CVE-2026-104584
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.7%
from disclosure to weapon0 days
Published on NVDOct 13
1st PoCOct 9
exploitation probability
0.7%top 46% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via the custom_headers scan engine configuration field in web/reNgine/tasks.py (fetch_url and dir_file_fuzz functions).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 1
githubgithub.com/AmalJafarzade/CVE-2026-104584★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.