45485, CVE-2026-55035
Added vulnerability detection for Skipper:
- High: CVE-2026-65604
- Medium: CVE-2026-54246, CVE-2026-54247
- Low: CVE-2026-65838, CVE-2026-86043
Added vulnerability detection for Spring Boot:
- Critical: CVE-2026-40976
- High: CVE-2025-22235, CVE-2026-22731, CVE-2026-40972, CVE-2026-40973
- Medium: CVE-2023-34055, CVE-2024-38807, CVE-2026-40970, CVE-2026-40971, CVE-2026-40974, CVE-2026-40975, CVE-2026-40977, CVE-2026-40992, CVE-2026-41001
Added vulnerability detection for Spring Cloud Gateway:
- High: CVE-2026-22750
Added vulnerability detection for SQLite:
- Critical: CVE-2026-51302
- High: CVE-2026-11822, CVE-2026-11824, CVE-2026-51296, CVE-2026-51297, CVE-2026-51304
- Medium: CVE-2026-51298
Added vulnerability detection for Squid:
- High: CVE-2026-61642
- Medium: CVE-2026-47729, CVE-2026-50012
Added vulnerability detection for Tomcat:
- Critical: CVE-2026-53434, CVE-2026-55276, CVE-2026-59083, CVE-2026-59084
- High: CVE-2026-53404, CVE-2026-55957, CVE-2026-66299
- Medium: CVE-2026-50229, CVE-2026-55955, CVE-2026-55956
Added vulnerability detection for TornadoWebServer:
- High: CVE-2026-103262
- Medium: CVE-2024-58384, CVE-2026-91991, CVE-2026-91992, CVE-2026-103261, CVE-2026-103263
- Low: CVE-2023-54397, CVE-2024-14029, CVE-2026-82397, CVE-2026-91990
Added vulnerability detection for uaparser.js:
- Medium: CVE-2026-48125
Added vulnerability detection for WebLogic:
- Critical: CVE-2026-35263, CVE-2026-35292, CVE-2026-35298, CVE-2026-35300, CVE-2026-35301, CVE-2026-60198, CVE-2026-60199, CVE-2026-60200, CVE-2026-60202, CVE-2026-60204, CVE-2026-60205, CVE-2026-60206, CVE-2026-60208, CVE-2026-60291, CVE-2026-60292, CVE-2026-60294, CVE-2026-60672, CVE-2026-60696, CVE-2026-60698, CVE-2026-60702, CVE-2026-60977
- High: CVE-2026-35258, CVE-2026-35259, CVE-2026-35299, CVE-2026-35302, CVE-2026-35303, CVE-2026-35311, CVE-2026-46848, CVE-2026-60153, CVE-2026-60196, CVE-2026-60201, CVE-2026-60203, CVE-2026-60207, CVE-2026-60293, CVE-2026-60312, CVE-2026-60313, CVE-2026-60343, CVE-2026-60415, CVE-2026-60527, CVE-2026-60528, CVE-2026-60529, CVE-2026-60679, CVE-2026-60680, CVE-2026-60699
- Medium: CVE-2026-35291
Added vulnerability detection for WordPress:
- Critical: CVE-2026-60137, CVE-2026-63030
- High: CVE-2026-64638
Added vulnerability detection for WordPress:
- High: CVE-2026-87902

Improvements

Source map detection: Detection of source maps is improved.
Leaked secret detection: Detection of leaked secrets is improved with better coverage and adding GitHub tokens detection.
fancyBox library version detection: Invicti now detects the fancyBox jQuery plugin and its version, enabling better coverage of known vulnerabilities in this library.
Apache HTTP Server path traversal detection: Detection accuracy for CVE-2021-41773 and CVE-2021-42013 is improved.
Admin interface detection: Detection coverage for exposed admin interfaces is improved.
XSS in JSON security check: The XSS in JSON security check is now a separate, independently configurable script that you can enable or disable on its own.
Default scan profiles: Crawling, discovery, and web application firewall (WAF) detection scripts are now included in the default scan profiles.
CWE classifications: Discouraged CWE identifiers are replaced with currently recommended alternatives for 23 vulnerability types.
CSTI security check: False positives for Client-Side Template Injection are reduced.
Apache Struts2 Remote Code Execution check: False positives for S2-053 are reduced.
Polyfill.io Supply Chain Compromise check: The check now includes the CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) classification.
Time-based SQL injection detection: False positives are reduced. Invicti now verifies response delays with a proportionality check before confirming the vulnerability.

v.Security - 21 Apr 2026

Copy Link Copy Link

New security checks and improved technology detection.

Security checks

Updated the vulnerability database (VDB) to version 20260421
Added a new security check for Cross-Origin Opener Policy (COOP)
Updated severity ratings for axios versions 1.7.8, 1.7.9, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.12.2 from High to Critical
Updated severity ratings for Django versions 4.2.26, 4.2.28, 5.2.8, 5.2.10, 5.2.11, 6.0, 6.0.1, 6.0.2 from High to Critical
Updated severity ratings for MediaWiki versions 1.39.6, 1.39.7, 1.39.8, 1.39.9, 1.39.10, 1.39.11, 1.39.12 from High to Critical
Updated severity ratings for MediaWiki versions 1.39.13, 1.43.0, 1.43.1, 1.43.2, 1.43.3, 1.44.0, 1.45.0 from Medium to Critical
Updated severity ratings for Tomcat versions 9.0.113, 9.0.114 from High to Critical
Updated severity ratings for XWiki Platform versions 17.4.0, 17.4.1, 17.4.2, 17.4.3, 17.5.0, 17.6.0 from High to Critical
Updated severity ratings for XWiki Platform versions 17.4.4, 17.4.5, 17.7.0, 17.8.0 from Medium to Critical
Added vulnerability detection for axios:
- Critical: CVE-2025-62718
Added vulnerability detection for Chamilo:
- Critical: CVE-2026-33698, CVE-2026-33707
- High: CVE-2026-31939, CVE-2026-31940, CVE-2026-32892, CVE-2026-32894, CVE-2026-32930, CVE-2026-32931, CVE-2026-33702, CVE-2026-33704, CVE-2026-33706, CVE-2026-33710
- Medium: CVE-2025-66447, CVE-2026-31941, CVE-2026-32932, CVE-2026-33141, CVE-2026-33705, CVE-2026-33708, CVE-2026-33737
Added vulnerability detection for Django:
- Critical: CVE-2026-4277
- High: CVE-2026-3902, CVE-2026-33034
- Medium: CVE-2026-33033
- Low: CVE-2026-4292
Added vulnerability detection for Dolibarr:
- Critical: CVE-2019-25710
Added vulnerability detection for Grafana:
- Medium: CVE-2026-21724
Added vulnerability detection for LimeSurvey:
- Medium: CVE-2025-63238
Added vulnerability detection for MediaWiki:
- Critical: CVE-2025-67484
- Medium: CVE-2025-67476, CVE-2025-67480
Added vulnerability detection for phpBB:
- High: CVE-2025-70810
- Medium: CVE-2025-70811
Added vulnerability detection for Python:
- Low: CVE-2026-4519
Added vulnerability detection for Roundcube:
- High: CVE-2026-35537
Added vulnerability detection for SharePoint:
- Medium: CVE-2026-32201
Added vulnerability detection for SQLite:
- High: CVE-2025-70873
Added vulnerability detection for Tomcat:
- Critical: CVE-2026-29145
- High: CVE-2026-24880, CVE-2026-29129, CVE-2026-29146, CVE-2026-34483, CVE-2026-34486, CVE-2026-34487
- Medium: CVE-2026-25854, CVE-2026-32990, CVE-2026-34500
Added vulnerability detection for XWiki Platform:
- Critical: CVE-2026-33229

v.Security - 16 Apr 2026

Copy Link Copy Link

New security checks and improved technology detection.

Security checks

Updated the vulnerability database (VDB) to version 20260414.
Added detection for exposed installers to reduce information disclosure risk and improve coverage.
Improved JSON parsing and aligned vulnerability tags for more accurate and reliable scan results.
Added detection for Nginx UI information disclosure (CVE-2026-27944).
Added detection for Citrix NetScaler memory overread (CVE-2026-3055).
Updated severity ratings for Joomla versions 3.10.14, 3.10.15, 3.10.16, 3.10.17, 3.10.18, 3.10.19, 3.10.20, 4.4.13, 5.2.6, 5.3.0, 5.3.1 from Medium to High
Updated severity ratings for Lodash versions 4.17.12, 4.17.13, 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20 from High to Critical
Updated severity ratings for Piwigo versions 2.9.2, 2.9.3, 2.9.4, 2.10.0, 2.10.1, 2.10.2, 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.5.0, 12.0.0, 12.1.0, 12.2.0, 12.3.0, 13.1.0, 13.2.0, 13.3.0, 13.4.0, 13.5.0, 13.7.0, 14.0.0, 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.5.0, 15.6.0 from High to Critical
Updated severity ratings for Piwigo versions 13.8.0, 15.0.0, 15.1.0, 15.2.0, 15.3.0, 15.4.0, 15.5.0 from Medium to Critical
Updated severity ratings for phpMyFAQ versions 4.0.16, 4.0.17, 4.0.18 from Medium to High
Added vulnerability detection for Jboss EAP:
- Critical: CVE-2026-28367
- High: CVE-2026-3260
Added vulnerability detection for Joomla:
- High: CVE-2026-21629, CVE-2026-21630, CVE-2026-23898, CVE-2026-23899
- Medium: CVE-2026-21631, CVE-2026-21632
Added vulnerability detection for Lodash:
- Critical: CVE-2026-4800
- Medium: CVE-2026-2950
Added vulnerability detection for MediaWiki:
- Medium: CVE-2025-67475, CVE-2025-67477, CVE-2025-67481, CVE-2025-67483
Added vulnerability detection for MongoDb:
- High: CVE-2026-4148
- Medium: CVE-2026-4147
Added vulnerability detection for Piwigo:
- Critical: CVE-2026-27634
- High: CVE-2026-27833, CVE-2026-27834, CVE-2026-27885
Added vulnerability detection for Roundcube:
- High: CVE-2026-35545
- Medium: CVE-2026-35539, CVE-2026-35540, CVE-2026-35541, CVE-2026-35542, CVE-2026-35543, CVE-2026-35544
- Low: CVE-2026-35538
Added vulnerability detection for TornadoWebServer:
- Medium: CVE-2026-35536
Added vulnerability detection for osTicket:
- Medium: CVE-2026-26895
Added vulnerability detection for phpBB:
- High: CVE-2019-25685
Added vulnerability detection for phpMyFAQ:
- High: CVE-2026-34728
- Medium: CVE-2026-32629, CVE-2026-34729
Added vulnerability detection for qdPM:
- High: CVE-2019-25669
Added vulnerability detection for wordpresspluginbackupmigration:
- Medium: CVE-2023-0958, CVE-2023-3977

v.Security - 24 Mar 2026

Copy Link Copy Link

New security checks and improved technology detection.

Security checks

Updated the vulnerability database (VDB) to version 20260324
Added a new security check of Chrome Logger information disclosure
Updated severity ratings for Craft CMS versions 4.17.0, 4.17.1, 4.17.2, 4.17.3, 5.9.0, 5.9.1, 5.9.2, 5.9.3, 5.9.4, 5.9.5, 5.9.6 from Medium to Critical
Updated severity ratings for LimeSurvey versions 1.72, 1.85, 1.86, 3.19.0, 3.19.1, 3.19.2, 3.19.3, 3.20.0, 3.20.2, 3.21.0, 3.21.1, 3.21.2, 3.21.3, 3.21.4, 3.21.5, 3.21.6, 3.22.0, 3.22.1, 3.22.2, 3.22.3, 3.22.4, 3.22.5, 3.22.6, 3.22.7, 3.22.8, 3.22.9, 3.22.10, 3.22.11, 3.22.12, 3.22.13, 3.22.14, 3.22.15, 3.22.16, 3.22.17, 3.22.18, 3.22.19, 3.22.20, 3.22.21, 3.22.210, 3.22.24, 3.22.25, 3.22.26, 3.22.27, 3.22.28, 3.22.29, 3.23.0, 3.23.1, 3.23.2, 3.23.3, 3.23.4, 3.23.5, 3.23.6, 3.23.7, 3.23.22, 3.23.32, 3.24.0, 3.24.1, 3.24.2, 3.24.3, 3.24.4, 3.24.5, 3.24.6, 3.25.0, 3.25.1, 3.25.2, 3.25.3, 3.25.4, 3.25.5, 3.25.6, 3.25.7, 3.25.8, 3.25.9, 3.25.10, 3.25.11, 3.25.12, 3.25.13, 3.25.14, 3.25.15, 3.25.16, 3.25.17, 3.25.18, 3.25.19, 3.25.20, 3.25.21, 3.25.22, 3.26.0, 3.26.1, 3.26.2, 3.26.3, 3.26.4, 3.26.5, 3.27.0, 3.27.1, 3.27.2, 3.27.3, 3.27.4, 3.27.5, 3.27.6, 3.27.7, 3.27.8, 3.27.9, 3.27.10, 3.27.11, 3.27.12, 3.27.13, 3.27.14, 3.27.16, 3.27.17, 3.27.18, 3.27.19, 3.27.20, 3.27.21, 3.27.22, 3.27.23, 3.27.24, 3.27.25, 3.27.26, 3.27.27, 3.27.28, 3.27.29, 3.27.30, 3.27.31, 3.27.32, 3.27.33, 3.27.34, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.1.7, 4.1.8, 4.1.9, 4.1.10, 4.1.11, 4.1.12, 4.1.13, 4.1.14, 4.1.15, 4.1.16, 4.1.17, 4.1.18, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.3.12, 4.3.13, 4.3.14, 4.3.15, 4.3.16, 4.3.17, 4.3.18, 4.3.19, 4.3.20, 4.3.21, 4.3.22, 4.3.23, 4.3.24, 4.3.25, 4.3.26, 4.3.27, 4.3.28, 4.3.29, 4.3.30, 4.3.31, 4.3.32, 4.3.33, 4.3.34, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, 4.4.12, 4.4.13, 4.4.14, 4.4.15, 4.4.16, 4.5.0, 4.5.1, 4.5.2, 4.6.0, 4.6.1, 4.6.2, 4.6.3, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.1.14, 5.1.15, 5.1.16, 5.1.17, 5.1.18, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.4.4, 6.2.9 from High to Critical
Updated severity ratings for OpenSSL versions 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.6.0 from Critical to High
Added vulnerability detection for CKEditor:

– Medium: CVE-2026-28343
Added vulnerability detection for Chamilo:

– Critical: CVE-2026-28430

– High: CVE-2026-30875, CVE-2026-30881

– Medium: CVE-2026-30876, CVE-2026-30882
Added vulnerability detection for Craft CMS:

– Critical: CVE-2026-32267

– High: CVE-2026-31857, CVE-2026-31858, CVE-2026-32263, CVE-2026-32264

– Medium: CVE-2026-31859, CVE-2026-32262, CVE-2026-33051
Added vulnerability detection for Jenkins:

– High: [CVE-2026-33001, CVE-2026-33002
Added vulnerability detection for LimeSurvey:

– Critical: CVE-2025-56422

– High: CVE-2025-56421
Added vulnerability detection for MediaWiki:

– Medium: CVE-2025-61636, CVE-2025-61637, CVE-2025-61638, CVE-2025-61639, CVE-2025-61640

– Low: CVE-2025-61634
Added vulnerability detection for NextJsReactFramework:

– High: CVE-2026-27979, CVE-2026-27980

– Medium: CVE-2026-27977, CVE-2026-27978, CVE-2026-29057
Added vulnerability detection for TornadoWebServer:

– High: CVE-2026-31958

Improvements

Better detection of Backup folders and files
Better detection of Shiro deserialization RCE
Fixed Prompt Injection testing in some edge cases

v.Security - 11 Mar 2026

Copy Link Copy Link

New security checks and improved technology detection.

Security checks

Updated the vulnerability database (VDB) to version 20260310
Improved technology detection
Updated severity ratings for Chamilo versions 1.10.0, 1.10.2, 1.10.4, 1.10.6, 1.10.8, 1.11.26, 1.8.6.1, 1.8.8.3, 1.9.0, 1.9.10, 1.9.10.2, 1.9.10.4, 1.9.6, 1.9.6.1, 1.9.8, 1.9.8.1, 1.9.8.2 from High to Critical
Updated severity rating for Chamilo version 1.11.24 from Medium to Critical
Updated severity ratings for Craft CMS versions 4.15.6.2, 4.16.17, 4.16.18, 4.16.19, 4.4.14, 4.5.6.1, 5.6.16, 5.7.1.1, 5.8.21, 5.8.22, 5.8.23 from High to Critical
Updated severity ratings for DotCMS versions 22.03, 22.03.2, 22.03.4, 22.03.5, 22.03.6, 22.03.7, 22.03.8, 22.03.9, 22.03.10, 22.03.11, 22.03.12, 22.03.13, 22.03.14, 22.03.15, 23.01.1, 23.01.2, 23.01.3, 23.01.4, 23.01.5, 23.01.6, 23.01.7, 23.01.8, 23.01.9, 23.01.10, 23.01.11, 23.01.12, 23.01.13, 23.01.14, 23.01.15, 23.01.16, 23.01.17, 23.10.24.0 from Medium to Critical
Updated severity ratings for EspoCRM versions 2.6.0, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.9.2, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.3.0, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 3.6.1, 3.6.2, 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.8.0, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.6.0, 4.7.0, 4.7.1, 4.7.2, 4.8.0, 4.8.1, 4.8.2, 4.8.3, 4.8.4, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.3.6, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.9, 5.7.10, 5.7.11, 5.8.0, 5.8.1, 5.8.2, 5.8.3, 5.8.4, 5.8.5 from High to Critical
Updated severity ratings for osCommerce versions 1.0.6.0, 1.0.7.0, 1.0.7.1, 1.0.7.2, 1.0.7.3, 1.0.7.4, 1.0.7.5, 1.0.7.6, 1.0.7.7, 1.0.7.8, 1.0.7.9, 1.1, 1.11, 1.12, 1.13, 2.3, 2.3.1, 2.3.2, 2.3.3, 2.3.3.1, 2.3.3.2, 2.3.3.3, 2.3.3.4, 2.3.4 from Medium to High
Added vulnerability detection for Chamilo:
- Critical: CVE-2025-50187, CVE-2025-50190, CVE-2025-50192, CVE-2025-50199, CVE-2025-52998
- High: CVE-2024-47886, CVE-2025-50188, CVE-2025-50189, CVE-2025-50191, CVE-2025-50193, CVE-2025-50194, CVE-2025-50195, CVE-2025-50196, CVE-2025-50197, CVE-2025-52469, CVE-2025-52482
- Medium: CVE-2024-50337, CVE-2025-50186, CVE-2025-50198, CVE-2025-52468, CVE-2025-52470, CVE-2025-52475, CVE-2025-52476, CVE-2025-52563, CVE-2025-52564
Added vulnerability detection for Craft CMS:
- Critical: CVE-2026-28697, CVE-2026-28783
- High: CVE-2026-28695, CVE-2026-28696, CVE-2026-28784
- Medium: CVE-2026-27129, CVE-2026-28781, CVE-2026-28782, CVE-2026-29069
Added vulnerability detection for DOMPurify:
- Medium: CVE-2025-15599, CVE-2026-0540
Added vulnerability detection for Django:
- High: CVE-2026-25673
- Low: CVE-2026-25674
Added vulnerability detection for DotCMS:
- Critical: CVE-2025-11165
Added vulnerability detection for EspoCRM:
- Critical: CVE-2020-37094
Added vulnerability detection for Jetty:
- High: CVE-2026-1605
- Medium: CVE-2025-11143
Added vulnerability detection for MediaWiki:
- Medium: CVE-2025-61645
Added vulnerability detection for Moodle:
- High: CVE-2025-67847
Added vulnerability detection for Underscore.js:
- High: CVE-2026-27601
Added vulnerability detection for Werkzeug:
- Medium: CVE-2026-27199
Added vulnerability detection for XWikiplatform:
- High: CVE-2025-55749
Added vulnerability detection for osCommerce:
- High: CVE-2019-25495, CVE-2019-25496, CVE-2019-25497
Added vulnerability detection for phpMyFAQ:
- High: CVE-2026-27836

v.Security - 04 Mar 2026

Copy Link Copy Link

New security checks and improved vulnerability detection.

Security checks

Updated the vulnerability database (VDB) to version 20260303
Added security check for CWP Remote Code Execution CVE-2025-48703
Improved detection of MongoDB vulnerabilities
Updated severity ratings for CaddyWebServer versions 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.10.10, 0.10.11, 0.10.12, 0.10.13, 0.10.14, 0.11.0, 0.11.1, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.3, 2.3.0, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4 from High to Critical
Updated severity rating for Grafana version 10.4.0 from Low to Medium
Updated severity rating for Markdownit version 14.1.0 from Medium to High
Updated severity ratings for Moodle versions 4.2.10, 4.2.11 from Medium to High
Updated severity ratings for Piwigo versions 14.0.0, 14.1.0, 14.2.0, 14.3.0, 14.4.0 from Medium to High
Added vulnerability detection for Angular:
- Medium: CVE-2026-22610, CVE-2026-27970
Added vulnerability detection for CKEditor:
- Medium: CVE-2021-21254, CVE-2024-45613, CVE-2025-61261
Added vulnerability detection for CaddyWebServer:
- Critical: CVE-2026-27586, CVE-2026-27587, CVE-2026-27588, CVE-2026-27590
- Medium: CVE-2026-27585, CVE-2026-27589
Added vulnerability detection for CakePHP:
- Medium: CVE-2026-23643
Added vulnerability detection for Chamilo:
- Medium: CVE-2026-1106
Added vulnerability detection for Craft CMS:
- Medium: CVE-2026-27126, CVE-2026-27127, CVE-2026-27128
Added vulnerability detection for Dolibarr:
- High: CVE-2019-25450, CVE-2019-25452
- Medium: CVE-2021-47779
Added vulnerability detection for Grafana:
- Medium: CVE-2025-41117, CVE-2026-21722
- Low: CVE-2026-21725
Added vulnerability detection for Markdownit:
- High: CVE-2026-2327
Added vulnerability detection for MongoDb:
- High: CVE-2026-1847, CVE-2026-1848, CVE-2026-1849, CVE-2026-1850
- Medium: CVE-2026-25609, CVE-2026-25610, CVE-2026-25613
Added vulnerability detection for Moodle:
- High: CVE-2026-26045, CVE-2026-26046
- Medium: CVE-2026-26047
Added vulnerability detection for NextJsReactFramework:
- High: CVE-2025-59472
Added vulnerability detection for Piwigo:
- High: CVE-2024-48928
- Medium: CVE-2025-62512

1 2 … 31 »