Test library

Every check SafeVibe runs

This table is generated from the scanner's own rule definitions, so it is exactly what runs. Passive website checks run on every scan; deep checks run only on sites whose ownership is verified; repository checks run on GitHub repos. The catalog grows by itself every hour. See how it learns. Catalog last synced 2026-11-13.

1,304

checks in total

965

in the self-growing catalog

passive website checks

181

repository checks

named CVEs

actively exploited (KEV)

ScopeCategorySeverityTechnologySource

Actively exploited only (CISA KEV)With a CVE id

1304 of 1304 checks

Severity	Check	Scope	Category	Technology	CVE	Source
High	Grafana Snapshot - Authentication Bypass GET /api/snapshots/:key, /dashboard/snapshot/:key	Website · deep	Known CVEs & vulns	grafana	CVE-2021-39226KEV	nuclei-templates
Medium	Joomla! Webservice - Password Disclosure GET /api/index.php/v1/config/application?public=true, /api/v1/config/application?public=t…	Website · deep	Known CVEs & vulns	joomla	CVE-2023-23752KEV	nuclei-templates
Critical	Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass GET /?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900	Website · deep	Known CVEs & vulns	wordpress	CVE-2026-18072	nuclei-templates
Critical	Apache APISIX Dashboard <2.10.1 - API Unauthorized Access GET /apisix/admin/migrate/export	Website · deep	Known CVEs & vulns	apache	CVE-2021-45232	nuclei-templates
Critical	Apache ShenYu Admin Unauth Access GET /plugin	Website · deep	Known CVEs & vulns	apache	CVE-2022-23944	nuclei-templates
Critical	baserCMS Installation - Exposure GET /	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	BlueImp jQuery-File-Upload - Arbitrary File Upload GET /jquery-file-upload/server/php/	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	CirCarLife - Installer GET /html/setup.html	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	CISA Known Exploited Vulnerabilities Actively exploited CVEs escalated to critical	Live intelligence	Live feeds	generic	—	Live feed
Critical	Committed .env file A .env file is committed to the repository. These hold production secrets and must never …	GitHub repo	Sensitive files	generic	—	Built-in
Critical	Committed credential store A git-credentials or kubeconfig file is committed. These hold plaintext tokens for your g…	GitHub repo	Sensitive files	generic	—	Built-in
Critical	Committed credentials JSON A credentials / service-account JSON file is committed. These usually grant broad cloud a…	GitHub repo	Sensitive files	generic	—	Built-in
Critical	Committed private SSH key A private SSH key is committed. Anyone with repo access can use it to impersonate you.	GitHub repo	Sensitive files	generic	—	Built-in
Critical	Compromised release: @ctrl/tinycolor@4.1.1, 4.1.2 Shai-Hulud npm worm (Sept 2025) — steals npm/GitHub/cloud tokens and republishes itself	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: @solana/web3.js@1.95.6, 1.95.7 Dec 2024 compromise — private-key exfiltration	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: ansi-regex@6.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: ansi-styles@6.2.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: backslash@0.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: chalk-template@1.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: chalk@5.6.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: coa@2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 Nov 2021 compromise — password stealer	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: color-convert@3.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: color-name@2.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: color-string@2.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: debug@4.4.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: error-ex@1.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, 10.1.7 July 2025 maintainer phishing (CVE-2025-54313) — Windows malware loader	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: event-stream@3.3.6 2018 flatmap-stream backdoor	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: has-ansi@6.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: is-arrayish@0.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: node-ipc@10.1.1, 10.1.2 Mar 2022 protestware — overwrites files	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: nx@20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 s1ngularity / Nx compromise (Aug 2025) — exfiltrated secrets via AI CLIs	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: rc@1.2.9, 1.3.9, 2.3.9 Nov 2021 compromise — password stealer	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: simple-swizzle@0.2.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: slice-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: strip-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: supports-color@10.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: supports-hyperlinks@4.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: ua-parser-js@0.7.29, 0.8.0, 1.0.0 Oct 2021 compromise — cryptominer & password stealer	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Compromised release: wrap-ansi@9.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer)	GitHub repo	Supply chain	npm	—	Curated advisories
Critical	Database error from crafted input (SQLi precondition) Single quote in a query parameter	Website · deep	Injection	generic	—	Built-in
Critical	DigitalOcean Key Exposure via Axiom GET /.axiom/accounts/do.json	Website · deep	Exposed files	generic	—	nuclei-templates
Critical	Docker Container - Misconfiguration Exposure GET /images/json	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=, /?alg_wc_ev_verify_emai…	Website · deep	Known CVEs & vulns	wordpress	—	nuclei-templates
Critical	Exposed admin / tool: Actuator /env (full config leak) GET /actuator/env	Website · deep	Admin panels	generic	—	Built-in
Critical	Exposed admin / tool: Actuator heap dump GET /actuator/heapdump	Website · deep	Admin panels	generic	—	Built-in
Critical	Exposed secret: Anthropic API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: AWS Access Key ID Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: AWS Secret Access Key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Azure Storage connection string Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Database URL with embedded password Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: DigitalOcean token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: GitHub token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: GitLab personal access token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Google Cloud service-account key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Groq API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: HashiCorp Vault token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: npm access token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: npm auth token in .npmrc Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: OpenAI API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: OpenRouter API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Perplexity API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: PlanetScale credential Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Private Key Block Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: PyPI upload token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Replicate API token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Shopify access token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Stripe (or Clerk) live secret key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Supabase personal access token Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: Supabase secret key (sb_secret_) Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed secret: xAI (Grok) API key Regex on page + every JS bundle	Website · passive	Secrets	generic	—	Built-in
Critical	Exposed: AWS credentials file GET /.aws/credentials	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Database backup dump GET /backup.sql	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Database dump GET /dump.sql	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Development environment file GET /.env.development	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Environment file (.env) GET /.env	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Environment file backup GET /.env.backup	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Git credential store GET /.git-credentials	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Local environment file GET /.env.local	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Production environment file GET /.env.production	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: SSH private key GET /id_rsa	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: Terraform state GET /terraform.tfstate	Website · deep	Exposed files	generic	—	Built-in
Critical	Exposed: WordPress config backup GET /wp-config.php.bak	Website · deep	Exposed files	generic	—	Built-in
Critical	Firebase Realtime Database world-readable GET /.json?shallow=true	Website · deep	Backend rules	firebase	—	Built-in
Critical	Firebase rules allow public access allow … if true; / .read: true	GitHub repo	Backend rules	firebase	—	Built-in
Critical	Firestore collections readable without auth users, profiles, posts, messages, orders, chats	Website · deep	Backend rules	firebase	—	Built-in
Critical	Fork CMS - Installer GET /install/2	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	form-data < 2.5.4 / 3.0.4 / 4.0.4 Predictable multipart boundary allows parameter injection (CVE-2025-7783).	GitHub repo	Dependencies	npm	—	Curated advisories
Critical	GetSimple CMS - Installer GET /admin/install.php	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	GitHub Actions script injection Untrusted ${{ github.event.* }} in run/script	GitHub repo	CI/CD	github-actions	—	Built-in
Critical	GitLab CE/EE - Hard-Coded Credentials GET /users/sign_in	Website · deep	Known CVEs & vulns	gitlab	CVE-2022-1162	nuclei-templates
Critical	GitLab CE/EE - Information Disclosure GET /users/sign_in	Website · deep	Known CVEs & vulns	gitlab	CVE-2022-0735	nuclei-templates
Critical	Gogs (Go Git Service) - Installer GET /install	Website · deep	Misconfig & panels	generic	—	nuclei-templates
Critical	Hardcoded secret: Anthropic API key Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: AWS Access Key ID Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: AWS Secret Access Key Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: Azure Storage connection string Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: Database URL with embedded password Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: DigitalOcean token Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in
Critical	Hardcoded secret: GitHub token Regex on every text file (and git history)	GitHub repo	Secrets	generic	—	Built-in

Read-only by design

Every check is a single GET/HEAD request or a pattern match. Templates that exploit, fuzz, brute-force or send payloads are rejected when the catalog is built.

Generated once, kept current

Each source template is converted once and remembered in a ledger. Hourly syncs only process what is new or changed upstream, and refresh the actively-exploited flags.

Sources

ProjectDiscovery nuclei-templates (MIT), CISA KEV, OSV.dev, FIRST EPSS, OpenSSF malicious packages, curated advisories, and SafeVibe's AI researcher for brand-new CVEs.