# ProjectDiscovery Nuclei Templates April 2026: detection coverage for exploited/KEV-listed CVEs (cPanel & WHM CVE-2026-41940, Langflow CVE-2026-33017, FortiClientEMS) and AI/LLM platforms

> ProjectDiscovery's April 2026 Nuclei release summary (v10.4.2 and v10.4.3) adds 226 templates covering 123 CVEs, including 10 exploited/KEV-listed CVEs in cPanel & WHM, Langflow, MajorDoMo, SmarterMail, Nginx UI, LMDeploy and FortiClient EMS. It also expands AI/LLM attack-surface coverage (Langflow, Flowise, Marimo, LiteLLM, ComfyUI and others).

- **Published:** 2026-10-31T01:14:54Z
- **Last reviewed:** 2026-10-31T01:14:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4870
- **ID:** TL-2026-4870
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940, CVE-2026-33017, CVE-2026-27174, CVE-2026-24423, CVE-2026-33032, CVE-2026-33626, CVE-2026-3844, CVE-2025-13390, CVE-2026-21643, CVE-2026-35616

## Description

ProjectDiscovery published its April 2026 Nuclei Templates summary on 2026-05-12. Two releases are covered: v10.4.2 (2026-04-15; 121 templates, 61 CVEs) and v10.4.3 (2026-05-05; 105 templates, 62 CVEs), for 226 new templates, 123 CVEs and 27 first-time contributors. This is a detection-coverage roundup rather than a single vulnerability report, so the value to defenders is the list of exploited CVEs that now have open-source detection templates.

The source lists ten exploited/KEV-listed CVEs: CVE-2026-41940 (cPanel & WHM session-file CRLF injection authentication bypass), CVE-2026-33017 (Langflow unauthenticated RCE, versions before 1.9.0), CVE-2026-27174 (MajorDoMo unauthenticated RCE), CVE-2026-24423 (SmarterMail RCE), CVE-2026-33032 (Nginx UI broken access control), CVE-2026-33626 (LMDeploy SSRF), CVE-2026-3844 (Breeze arbitrary file upload, 2.4.4 and earlier), CVE-2025-13390 (WP Directory Kit authentication bypass, 1.4.4 and earlier), CVE-2026-21643 (FortiClientEMS SQL injection, 7.4.4) and CVE-2026-35616 (FortiClient EMS authentication bypass). It also highlights 22 further critical/high issues, including Apache ActiveMQ (CVE-2026-34197, CVE-2026-40466), OpenAM (CVE-2026-33439), FortiSandbox (CVE-2026-39808), NocoBase (CVE-2026-34156), Marimo (CVE-2026-39987), Flowise (CVE-2025-59528), Cockpit (CVE-2026-4631), Cisco Secure Firewall Management Center (CVE-2026-20079) and Progress ShareFile (CVE-2026-2699).

Supplementary sources add mechanics for several of the listed CVEs. cPanel & WHM CVE-2026-41940 (CVSS 9.8, CWE-93) abuses the whostmgrsession cookie and raw CRLF characters injected via a basic authorization header so that unsanitized session files are written with attacker-chosen properties such as user=root; suspected zero-day exploitation began 2026-02-23, the patch shipped 2026-04-28 and CISA added it to KEV on 2026-04-30, with about 1.5 million exposed instances reported. Langflow CVE-2026-33017 (CVSS 9.8; CWE-94/95/306) is reachable via POST /api/v1/build_public_tmp/{flow_id}/flow, where an attacker-supplied data parameter replaces the stored flow and its Python code runs through exec() during graph construction; exploitation was seen about 20 hours after the 2026-03-17 advisory, the CVE was added to KEV on 2026-03-25, and attackers harvested environment variables, .env files and SQLite databases for AI-provider and cloud keys. Nginx UI CVE-2026-33032 ("MCPwn", CVSS 9.8) stems from the /mcp_message MCP endpoint lacking the auth middleware; it is fixed in 2.3.4. LMDeploy CVE-2026-33626 is an SSRF in the vision-language load_image() function (0.12.0 and earlier, fixed in 0.12.3) exploited about 12.5 hours after its 2026-04-21 advisory, including retrieval of AWS instance metadata credentials. SmarterMail CVE-2026-24423 (CVSS 9.8) is unauthenticated RCE via the ConnectToHub API in builds before 9511 and is used in ransomware attacks. FortiClient EMS CVE-2026-35616 affects 7.4.5/7.4.6 and was added to KEV on 2026-04-06. MajorDoMo CVE-2026-27174 (CVSS 10) combines a missing exit after redirect in the admin panel with eval() in the PHP console.

The ProjectDiscovery source supplies no CVSS scores, IOCs or attribution for the roundup, so no threat actor is attributed. Scoring is left null at the roundup level; severity is CRITICAL because of the KEV-listed, actively exploited designation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Command and Scripting Interpreter: Python
- T1059 Command and Scripting Interpreter
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1005 Data from Local System
- T1595.002 Active Scanning: Vulnerability Scanning

## Sources

- [Nuclei Templates - April 2026 (ProjectDiscovery)](https://projectdiscovery.io/blog/nuclei-templates-april-2026)
- [Rapid7: CVE-2026-41940 cPanel & WHM Authentication Bypass](https://www.rapid7.com/blog/post/etr-cve-2026-41940-cpanel-whm-authentication-bypass/)
- [SecurityWeek: Critical cPanel & WHM Vulnerability Exploited as Zero-Day for Months](https://www.securityweek.com/critical-cpanel-whm-vulnerability-exploited-as-zero-day-for-months/)
- [Help Net Security: cPanel zero-day exploited for months before patch release (CVE-2026-41940)](https://helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/)
- [CSA Research Note: CVE-2026-33017 Unauthenticated RCE in Langflow AI Pipelines](https://labs.cloudsecurityalliance.org/research/csa-research-note-langflow-cve-2026-33017-rce-20260330-csa-s/)
- [CSA Research Note: LMDeploy SSRF AI Inference Exploitation (CVE-2026-33626)](https://labs.cloudsecurityalliance.org/research/csa-research-note-lmdeploy-ssrf-ai-inference-exploitation-20/)
- [The Hacker News: LMDeploy CVE-2026-33626 flaw exploited](https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html)
- [NVD: CVE-2026-33032 (nginx-ui MCPwn)](https://nvd.nist.gov/vuln/detail/CVE-2026-33032)
- [SecurityWeek: Exploited Vulnerability Exposes Nginx Servers to Hacking](https://www.securityweek.com/exploited-vulnerability-exposes-nginx-servers-to-hacking/)
- [Help Net Security: Ransomware attackers are exploiting critical SmarterMail vulnerability (CVE-2026-24423)](https://www.helpnetsecurity.com/2026/02/06/ransomware-smartermail-cve-2026-24423/)
- [Resecurity: Critical MajorDoMo RCE CVE-2026-27174 Analysis](https://www.resecurity.com/en/blog/article/critical-majordomo-rce-cve-2026-27174-unauthenticated-remote-code-execution-analysis)
- [Nopal Cyber Threat Hunting Advisory: FortiClient EMS CVE-2026-35616](https://www.nopalcyber.com/threat-hunting-advisory/april-28th,-2026)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4870