CVE-2026-41282

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-412839.9OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code executi CVE-2026-412847.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu CVE-2026-412854.3In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (CVE-2026-412866.5Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated a CVE-2026-412876.5Stack-based Buffer Overflow vulnerability in the WatchGuard Agent discovery service on Windows allows Overflow Buffers. An unauthenticated a CVE-2026-412887.8Incorrect permission assignment for a resource in the patch management component of the WatchGuard Agent on Windows allows an authenticated CVE-2026-41298.1There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access ho CVE-2026-412927.5NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of inco CVE-2026-412939.8Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 CVE-2026-412948.6OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variabl CVE-2026-412957.8OpenClaw before 2026.4.2 contains an improper trust boundary vulnerability allowing untrusted workspace channel shadows to execute during bu CVE-2026-412968.2OpenClaw before 2026.3.31 contains a time-of-check-time-of-use race condition in the remote filesystem bridge readFile function that allows