Loading story…
ProjectDiscovery's nuclei-templates repository received new pull requests adding exposure-detection templates for BaGet and Devtron. One submission, opened by DhiyaneshGeek, adds a template for detecting BaGet exposure and was marked verified:true, configured with max-request: 1, and validated with a Shodan query. The pull request carried a verified GitHub signature, was labeled Ready to merge, and automated review reported no security issues in the template.
A separate pull request by johnk3r adds two Devtron-focused templates: one to identify an exposed Devtron panel and another to detect an exposed env-config JavaScript file. The author said the templates were tested against both vulnerable and patched targets to improve accuracy and reduce false positives, while ProjectDiscovery's automated checks also found no security issues. Together, the submissions expand Nuclei coverage for identifying publicly exposed package management and DevOps administration assets.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A separate GitHub pull request (#15870) was opened in the same repository to add two Nuclei templates for detecting exposed Devtron panel and env-config resources. The submitter stated the templates were validated against vulnerable and patched targets, and automated review found no security issues.
A GitHub pull request (#15857) was opened in the projectdiscovery/nuclei-templates repository to add a new Nuclei template for detecting BaGet exposure. Automated review reported no security issues and marked the template as verified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery contributors submitted new **Nuclei** detection content to expand coverage for two separate security issues: `CVE-2021-42392` and an unauthenticated exposure condition affecting **PhotoPrism**. Pull request **#15734**, opened by **maciejklimek**, proposes adding a template for `CVE-2021-42392`, while pull request **#15766**, opened by **pussycat0x**, adds `photoprism-unauth-exposure.yaml` to identify publicly accessible PhotoPrism instances without authentication. Both submissions were presented as defensive scanning updates in the `projectdiscovery/nuclei-templates` repository and included standard validation notes stating they were tested against vulnerable and patched targets. Repository automation requested reviewer attention, and the PhotoPrism template was marked ready to merge, while the `CVE-2021-42392` template remained open pending review; neither reference indicated an active intrusion campaign or confirmed breach tied to the detections.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received two new detection-template pull requests from contributor **pussycat0x**: one for **OpenText Filr guest access exposure** and another for **`CVE-2024-8252`**. The OpenText Filr submission proposes a template named `opentext-filr-guest-access.yaml` aimed at identifying instances where guest access is exposed, indicating a configuration or exposure check rather than a clearly documented CVE-based issue. A second pull request adds `CVE-2024-8252.yaml`, expanding Nuclei coverage for a separate vulnerability identified by CVE. In both submissions, the contributor stated the templates were validated against vulnerable and patched targets to improve detection accuracy and reduce false positives, while repository automation assigned reviewers and labels; the CVE template remained open, and automated review tooling was unable to complete analysis on at least one of the submissions during the captured review cycle.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository received new pull requests to detect exposed installation interfaces in **ModX CMS** and **Revive Adserver**, highlighting a common web misconfiguration that can leave setup pages accessible after deployment. The ModX submission, pull request `#15757`, adds a template for identifying an unfinished installation page, while pull request `#15759` targets Revive Adserver instances exposing installer endpoints through two common installation wizard paths. Both templates were submitted by **DhiyaneshGeek** and were described as validated against vulnerable and non-vulnerable targets to improve true-positive accuracy and reduce false positives. Automated review reported no security issues in the Revive Adserver template, and the ModX template was marked **Done** and **Ready to merge**, while the Revive Adserver detection remained open pending human review from **theamanrawat**.
Jun 29, 2026