Loading story…
ProjectDiscovery contributors submitted new Nuclei detection templates for two high-impact vulnerabilities: CVE-2025-27364, a remote code execution flaw affecting MITRE Caldera, and CVE-2025-22457, a stack-based buffer overflow affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways. The Caldera submission adds a community template for identifying exposure to the RCE issue, while the Ivanti submission adds version-based detection logic tied to product web portal pages.
The Ivanti flaw was described as a CVSS 9.0 vulnerability in X-Forwarded-For header processing and was reported as actively exploited in the wild by China-nexus threat actors, with references to Mandiant, Google TAG, and inclusion in CISA's Known Exploited Vulnerabilities catalog. The proposed Ivanti template checks for versions earlier than 22.7R2.6, giving defenders a way to quickly identify potentially exposed appliances, while the Caldera template expands scanning coverage for organizations using the adversary emulation platform.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A community contributor opened a pull request to add a Nuclei detection template for CVE-2025-22457. The proposed template performs version-based detection for vulnerable Ivanti Connect Secure, Policy Secure, and ZTA Gateway instances.
A community contributor opened a pull request to add a Nuclei detection template for CVE-2025-27364, described in the reference as a remote code execution issue affecting MITRE Caldera. The visible content does not provide earlier disclosure or exploitation details beyond the template submission.
CVE-2025-22457 was added to CISA’s Known Exploited Vulnerabilities catalog after being identified as actively exploited in the wild. Reporting cited Mandiant and Google TAG attributing exploitation to China-nexus threat actors.
Ivanti disclosed CVE-2025-22457, a stack-based buffer overflow in X-Forwarded-For header processing affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways. The issue impacts versions earlier than 22.7R2.6 and carries a CVSS score of 9.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery contributors submitted new Nuclei detection templates for two newly tracked vulnerabilities: **`CVE-2025-27364`**, described as an **unauthenticated remote code execution** flaw in **MITRE Caldera**, and **`CVE-2025-25291`**, an **authentication bypass** issue in **`ruby-saml`** affecting **GitLab SAML SSO** deployments. The references indicate both issues were significant enough to prompt rapid addition of scanning coverage in the public `nuclei-templates` repository. Available details remain limited because the source material is drawn from GitHub pull request metadata rather than full advisories, but the vulnerability labels point to potentially high-impact exposure in identity and adversary-emulation infrastructure. Security teams using **GitLab SAML single sign-on** or **MITRE Caldera** should track vendor guidance, validate exposure to **`CVE-2025-25291`** and **`CVE-2025-27364`**, and prepare to use updated detection content as part of vulnerability assessment workflows.
Jun 29, 2026
ProjectDiscovery's `nuclei-templates` repository added detection content for two remote code execution vulnerabilities: **CVE-2025-48703** affecting **CWP Control Web Panel** and **CVE-2025-51482** affecting **Letta AI**. One pull request identifies the CWP issue as an RCE flaw, while a second names an RCE path in Letta AI via the `/v1/tools/run` endpoint. The references indicate public detection coverage is being created for both issues, which can increase defender visibility as well as attacker awareness. The available material does not include affected versions, exploitation evidence, patch guidance, or victim impact, but it does confirm that both vulnerabilities were significant enough to warrant dedicated `nuclei` checks for internet-exposed systems.
Jun 29, 2026
Rapid7 submitted a Metasploit module for **Ivanti Connect Secure** that targets the chained vulnerabilities `CVE-2023-46805` and `CVE-2024-21887`, a combination widely associated with remote code execution on exposed appliances. The pull request indicates offensive security tooling has been updated to support exploitation of the authentication bypass and command injection chain, lowering the barrier for defenders and attackers alike to reproduce the issue in testing or live environments. A separate GitHub reference shows ProjectDiscovery adding a Nuclei template for `CVE-2025-4665`, identified as a **SQL injection** flaw in the **WordPress CFDB7** plugin. While the available material does not include exploitation details or patch guidance, both references show public security tooling rapidly incorporating newly disclosed vulnerabilities, increasing the urgency for organizations to identify exposed Ivanti gateways and vulnerable WordPress installations and apply mitigations or updates.
Jun 29, 2026