टेस्ट लाइब्रेरी
SafeVibe की हर जाँच
यह तालिका स्कैनर के अपने नियमों से बनती है, इसलिए यह ठीक वही दिखाती है जो चलता है। पैसिव जाँचें हर स्कैन में चलती हैं; डीप जाँचें सिर्फ़ सत्यापित साइटों पर; रिपॉज़िटरी जाँचें GitHub रिपॉज़िटरी पर। कैटलॉग हर घंटे अपने-आप बढ़ता है। देखें यह कैसे सीखता है. कैटलॉग का पिछला सिंक: 2026-11-13।
1,304
कुल जाँचें
965
अपने-आप बढ़ने वाले कैटलॉग में
83
पैसिव वेबसाइट जाँचें
181
रिपॉज़िटरी जाँचें
75
नामित CVE
2
सक्रिय रूप से शोषित (KEV)
1304 में से 1304 जाँचें
| गंभीरता | जाँच | दायरा | श्रेणी | तकनीक | CVE | स्रोत |
|---|---|---|---|---|---|---|
| उच्च | Grafana Snapshot - Authentication Bypass GET /api/snapshots/:key, /dashboard/snapshot/:key | वेबसाइट · डीप | Known CVEs & vulns | grafana | CVE-2021-39226KEV | nuclei-templates |
| मध्यम | Joomla! Webservice - Password Disclosure GET /api/index.php/v1/config/application?public=true, /api/v1/config/application?public=t… | वेबसाइट · डीप | Known CVEs & vulns | joomla | CVE-2023-23752KEV | nuclei-templates |
| गंभीर | Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass GET /?_wplogin=35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900 | वेबसाइट · डीप | Known CVEs & vulns | wordpress | CVE-2026-18072 | nuclei-templates |
| गंभीर | Apache APISIX Dashboard <2.10.1 - API Unauthorized Access GET /apisix/admin/migrate/export | वेबसाइट · डीप | Known CVEs & vulns | apache | CVE-2021-45232 | nuclei-templates |
| गंभीर | Apache ShenYu Admin Unauth Access GET /plugin | वेबसाइट · डीप | Known CVEs & vulns | apache | CVE-2022-23944 | nuclei-templates |
| गंभीर | baserCMS Installation - Exposure GET / | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | BlueImp jQuery-File-Upload - Arbitrary File Upload GET /jquery-file-upload/server/php/ | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | CirCarLife - Installer GET /html/setup.html | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | CISA Known Exploited Vulnerabilities Actively exploited CVEs escalated to critical | लाइव जानकारी | Live feeds | generic | — | Live feed |
| गंभीर | Committed .env file A .env file is committed to the repository. These hold production secrets and must never … | GitHub रिपॉज़िटरी | Sensitive files | generic | — | Built-in |
| गंभीर | Committed credential store A git-credentials or kubeconfig file is committed. These hold plaintext tokens for your g… | GitHub रिपॉज़िटरी | Sensitive files | generic | — | Built-in |
| गंभीर | Committed credentials JSON A credentials / service-account JSON file is committed. These usually grant broad cloud a… | GitHub रिपॉज़िटरी | Sensitive files | generic | — | Built-in |
| गंभीर | Committed private SSH key A private SSH key is committed. Anyone with repo access can use it to impersonate you. | GitHub रिपॉज़िटरी | Sensitive files | generic | — | Built-in |
| गंभीर | Compromised release: @ctrl/tinycolor@4.1.1, 4.1.2 Shai-Hulud npm worm (Sept 2025) — steals npm/GitHub/cloud tokens and republishes itself | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: @solana/web3.js@1.95.6, 1.95.7 Dec 2024 compromise — private-key exfiltration | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: ansi-regex@6.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: ansi-styles@6.2.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: backslash@0.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: chalk-template@1.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: chalk@5.6.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: coa@2.0.3, 2.0.4, 2.1.1, 2.1.3, 3.0.1, 3.1.3 Nov 2021 compromise — password stealer | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: color-convert@3.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: color-name@2.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: color-string@2.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: debug@4.4.2 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: error-ex@1.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: eslint-config-prettier@8.10.1, 9.1.1, 10.1.6, 10.1.7 July 2025 maintainer phishing (CVE-2025-54313) — Windows malware loader | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: event-stream@3.3.6 2018 flatmap-stream backdoor | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: has-ansi@6.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: is-arrayish@0.3.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: node-ipc@10.1.1, 10.1.2 Mar 2022 protestware — overwrites files | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: nx@20.9.0, 20.10.0, 20.11.0, 20.12.0, 21.5.0, 21.6.0, 21.7.0, 21.8.0 s1ngularity / Nx compromise (Aug 2025) — exfiltrated secrets via AI CLIs | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: rc@1.2.9, 1.3.9, 2.3.9 Nov 2021 compromise — password stealer | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: simple-swizzle@0.2.3 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: slice-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: strip-ansi@7.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: supports-color@10.2.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: supports-hyperlinks@4.1.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: ua-parser-js@0.7.29, 0.8.0, 1.0.0 Oct 2021 compromise — cryptominer & password stealer | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Compromised release: wrap-ansi@9.0.1 Sept 2025 chalk/debug compromise (browser crypto-wallet drainer) | GitHub रिपॉज़िटरी | Supply chain | npm | — | Curated advisories |
| गंभीर | Database error from crafted input (SQLi precondition) Single quote in a query parameter | वेबसाइट · डीप | Injection | generic | — | Built-in |
| गंभीर | DigitalOcean Key Exposure via Axiom GET /.axiom/accounts/do.json | वेबसाइट · डीप | Exposed files | generic | — | nuclei-templates |
| गंभीर | Docker Container - Misconfiguration Exposure GET /images/json | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass GET /my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=, /?alg_wc_ev_verify_emai… | वेबसाइट · डीप | Known CVEs & vulns | wordpress | — | nuclei-templates |
| गंभीर | Exposed admin / tool: Actuator /env (full config leak) GET /actuator/env | वेबसाइट · डीप | Admin panels | generic | — | Built-in |
| गंभीर | Exposed admin / tool: Actuator heap dump GET /actuator/heapdump | वेबसाइट · डीप | Admin panels | generic | — | Built-in |
| गंभीर | Exposed secret: Anthropic API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: AWS Access Key ID Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: AWS Secret Access Key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Azure Storage connection string Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Database URL with embedded password Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: DigitalOcean token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: GitHub token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: GitLab personal access token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Google Cloud service-account key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Groq API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: HashiCorp Vault token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: npm access token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: npm auth token in .npmrc Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: OpenAI API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: OpenRouter API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Perplexity API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: PlanetScale credential Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Private Key Block Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: PyPI upload token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Replicate API token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Shopify access token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Stripe (or Clerk) live secret key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Supabase personal access token Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: Supabase secret key (sb_secret_) Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed secret: xAI (Grok) API key Regex on page + every JS bundle | वेबसाइट · पैसिव | Secrets | generic | — | Built-in |
| गंभीर | Exposed: AWS credentials file GET /.aws/credentials | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Database backup dump GET /backup.sql | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Database dump GET /dump.sql | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Development environment file GET /.env.development | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Environment file (.env) GET /.env | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Environment file backup GET /.env.backup | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Git credential store GET /.git-credentials | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Local environment file GET /.env.local | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Production environment file GET /.env.production | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: SSH private key GET /id_rsa | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: Terraform state GET /terraform.tfstate | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Exposed: WordPress config backup GET /wp-config.php.bak | वेबसाइट · डीप | Exposed files | generic | — | Built-in |
| गंभीर | Firebase Realtime Database world-readable GET /.json?shallow=true | वेबसाइट · डीप | Backend rules | firebase | — | Built-in |
| गंभीर | Firebase rules allow public access allow … if true; / .read: true | GitHub रिपॉज़िटरी | Backend rules | firebase | — | Built-in |
| गंभीर | Firestore collections readable without auth users, profiles, posts, messages, orders, chats | वेबसाइट · डीप | Backend rules | firebase | — | Built-in |
| गंभीर | Fork CMS - Installer GET /install/2 | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | form-data < 2.5.4 / 3.0.4 / 4.0.4 Predictable multipart boundary allows parameter injection (CVE-2025-7783). | GitHub रिपॉज़िटरी | Dependencies | npm | — | Curated advisories |
| गंभीर | GetSimple CMS - Installer GET /admin/install.php | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | GitHub Actions script injection Untrusted ${{ github.event.* }} in run/script | GitHub रिपॉज़िटरी | CI/CD | github-actions | — | Built-in |
| गंभीर | GitLab CE/EE - Hard-Coded Credentials GET /users/sign_in | वेबसाइट · डीप | Known CVEs & vulns | gitlab | CVE-2022-1162 | nuclei-templates |
| गंभीर | GitLab CE/EE - Information Disclosure GET /users/sign_in | वेबसाइट · डीप | Known CVEs & vulns | gitlab | CVE-2022-0735 | nuclei-templates |
| गंभीर | Gogs (Go Git Service) - Installer GET /install | वेबसाइट · डीप | Misconfig & panels | generic | — | nuclei-templates |
| गंभीर | Hardcoded secret: Anthropic API key Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: AWS Access Key ID Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: AWS Secret Access Key Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: Azure Storage connection string Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: Database URL with embedded password Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: DigitalOcean token Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
| गंभीर | Hardcoded secret: GitHub token Regex on every text file (and git history) | GitHub रिपॉज़िटरी | Secrets | generic | — | Built-in |
डिज़ाइन से रीड-ओनली
हर जाँच एक GET/HEAD अनुरोध या एक पैटर्न खोज है। जो टेम्पलेट एक्सप्लॉइट, फ़ज़िंग, ब्रूट फ़ोर्स करते हैं या पेलोड भेजते हैं, वे कैटलॉग बनाते समय अस्वीकार हो जाते हैं।
एक बार बने, हमेशा अपडेट
हर स्रोत टेम्पलेट सिर्फ़ एक बार बदला और दर्ज किया जाता है। हर घंटे के सिंक सिर्फ़ नई या बदली चीज़ें प्रोसेस करते हैं और सक्रिय शोषण के निशान अपडेट करते हैं।
स्रोत
ProjectDiscovery nuclei-templates (MIT), CISA KEV, OSV.dev, FIRST EPSS, OpenSSF के मैलिशियस पैकेज, चुनी हुई सुरक्षा सलाह और नवीनतम CVE के लिए SafeVibe का AI रिसर्चर।